Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 1 Aug 2001 10:21:01 -0500 
From:      "Schlosser, Matt D." <mschlosser@eschelon.com>
To:        'Maximum' <m-a-x-i-m-u-m@mail.ru>, "'freebsd-security@freebsd.org'" <freebsd-security@freebsd.org>
Subject:   RE: Trojan injected in my Freebsd 4.1-RELEASE
Message-ID:  <2FA3BA0C7551724CA6DDF4E345360505049EF1@walleye.corp.fishnet.com>

next in thread | raw e-mail | index | archive | help
If all you want to do is play with the hacker and not boot them, the best
thing you can do is take careful steps in making sure they don't know you
know.  Don't do anything out of the ordinary that the other person might
notice, do things quietly secretly. Stick the machine on a hub with another
machine and have that machine sniff for traffic on that port.  Then the
person will not see you looking for them.   With luck, you can build a
sandbox around them without their knowledge.  Could be a fun project.

nrfbsdrk v0.1 by gREMLiNs means rootkit.  This person doesn't seem very good
since your security report told you they were there. Probably script kiddie
turned dorm rat.

-----Original Message-----
From: owner-freebsd-security@FreeBSD.ORG
[mailto:owner-freebsd-security@FreeBSD.ORG]On Behalf Of Maximum
Sent: Wednesday, August 01, 2001 9:24 AM
To: freebsd-security@freebsd.org
Subject: Trojan injected in my Freebsd 4.1-RELEASE



 Hi everybody,

today I've got security report from my FreeBSD box that some suid files
changed. That was /usr/bin/netstat, /usr/bin/fstat and /usr/bin/quote.

Using chkproc programm from Nelson Murilo found at pangeia.com.br I found
one stealth process. Running clean ps command i found ssh daemon sshd daemon
named 'swapper' in process list. This daemon is attached to 50505 port. Also
i found directory with other hacker's scripts and one of them contained full
list of changed binaries
that was : ps,ls,netstat,fstat,ldconfig and telnetd

Examining logs I had not found any records about visit of hacker. Wtmp was
cleared 5 hours back from time of created hackers scripts.

I'm going not only remove this trojan from my box, but find from where
attack was made and the way attack was made.

Now I wrote small script that will run clean netstat and grep from output
any connections to 50505 port and telnet port. This scripth I had included
in my crontab and cron runs it every minute.

This way I hope to find from where that man connects to me.

Do you have any other suggestions to help me find how hacker injected trojan
?

In one of shell script I'm talking about i found copyright mark "nrfbsdrk
v0.1 by gREMLiNs".

Thank you.

Maxim Sorokin

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2FA3BA0C7551724CA6DDF4E345360505049EF1>