Barry O’Donovan says, a little over two years ago I was hacked. Someone broke into a web server I was administrating that had only Apache and OpenSSH running publically, and all packages were up-to-date. The hacker replaced my ps binary with his own to hide his processes, added a new service that was executed from the binary “/bin/crond ” (the space is intentional – it makes it look like a normal and an expected process in a running-processes listing and a normal binary in a directory listing). The “crond ” process gathered usernames and passwords and stored them in a text file in the directory “/dev/pf0 / /”, (5 and 2 spaces respectively), which also contained a root shell. The chances of me finding and identifying this intrusion would have been extremely remote if I had not been running Tripwire. Read more.