Umeet :: Presentation

Talk

20031219-3.en

`_libra_`	`i´ll made an study case about this`
`_libra_`	`and you´ll learn why i did choose that trojan that i´ll comment later`
`_libra_`	`later i´ll talk about simple solutions`
`_libra_`	`but that will help us to stop the inserion of trojans into our system`
`_libra_`	`about definions:`
`_libra_`	`cracker, will be the person who only intrude into a system`
`_libra_`	`hacker, the person who writes the code, no matter if its for bad things`
`_libra_`	`lets start`
`_libra_`	`like all in this world evolute`
`_libra_`	`the technics used by the operating systems to improve its "rendimiento"`
`_libra_`	`and presence`
`_libra_`	`but also hackers evolve`
`_libra_`	`that improve itss codes and the hide ways`
`_libra_`	`in example`
`_libra_`	`some thime ago`
`_libra_`	`trojans were completly programed for a reason`
`_libra_`	`it was a program that made something while the user dont knew what`
`_libra_`	`something like today viruses`
`_libra_`	`and we also have backdoors`
`_libra_`	`those made a user arrive quikly`
`_libra_`	`i the ancient, 5 years ago more or less`
`_libra_`	`system programers installed backdoors`
`_libra_`	`in its programs to save time`
`_libra_`	`but sacrifycing the security of their systems`
`_libra_`	`some thime they forgot to erase its backdoors`
`_libra_`	`which were dicovered by other people`
`_libra_`	`in some time, simple backdoor were saw`
`_libra_`	`they were simple to be detected`
`_libra_`	`in example`
`_libra_`	`in the file /etc/services some lines like this were put`
`_libra_`	`" backdoor 31337/tcp"`
`_libra_`	`and in the /etc/inet.conf file "backdoor stream tcp nowait root /bin/bash -i"`
`_libra_`	`later, if you open a shell in the por 31337 in wich whoever could be connected, he/she would have root privileges`
`_libra_`	`this kind of ancient backdoors were easy tobe detected`
`_libra_`	`but no to the unexperienced administrators`
`_libra_`	`and, in another example`
`_libra_`	`adding a line to the /etc/passwd file whith root privileges like that: krocz:x:0:0:root:/root:/bin/bash`
`_libra_`	`and if you were logged into with the krocz user you got root`
`_libra_`	`now, it has changed`
`_libra_`	`whith the techniques used by viruses`
`_libra_`	`new backdoor have been made, mixing techniques used bny viruses have become trojans`
`_libra_`	`because we execute programs without knowing wath they´re gonna do`
`_libra_`	`that will be explained`
`_libra_`	`now theres no diference within virus and trojan`
`_libra_`	`talking about the linux context`
`_libra_`	`tachniques like library redirections`
`_libra_`	`explained at the Silvio Cesare phrack article http://www.phrack.org/phrack/56/p56-0x07`
`_libra_`	`theres another interesting http://www.phrack.org/phrack/61/p61-0x0a_Infecting_Loadable_Kernel_Modules.txt`
`_libra_`	`trojanization has change, and the technique will see talks about /dev/kmen infection`
`_libra_`	`http://www.phrack.org/phrack/58/p58-0x07`
`_libra_`	`http://www.phrack.org/phrack/58/p58-0x07`
`_libra_`	`those are some of the techniques used by trojans`
`_libra_`	`to be installed in the system, more than trojan, rootkits`
`_libra_`	`rootkits are programs installed in a system to hide the presence of an atacker in a system`
`_libra_`	`like its said in #qc`
`_libra_`	`there are some articles here`
`_libra_`	`> http://www.est.cl/phrack/p61-0x0a.txt ( en castellano )`
`_libra_`	`<krocz> <redyuck> http://www.est.cl/phrack/phrack58-0x07.txt`
`_libra_`	`and like i said, the technique that ill talk about later and its very complicated is that of the kernel image infection`
`_libra_`	`http://www.phrack.org/phrack/60/p60-0x08.txt`
`_libra_`	`when a atacker break into a system`
`_libra_`	`what always try is to be hide for the administrator`
`_libra_`	`a simple way of do it is by creating directories into the /dev directory`
`_libra_`	`and installing there its tools`
`_libra_`	`tools with suid root`
`_libra_`	`that when are executed with root privileges`
`_libra_`	`that kind of programs are simple detected`
`_libra_`	`with a find / -perm +4000 command`
`_libra_`	`youll find several programs with suid root`
`_libra_`	`administrator must know what of this programs should have permises`
`_libra_`	`<redyuck> or with chkrootkit ) <- ill show why it isnt efficient several time`
`_libra_`	`the idea, is to be hidden for the administrator`
`_libra_`	`ancient rootkits changed the more used commands`
`_libra_`	`to hide conections, process, and that kind of things`
`_libra_`	`they changed the /bin/login to detect the pass introduced by the users who were in the system`
`_libra_`	`or changing the ps to hide process executed by the cracker`
`_libra_`	`or commands like netstat`
`_libra_`	`tripwire easy detected this rootkits`
`_libra_`	`or with md5sum`
`_libra_`	`to the files and comparing with others`
`_libra_`	`we get the hash that wasnt the same than the origianl`
`_libra_`	`like it has been said`
`_libra_`	`chrootkit is a very commented tool`
`_libra_`	`used to detect anomalies in the system`
`_libra_`	`http://www.chkrootkit.org`
`_libra_`	`i think you can trust very much on this tool`
`_libra_`	`you´ll see with this lines`
`_libra_`	`if ${egrep} -i adore < /proc/ksyms >/dev/null 2>&1; then`
`_libra_`	`<krocz> echo "Warning: Adore LKM installed"`
`_libra_`	`<krocz> fi`
`_libra_`	`with this you see if there exist the LKM-rootkits adore`
`_libra_`	`with could be false`
`_libra_`	`what could be false`
`_libra_`	`or this`
`_libra_`	`${strings} ${ROOTDIR}sbin/init \| ${egrep} HOME"`
`_libra_`	`with this you try t search the string HOME in /sbin/init`
`_libra_`	`the HOME string is used by the suckit rootkit`
`_libra_`	`if it dont find that string, it will supose that the suckit trojan wasnt installed`
`_libra_`	`if it dont find that string, it will supose that the suckit trojan wasnt installed`
`_libra_`	`it dont know that you could detect some changes comparing the md5 hashes`
`_libra_`	`chrootkit told me i has a trojan installed, jus because i has 4 hiden process`
`_libra_`	Checking `lkm'... You have 4 process hidden for ps command
`_libra_`	`later ill saw it wash a problem of the procfs installed in my debian`
`_libra_`	`who has problems`
`_libra_`	`now, we are gonna study how do rootkits works`
`_libra_`	`i read the new about the intrusion into the debian´s servers`
`_libra_`	`i read the new about the intrusion into the debian´s servers`
`_libra_`	`i think you know how it was made`
`_libra_`	`: D`
`_libra_`	`but what is important is that intruders used trojans and suckit to hide its presence`
`_libra_`	`some reason should be if their used this trojan`
`_libra_`	`in http://www.exis.cl/present/umeet/pre.html`
`_libra_`	`i´ve made a descrption of a probe that i´ve done`
`_libra_`	`to demostrate what im exposing`
`_libra_`	`we´ll see that the first step was execute an hash md5 into the /sbin/init`
`_libra_`	`that is who modifies suckits when it is installed into the system`
`_libra_`	`later, i become infected with the trojan-rootkit`
`_libra_`	`executed the backdoor "./sk"`
`_libra_`	`and i return to made a hash md5 at /sbin/init`
`_libra_`	`but, surprise, the hash hasent changed`
`_libra_`	`this hide way made it also undetectable to tripwire`
`_libra_`	`the trojan works by /dev/kmen`
`_libra_`	`like has been said before`
`_libra_`	`this file contains the kernel image in memory`
`_libra_`	`the file has write permises`
`_libra_`	`suckuit search the directions of the Syscall table`
`_libra_`	`and modifies it`
`_libra_`	`modifiing what it need`
`_libra_`	`with this, it can avoid md5 compare`
`_libra_`	`this technique is shown in the 7a69 ezine, in the article wrote by IReick`
`_libra_`	`article number 9`
`_libra_`	`suckit modifies /sbin/init`
`_libra_`	`to be loaded if the machine is reset`
`_libra_`	`this rootkit has a client used to be conected with the machine infected with suckit`
`_libra_`	`avoiding log`
`_libra_`	`sendind a binary package to an open port`
`_libra_`	`and, beacuse the suckuit is at the kernel level, it is detected and compare the hash password to see if is like the one he has`
`_libra_`	`installed`
`_libra_`	`if they are equal, send a conection to a atacker listen mode port`
`_libra_`	`this is also know as reverse telnet`
`_libra_`	`is with this that firewalls are avoided`
`_libra_`	`because the conection is made by the machine infected`
`_libra_`	`and the package can go to every port, binary or ascii`
`_libra_`	`or if it is bahind a nat`
`_libra_`	`it is procesed in the kernel level`
`_libra_`	`withou being logged`
`_libra_`	`and without encription`
`_libra_`	`the trafic isnt easy to detect with IDS`
