Host Integrity Monitoring Using Osiris and Samhain

Preface

In February 2004, portions of Microsoft’s source code for Windows NT and Windows 2000 were posted to Internet Relay Chat (IRC) chat rooms and eventually all over the Internet. In March 2004, Cisco took a similar blow when a Russian Web site reported that roughly 800MB of Cisco’s IOS source code had been stolen. In the following days, an analysis of the stolen material revealed that it was taken from one of Cisco’s Sun servers; thus, it is reasonable to conclude that it was taken from within Cisco’s corporate network. In August 2003, the primary File Transfer Protocol (FTP) servers for the GNU project were compromised and all of the source code packages they served were at risk.

What is interesting about all three of these incidents ...