6

The closing of this question perplexes me. I understand that the question it is supposedly a duplicate of--How do I deal with a compromised server? --is basically the canonical question on here about what can be done to remediate any potentially/known-compromised server with a full, general-purpose OS on it. (And perhaps it is for general-purpose PCs as well.) And I don't think I have any real issue with it being that. But is it really the judgment of the community that dealing with a potentially compromised modem or router--especially a SOHO modem/router--is almost exactly the same thing, at a practical level, as dealing with a compromised server?

If so, I'd definitely appreciate some more guidance about what types of computational device compromises don't fall within the scope of that canonical question, at least when we're talking about the purpose of closing a new question as a duplicate of it. Cause (as someone who has done both many home/small biz gigs and some corporate-scale work) I honestly do have some trouble seeing the almost "exact" practical ( vs. theoretical) similarity myself in the case of remediating SOHO routers vs. enterprise servers.

| |
  • I've made an equivalent question about compromised routers we can use as a duplicate target. Feedback always welcome. – André Borie Oct 1 '16 at 9:25
  • @AndréBorie: I think that is a good start but some consideration should be given to those circumstances where the device CANNOT be factory reset. Perhaps because it is locked by the provider (typically a large ISP). – Julian Knight Oct 7 '16 at 19:28
5

In general, and this is why I agreed with the flags and other close votes, a compromised device is a compromised device. It needs to be removed from service, imaged (if forensic investigation is going to be carried out), wiped, and rebuilt from new or from backup. There is little to be gained from trying to distinguish between a server, desktop computer or network device in most cases.

A router does carry an OS, and in many cases this isn't dramatically stripped down from a server OS. Ideally it just has the functions it requires to service its role, but this is not always the case.

Even where the router is carrying a minimalist OS, the core activities to recover from compromise are the same.

| |
  • 2
    Thanks for the reply. In terms of a "compromised device being a compromised device", I would tend to agree with you...from a theoretical, computer-science standpoint. Anything that has a processor of some kind, some memory, and access to some programmable storage somewhere has fundamental similarities to everything else that does. But from a very practical standpoint of actually giving directions to someone for concrete remediation action steps to take the differences can be massive. I guess I find that "pragmatic" side of the issue more controlling But I appreciate your view as well. – mostlyinformed Sep 29 '16 at 7:19
  • I agree, while this view is "correct" from a theoretical viewpoint, it isn't necessarily our place to enforce this on people who may be unable to replace or factory reset devices for whatever reason. They may for example be better served with ammunition to go back to their ISP as only the ISP may be in a position to actually do anything (e.g. with locked home routers). – Julian Knight Oct 7 '16 at 19:24
5

My name shows up as one of the close voters of that question, but I did not vote to close it as a duplicate and I don't think it is a duplicate. I voted to close it as to broad.

Here are some things that taken together makes it a different question in my opinion:

  • A home use scenario v. a proffessional server scenario requires answers on different levels.
  • While both a server and a router are in fact computers, from the perspective of the OP the similarities and parallells are not obvious.
  • The OP specifically says that they "cannot reset & back-up ISP modem". To tell someone to reset and back-up their modem is clearly not an answer to that... Even if you disagree with the above points, come on, you have to be with me on this one.
  • Taken together, I don't think the OP or a similar person in a simliar situation would be helped by the duplicate question.

Still, the quesion deserved to be closed because it is very broad (and unclear as well). It is basically "I have a mess, how do I clean it up", not "I have a specific problem, how do I solve it".

But the close reason matters, a lot. It is how we communicate to the OP and that very important for their user experience. In this case, I think we picked the wrong one.

| |
  • 1
    Thanks for the response. I'd agree, it definitely was unclear/vague, in the "I have a mess. How do I clean it up?" kind of way. I think this is a case where a close reason matters (I'm sure there are plenty of worse questions that could be closed on multiple/many different good grounds), because the response "Your question is too broad, vague, and/or unclear." might be fixable by the asker, vs. not if "All computing devices are the same. Therefore, your question about remediating a computing device is actually the same one as this other question about remediating a computing device.". – mostlyinformed Sep 29 '16 at 7:40
  • Yes, I very much believe that closing questions are just as much about educating the reason as it is about keeping the site clean. – Anders Sep 29 '16 at 10:04
  • 1
    Anders - you do make a very good point, and to be honest, in seeing the various flags I was withering between those for Too Broad, and those for Dupe. – Rory Alsop Oct 3 '16 at 13:40
  • Agree that the close reason is wrong. Should someone say so in the comments? – Julian Knight Oct 7 '16 at 19:25
  • @JulianKnight I added a link to this discussion in the comments. – Anders Oct 7 '16 at 21:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .