This week was full of twists and turns for our systems. It all began with a routine mission: securing the design schematics of our mountain robots.
Act 1: The Digital Vault
The first step was setting up impenetrable storage. Using LUKS (Linux Unified Key Setup), we created an encrypted volume on /dev/sdb. The trick? Don't stop at encryption — add an active security layer with the noexec mount option. Result: even if an intruder managed to drop malware there, it would stay as inert as a yak in the snow.
Act 2: The AIDE Alert But security isn't a steady state, it's constant vigilance. Thanks to AIDE, our intrusion detector, an anomaly was flagged. Someone had modified system files!
Act 3: Pulling the Thread
The investigation was gripping. Tracing the trail back, we found a malicious script named backup.sh. This wasn't a simple backup tool — it was a backdoor exfiltrating our passwords (/etc/shadow).
The attacker had been clever, using a Systemd Timer (backup.timer) to trigger the attack intermittently and a hidden encrypted volume (backup.img) to stash the loot.
Lessons learned:
Integrity is key: Without a tool like AIDE to compare the system's "healthy" state to its current state, the attack could have gone on for months.
Beware of "standard" services: A name like "backup" is the perfect camouflage. Always check the content of
systemdunits.Visibility above all: Encryption protects your data, but it can also be used to hide the data being stolen from you.
See you Monday for new challenges in network security!