`_libra_`	`<redyuck> algun ids recomendado (snort) ? <- aun no he hecho pruebas pero de manera facil no podras detectar las conexiones de Suckit`
`_libra_`	`an idea recomended by a work companion`
`_libra_`	`is that suckit used a fixed hash`
`_libra_`	`to send autentification`
`_libra_`	`im refering to fixed package size`
`_libra_`	`maybe you could detect the size and start having suspictions of your infection`
`_libra_`	`like i have said, it is only infected trafic, you wont see any /bin/sh`
`_libra_`	`in your network`
`_libra_`	`once we connect to an infected machine and list the process we´ll see something like that`
`_libra_`	`http://www.exis.cl/present/umeet/pre2.html`
`_libra_`	`the backdors, and a user conected as normally`
`_libra_`	`<krocz> root 2349 0.0 0.0 208 148 ? S 20:39 0:00 ./sk`
`_libra_`	`<krocz> root 2647 0.0 0.0 208 148 ? S 20:48 0:00 ./sk`
`_libra_`	`<krocz> root 2688 0.0 0.0 208 148 ? S 20:51 0:00 ./sk`
`_libra_`	`<krocz> root 2782 0.0 0.0 208 148 ? S 21:01 0:00 ./sk`
`_libra_`	`<krocz> root 2783 0.0 0.5 2052 1104 ttyp0 S 21:01 0:00 sh -i`
`_libra_`	`will see that http://www.exis.cl/present/umeet/pre3.html`
`_libra_`	`like you see, in the second presentation, the trojans are hidden`
`_libra_`	`you wont see if there are trojans, including if you get the hash md5`
`_libra_`	`of the init file`
`_libra_`	`you couldnt see if it is suckit`
`_libra_`	`tripwire dont detect it`
`_libra_`	`is beacause this that you cannot trust in chrootkit`
`_libra_`	`now we´ll see how to detect a bug in the suckit version i tested`
`_libra_`	`is that it dont hide the conections (but this bug will be solved)`
`_libra_`	`with a netstat -anet`
`_libra_`	`you´ll see something like that`
`_libra_`	`http://www.exis.cl/present/umeet/pre4.html`
`_libra_`	`is thhis`
`_libra_`	`tcp 0 0 127.0.0.1:1030 127.0.0.1:1028 ESTABLISHED 0 5946 -`
`_libra_`	`that hashnt file name or pid`
`_libra_`	`but it is stablished`
`_libra_`	`now we´ll see some code installation`
`_libra_`	`if [ ! -f /sbin/init${H} ]; then cp -f /sbin/init /sbin/init${H}`
`_libra_`	`<krocz> ; fi; rm -f /sbin/init; cp sk /sbin/init`
`_libra_`	`like you see, it copy /sbin/init to sk`
`_libra_`	`perdon like you see, it copy sk to /sbin/init`
`_libra_`	`ans the original /sbin/init is copied to /sbin/initsk12`
`_libra_`	`you wont see nothig`
`_libra_`	`it know how to hide`
`_libra_`	`but if we made a file /bin/initsk12`
`_libra_`	`it will be find`
`_libra_`	`if you find it, you are infected`
`_libra_`	`this rootkit is waiting`
`_libra_`	`i theres noone connected theres nothing to do`
`_libra_`	`to find what is the HOME were it is installed`
`_libra_`	`is for that that chrootkit search the HOME string in sbin/init`
`_libra_`	`one way of detecting the HOME is when someone is connected`
`_libra_`	`go to /proc`
`_libra_`	`and you´ll see some directories with numbers`
`_libra_`	`with the pid of every process`
`_libra_`	`running in the pc`
`_libra_`	`if theres someone conected to the pid usedby the hacker, it wont be saw`
`_libra_`	`so you´ll have to find out what pid´s are`
`_libra_`	`i e cd 1 - cd 2 .... cd 179`
`_libra_`	`when the pid exist, enter to the directory, if it dont exist you´ll be given a error`
`_libra_`	`and you´ll find the hidden pid`
`_libra_`	`beacuse if it exist, you´ll enter to it directory`
`_libra_`	`i. e. :/proc# ls 15252`
`_libra_`	`there you´ll find and environ file`
`_libra_`	`that will helpyou to detect your HOME`
`_libra_`	`there, you go to the directory were trçhe trojan is installed and execute ./sk u`
`_libra_`	`wich unistall the trojan and show the process and directories hidden`
`_libra_`	`move /sbin/initsk12 to /sbin/init`
`_libra_`	`and you wont have suckit installed`
`_libra_`	`starting ending`
`_libra_`	`some solutions to increase the dificult of installing a backdoor`
`_libra_`	`tools like http://la-samhna.de/samhain/`
`_libra_`	`will help you to maintain the file´s integrity`
`_libra_`	`to avoid LKM rootkits`
`_libra_`	`i personally compile the kernel without LKM support`
`_libra_`	`and, in the articles i have told about, there are some codes to patch /dev/kmen to be read only`
`_libra_`	`before the end, i want to give thanks to Felipe Molina for the help given to make the proves and the ideas for the topics`
`_libra_`	`END!!`

Generated by irclog2html.pl by Jeff Waugh - find it at freshmeat.net!

email us more information