Chronology (4)
On Monday, heard that other Univ systems had been compromised too
I split the Dept network into “inside”/”outside”
Systems or clusters of systems were secured, moved from “inside” to “outside” as soon as practical
Problems with loosely managed research systems
Finally re-instated complete network connectivity (after several days).
Liaison with Univ, CERT, [******] staff
Notes:
On Monday we were informed that other University systems had also been compromised, including Computer Science and the Computing Service.
Being unclear whether a Trojan Horse had been installed, we decided we had to leave our systems off the Internet until they had been secured.
Computing Service also applied strong filters to their external routers while assessing the problem, and during the first couple of days recovery,
Within the Dept, I split our network into two disjoint parts, and only moved systems (or clusters of systems) onto the “outside” part when they had been investigated and were felt to be reasonably secured.
This was of course a major inconvenience to everyone.
Some systems in research groups were loosely managed, e.g the person who had set them up had since departed and no-one understood them well - this made for extra difficulty. For one system, no-one knew the root password, and it had to be disconnected entirely, pending their making further investigations.
These few days went like a nightmare, and I can no longer tell you in detail what individual steps were taken, but we had finally re-connected the whole of our network to the “outside world” after several days.
[******] reported that the PC in question had been secured: although the installation of LINUX for a student project had been properly authorised, there had been no intention for it to be a hacker’s base of operations!