September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: Re: [suse-security] hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi Andy, > hi gero, > > please post the content of MDACSET.log here it is: its quite strange. pam:/home/[my dir] # cat MDACSET.log Let's get out of here 2.1 already installed _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

4 3

RE: [suse-security] hacker attack ?
by Michael Sziede 19 Sep '01

19 Sep '01

Hi all. I'm on SuSE 7.1. That dialin.net address looked familiar: ------------- Sep 10 00:54:56 tdscom1 ftpd[23742]: ACCESS DENIED (not in any class) TO pD9553692.dip.t-dialin.net [217.85.54.146] Sep 10 00:54:56 tdscom1 ftpd[23742]: FTP LOGIN REFUSED (access denied) FROM pD9553692.dip.t-dialin.net [217.85.54.146], anonymous Sep 11 21:52:40 tdscom1 ftpd[9539]: ACCESS DENIED (not in any class) TO p3EE2182D.dip.t-dialin.net [62.226.24.45] Sep 11 21:52:40 tdscom1 ftpd[9539]: FTP LOGIN REFUSED (access denied) FROM p3EE2182D.dip.t-dialin.net [62.226.24.45], anonymous ------------- Coincidence? Michael B. Sziede Lead Programmer/Analyst TRX Data Services 1477 Chain Bridge Rd., Ste 201 McLean, VA 22101 USA Office: 703-748-3162 x210 Fax: 703-748-3167 email: michael.sziede(a)trx.com -----Original Message----- From: Gero Lindenblatt [mailto:gerol@web.de] Sent: Wednesday, September 19, 2001 10:01 AM To: suse-security(a)suse.com Subject: [suse-security] hacker attack ? Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

hacker attack ?
by Gero Lindenblatt 19 Sep '01

19 Sep '01

Hi, my system is SuSE 7.2. i was shocked today when i saw a file in my homedir called MDACSET.log. It's content is : ------- Lets get out of here. 2.1 already instlled. ------ In my /var/log/messages i could read --- Sep 4 15:55:42 pam proftpd[4981]: pam.[mydomain] (pD9E2C451.dip.t-dialin.net[217.226.196.81]) - Complex path, will rename /.in.MDACSET.log. to /MDACSET.log. --- is this a backdoor or something or just a file from a windows system which was ftped onto my server ? _I_ never puhsed this file up... thanks a lot Gero _______________________________________________________________________ 1.000.000 DM gewinnen - kostenlos tippen - http://millionenklick.web.de IhrName(a)web.de, 8MB Speicher, Verschluesselung - http://freemail.web.de

2 1

WEB IIS cmd exe requests
by webmaster 19 Sep '01

19 Sep '01

Hi list, May I ask you to write how that rejecting is with ipchains? Antal

3 2

Re: [suse-security] WEB IIS cmd exe requests
by Togan Muftuoglu 19 Sep '01

19 Sep '01

Hi Dove, I am sending the reply to the list as it was the palce you wanted it to go I believe, As sending to me only is probably not what you wanted :-) Please do not CC me as I am on the list. -- Togan Muftuoglu * dove; <dove(a)freemail.absa.co.za> on 19 Sep, 2001 wrote: > > * teo(a)gecadsoftware.com; <teo(a)gecadsoftware.com> on 18 Sep, 2001 wrote: > > > I have this for the older ones: > > > $IPTABLES -I INPUT -p tcp --dport 80 -m string --string .ida -m state > > > --state ESTABLISHED -j REJECT --reject-with tcp-reset > > > > > > I guess we can just add another one for cmd.exe in place of `.ida'. > > hi, could someone please send me the source for the strings module and a question : is this type of filtering allright for production systems ? doVe

