The Reverse Challenge
An unauthorized program, place place by a malicious user, has been found on at least on of the
machines in the univerisy. This document will provide:
- How it works
- The threat
1. How it works
The program is a server that listen for commands embedded in IP packets with a protocol of 11.
These commands allow the external user to generate Denial of Service attacks with TCP SYN packets,
DNS queries, and ICMP and UDP packets. In addtion, the user can execute commands, get a root
shell, and check on whether and which attack is running. The shell access is accomplished via tcp
2. The threat
The threat level of this program is very high. Any infected computer must be assumed to be fully
compromised since the intruder has full access to the machine. Any traffic on the network segment
may also have been seen. As with any DoS attack, there is additional load on our network resources
as well as the threat to the target(s) them selves.
A running instance of the program can be determine by using netstat --raw -na to look for
any raw sockets with protocol 11. Running instances of the program change their command string to
"[mingetty]". Detection of the binary file will require a thorough search of
the hard drives. Properties of the binary that may be useful for the search include.
Any suspected programs should be saved for further study.
- size = 205108
- cksum = 2513943409
- md5sum = 1d726de4f7fe7e580c8fad4b3e4703f6
- contain the string "[mingetty]"
- contain the string "The Linux C library 5.3.12"
In addition to standard security measures there are several steps that can be taken. First, look
for any network traffic using IP protocol 11 (or better, any non-standard protocol), any mal-formed
ip headers (ie frament clear with non-zero fragment offset), and tcp connections to port 23281.
This will catch some of the traffic used by this program.
To avoid this program being started accidentaly, all system not currently running
tripwire or other similar software
should have it install. The configuration on all machines should be checked to insure that
they are up to date.