Re: FW: OK, I've been hacked, now what?

[Crispin Cowan <crispin () cse ogi edu>]

kevin.sheldrake () baedsl co uk wrote:

> I assume that Tripwire tracks changes to files.  How does it
> distinguish between normal,
> everyday system usage and unauthorised access?

It has a heuristic for files that are "likely" to change (joe.user's
mailbox) and files that are "unlikely" to change (the login
executable).  It then gives you a report of the "surprising" file
changes, and you get to decide whether you care.  Naturally, this is
configurable.


> Is it available
> for NT Server 4, NT
> Workstation 4, DEC Unix, Solaris?

Yes, yes, probably, and yes:  http://www.tripwiresecurity.com/

Crispin
-----
 Crispin Cowan, Research Assistant Professor of Computer Science, OGI
    NEW:  Protect Your Linux Host with StackGuard'd Programs  :FREE
       http://www.cse.ogi.edu/DISC/projects/immunix/StackGuard/

                 Support Justice:  Boycott Windows 98