Hi,

...

...

I found a normal file in /dev: "h" on one of my servers: It contains the following text between binary code: Invalid partition table^@No operating system^@Error loading operating system

This should not be there. It might be part of a rootkit hooking before kernel-loading.

The server has an open ssh-port, available from internet via dyndns.org. Using DSL with t-online.de.

Not only available from dyndns.org. You can connect the IP always from everywhere. The portscan could be faked, the packet log may be misleading. 1. Remove the file, better move it to another location. 2. Reboot. If the system does not start -> it was hacked, this file was an active chainloader 3. load chkrootkit, do a make sense, check the system. If possible use /bin from CD or another machine (NFS, Samba, whatever). 4. If you find anything confirmed (an identified rootkit), shutdown, reinstall after formatting OR (the dangerous way) 5. Install another machine with same distribution, same patchlevel, and tripwire the disk against it. Replace changed files manually. This may result in a unusuable system, or you miss some infected files. Ciao, Dieter

Hello, Manfred Rebentisch wrote:

Hackers going on to make the internet unusable.

I cannot agree: Open your door at home and wait until the thiefes come in - so, is the way to your house unusable 'cause someone could use it to come in? No. You lock the door to keep them out (I think you do) and so you should do with your IT environment. Lock the door. IMHO poorly written programs and unpatched clients make the internet unusable. Do you remember SQL-Slammer? The patch was published about 184 days before the worm hit the internet. Sasser? 17 days before, IIRC. It our turn to patch and secure our systems instead of blaming others. Just my 2eurocents GTi P.S.: There's a difference between 'hacker' and 'cracker', see http://www.netlingo.com/right.cfm?term=cracker and http://www.netlingo.com/right.cfm?term=hacker

Ok, thats right. I only angry about the crackers (yes, an important difference!). But you know, it is nearly imposible to make a system invulnerable - or better: I believe it.

Depends on how dumb or wise someone setups a box: - no uneccessary services - neccessary services run as unser and not as root, if impossible your a wrapper or better chroot them - whisely choose the daemons you run - no weak passwords - update your system to up2date files - run ids (file and network ids) software and often parse the logfiles - write your own scripts to parse logfiles with important notes only and often parse them - get proven root-kit-detection-scripts - if you have more than one server let all servers take a specific role (e.g.: db-server, dhcp-server&firewall, webserver, corporate syslog-server) - if you got a bigger network build two firewalls with one in front of the internet and one in front of your network connected to each other (minimal system with own kernel and no network services activated), build in the first one a dmz and a honeypod that logs all activity - subscribe to different security mailinglists and follow the threads - don't overprotect a system so it's a challenge for some persons (there are enough weak servers on the net, so most kiddies search the more vulnerable ones) - some experience is needed as well, but much can be read on the net or you get help of more familliar persons on the net Most intrusions come from: - weak passwords - old service-daemons - unsecure services - unsatisfied employees - the own network - careless operation with data/data-security To get behind an intrusion: - leave system as is and don't change any data, otherwise no later forensic investigation will be possible - backup the system and run a forensic analysis on a trusted machine (you get data-patterns on the net and useful free software for that purpose as well) - unplug system from network - exchange system agains honeypod and log activities With the last thing you can find what's going on and trace the intruders back to their origin. Philippe

torsdagen den 1 juli 2004 10.43 skrev Manfred Rebentisch:

Can you explain "honeypod"? I understand, that it is an exchange for the harmed machine, but how do you build a "honeypod"?

Philippe probably means "honeypot". A honeypot is a machine which claims to run a service but instead logs and monitors all activity on that port. It is not uncommon to use honeypots for port 25 (SMTP) to detect infected computers which erroneously connect to that port. If you google for honeypot you will find more information. Just my 0.02 SEK ;) -- Mats Folke Avd. Datalogi och Div. of Computer Science Datorkommunikation and Networking Inst. för Systemteknik Dept. of Computer Science Luleå tekniska universitet and Electrial Engineering Luleå University of Techology Sweden tel: 0920 49 3065 telephone: +46 920 493065

-----Original Message----- From: list@nolog.org [mailto:list@nolog.org] Sent: 01 July 2004 10:41 To: suse-security@suse.com Subject: Re: [suse-security] Found file in /dev: "h"

Hi,

Manfred Rebentisch wrote:

...

Can you explain "honeypod"? I understand, that it is an exchange for the harmed machine, but how do you build a "honeypod"?

that's a typo: Honeypot. A honeypot is part of a honeynet ;)

I was assuming it's a new type of honeypot! Some sort of modular system or something.... Tom.