[iwar] [fc:]

From: Fred Cohen (fc@all.net)
Date: 2001-11-12 11:17:58
Next message: Fred Cohen: "[iwar] [fc:Chilling.Effects.of.Anti-Terrorism]"
Previous message: Fred Cohen: "Re: [iwar] Request for information"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200111121917.fACJHxu21303@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Mon, 12 Nov 2001 11:17:58 -0800 (PST)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

...
I am making this notification to assist in determining whether other
folks have been affected by this attack.

An associate's home NAT gateway linux box was hacked by what I am
guessing was the ssh1 crc bug (ssh1 was the only exposed service). 
This machine looks to have been compromised on Nov 2nd at 1:15pm PST, I
won't know for certain until I obtain his hard disk later today, and
provided that /var logging is recoverable.  This machine was running
redhat 6.2, reasonably patched except for the fact that he was still
running ssh1.

It appears that someone may be building up a network of (potentially)
DDOS hosts.  I have done some quick research and found no matches for
the signatures I have been able to identify so far.

Using the Chkrootkit (www.chkrootkit.org) utilities did not identify
a known trojan pack, so if this isn't identified in the wild, I'm
already referring to it as the LIMPninja.

It also appears that this particular host was used as a central host
for other LIMPninja zombies.  Also, haven't been able to determine
what the command structure it is that the remote bots act upon.

The following is by no means complete, even after a full examination
of the drive has been completed, as there was never any file
integrity base line completed(a shame).

The attack appears to be scripted as all changes happened within a
minute, except for the IRC server which was not installed until 2
days later (and manually).  When I found this particular irc net
there were over 120 hosts all communicating via IRC.  This host was
found to be running an unrealircd daemon from /usr/bin/bin/u/src/ircd
listening at port 6669.

All other compromised hosts were joining this irc network
(ircd.hola.mx  holad) on channel #kujikiri with a channel key of
'ninehandscutting'.  All bots joined as the nick ninjaXXXX where XXXX
is some RANDOM? selection of 4 upper case letters.  

Several ports were listening
3879	term (this port had an ipchains rule blocking all external
traffic - placed by the attacker's script)
6669	ircd
9706	term
42121	inetd spawned in.telnetd


Logs were wiped, and couldn't find a wiping utility so I'm thinking a
simple rm or unlink was used, so I'm hoping to find more details when
the disk is in hand.  File modifications that were made follow:(not
necessarily a complete analysis yet)

clearly Trojaned binaries (probably others)
/bin/ps
/bin/netstat
/bin/ls  (this ls binary was hiding several things, directory
structures named /u/, mysqld klogd ...)
/usr/local/bin/sshd1  (the file was just several hundred bytes larger
than previously)


Binary file/directory additions
/usr/bin/bin/u/ 	An entire directory structure containing the ircd
server source 
/usr/bin/share/mysqld   (looks like some type of irc spoofing proxy)
/bin/klogd		(almost looks like an ftp proxy)
/bin/term		(A bindshell of some sort)
/usr/sbin/init.d 	was added and is exactly the same file size as term

System configuration files that were modified/added
/etc/hosts.allow	made specific allowances for the .dk domain, as well
as .cais.net .cais.com
/etc/passwd	two new accounts were added with the same password (des
hashes -NOT MD5)
/etc/shadow	The added accounts were lpd 1212:1212, and admin 0:0
/etc/inetd.conf 200+ lines of whitespace added, and then the single
telnet entry
/etc/services	was modified for telnet to start on port 42121
/etc/resolv.conf a new nameserver was added... 
/etc/psdevtab   haven't examined closely yet
/etc/rc.sysinit	 a line was added to start the /usr/sbin/init.d  
trojan/backdoor
/etc/rc.local	after much whitespace was added.... following lines at
the bottom of the rc.local file

	killall -9 rpc.statd
	killall -9 gdm
	killall -9 gpm
	killall -9 lpd
	term
	klogd
	"/usr/bin/share/mysqld"
	/sbin/ipchains -I input -p tcp -d 0/0 3879 -j DENY


Hope this helps other folks who will or have already encountered this
attack.

sorry for the ramble... It's been a long night

- - -- 
William Salusky
Manager: Security Services
DMZ Services
<a href="mailto:change@dmzs.com?Subject=Re:%20Fwd:%20Possible%20DDOS%20network%20being%20built%20through%20ssh1%20crc%20compromised%20hosts%2526In-Reply-To=%2526lt;E163Joz-0004Sp-00@johnnyjohnny.dmzs.com">change@dmzs.com</a>

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:Chilling.Effects.of.Anti-Terrorism]"
Previous message: Fred Cohen: "Re: [iwar] Request for information"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-12-31 20:59:59 PST