3 3

FW: CERT Advisory CA-2001-26
by José Luis Ledesma 19 Sep '01

19 Sep '01

... José Luis Ledesma Technology _________________________ COMPETITIVENESS Technology Park Valles 08290 Barcelona - Spain Tel.: +34 935 820 159 Fax: +34 935 820 159 -----Original Message----- > From: CERT Advisory [mailto:cert-advisory@cert.org] > Sent: miércoles 19 de septiembre de 2001 1:32 > To: cert-advisory(a)cert.org > Subject: CERT Advisory CA-2001-26 > > > > -----BEGIN PGP SIGNED MESSAGE----- > > CERT Advisory CA-2001-26 Nimda Worm > > Original release date: September 18, 2001 > Source: CERT/CC > > A complete revision history is at the end of this file. > > Systems Affected > > * Systems running Microsoft Windows 95, 98, ME, NT, and 2000 > > Overview > > The CERT/CC has received reports of new malicious code > known as the > "W32/Nimda worm" or the "Concept Virus (CV) v.5." > This new worm > appears to spread by multiple mechanisms: > > * from client to client via email > > * from client to client via open network shares > > * from web server to client via browsing of compromised web sites > > * from client to web server via active scanning for and > exploitation > of the "Microsoft IIS 4.0 / 5.0 directory traversal" > vulnerability > (VU #111677) > > * from client to web server via scanning for the > back doors left > behind by the "Code Red II" (IN-2001-09), and > "sadmind/IIS" > (CA-2001-11) worms > > Initial analysis indicates that the worm contains no > destructive > payload beyond modification of web content to > facilitate its own > propagation. > > We are also receiving reports of denial of service as > a result of > network scanning and email propagation. > > I. Description > > The Nimda worm has the potential to affect both user > workstations > (clients) running Windows 95, 98, ME, NT, or 2000 and > servers running > Windows NT and 2000. > > Email Propagation > > This worm propagates through email arriving > as a MIME > "multipart/alternative" message consisting of two > sections. The first > section is defined as MIME type "text/html", but it > contains no text, > so the email appears to have no content. The second > section is defined > as MIME type "audio/x-wav", but it contains a > base64-encoded > attachment named "readme.exe", which is a binary executable. > > Due to a vulnerability described in CA-2001-06 (Automatic > Execution of > Embedded MIME Types), any mail software running on an > x86 platform > that uses Microsoft Internet Explorer 5.5 SP1 or > earlier (except IE > 5.01 SP2) to render the HTML mail automatically runs > the enclosed > attachment and, as result, infects the machine with the > worm. Thus, in > vulnerable configurations, the worm payload will > automatically be > triggered by simply opening (or previewing) this mail > message. As an > executable binary, the payload can also be triggered by > simply running > the attachment. > > The email message delivering the Nimda worm appears to > also have the > following characteristics: > > * The text in the subject line of the mail message > appears to be > variable, but those seen to date have been over > 80 characters > long. > > * There appear to be many slight variations in the > attach binary > file, causing the MD5 checksum to be different when > one compares > different attachments from different email messages. > However, the > file length of the attachment appears to > consistently be 57344 > bytes. > > Payload > > Infected client machines attempt to send copies of the > Nimda worm via > email to all addresses found in the Windows address book. > > Likewise, the client machines begin scanning for > vulnerable IIS > servers. Nimda looks for backdoors left by previous IIS > worms: Code > Red II [IN-2001-09] and sadmind/IIS worm > [CA-2001-11]. It also > attempts to exploit the IIS Directory Traversal > vulnerability (VU > #111677). The selection of potential target IP addresses > follows these > rough probabilities: > > * 50% of the time, an address with the same first two > octets will be > chosen > > * 25% of the time, an address with the same first > octet will be > chosen > > * 25% of the time, a random address will be chosen > > The infected client machine transfers a copy of the Nimda > code to any > server that it scans and finds to be vulnerable. Once > running on the > server machine, the worm traverses each directory > in the system > (including all those accessible through a file shares) > and write a > copy of itself to disk using the name "README.EML". When > a directory > containing web content (e.g., HTML or ASP files) > is found, the > following snippet of Javascript code is appended to every > one of these > web-related files: > > <script language="JavaScript"> > window.open("readme.eml", null, "resizable=no,top=6000,left=6000") > </script> > > This modification of web content allows further > propagation of the > worm to new clients through a browser or browsing of a > network file > system. > > Browser Propagation > > As part of the infection process, the Nimda worm > modifies all web > content files it finds (including, but not limited > to, files with > .htm, .html, and .asp extensions). As a result, any user > browsing web > content on the system, whether via the file system > or via a web > server, may download a copy of the worm. Some > browsers may > automatically execute the downloaded copy, thereby > infecting the > browsing system. > > File System Propagation > > The Nimda worm creates numerous copies of itself > (using the name > README.EML) in all writable directories (including > those found on a > network share) to which the user has access. If a > user on another > system subsequently selects the copy of the worm file > on the shared > network drive in Windows Explorer with the preview option > enabled, the > worm may be able to compromise that system. > > System FootPrint > > The scanning activity of the Nimda worm produces the > following log > entries for any web server listing on port 80/tcp: > > GET /scripts/root.exe?/c+dir > GET /MSADC/root.exe?/c+dir > GET /c/winnt/system32/cmd.exe?/c+dir > GET /d/winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir > GET > /msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\ x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir > GET /scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%35c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%5c../winnt/system32/cmd.exe?/c+dir > GET /scripts/..%2f../winnt/system32/cmd.exe?/c+dir > > Note: The first four entries in these sample logs denote > attempts to > connect to the backdoor left by Code Red II, while the > remaining log > entries are examples of exploit attempts for the > Directory Traversal > vulnerability. > > II. Impact > > Intruders can execute arbitrary commands within the > LocalSystem > security context on machines running the unpatched > versions of IIS. > Host that have been compromised are also at high risk for > being party > to attacks on other Internet sites. > > The high scanning rate of the Nimda worm may also > cause bandwidth > denial-of-service conditions on networks with infected machines. > > III. Solutions > > Recommendations for System Administrators of IIS machines > > To determine if your system has been compromised, > look for the > following: > > * root.exe artifact (indicates a compromise by > Code Red II or > sadmind/IIS worms making the system vulnerable to the > Nimda worm) > > * admin.dll artifact or unexpected .eml files in the > directories > with web content (indicates compromise by the Nimda worm) > > The only safe way to recover from the system compromise > is to format > the system drive(s) and reinstall the system software > from trusted > media (such as vendor-supplied CD-ROM). Additionally, > after the > software is reinstalled, all vendor-supplied security > patches must be > applied. The recommended time to do this is while the > system is not > connected to any network. However, if sufficient care > is taken to > disable all server network services, then the > patches can be > downloaded from the Internet. > > Detailed instructions for recovering your system can be > found in the > CERT/CC tech tip: > > Steps for Recovering from a UNIX or NT System Compromise > > http://www.cert.org/tech_tips/win-UNIX-system_compromise.html > > Apply the appropriate patch from your vendor > > A cumulative patch which addresses all of the > IIS-related > vulnerabilities exploited by the Nimda worm is > available from > Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-044.asp > > Recommendations for End User Systems > > Apply the appropriate patch from your vendor > > If you are running a vulnerable version of Internet > Explorer (IE), the > CERT/CC recommends applying patch for the "Automatic > Execution of > Embedded MIME Types" vulnerability available from Microsoft at > > > http://www.microsoft.com/technet/security/bulletin/MS01-020.asp > > Run and Maintain an Anti-Virus Product > > It is important for users to update their anti-virus > software. Most > anti-virus software vendors have released updated > information, tools, > or virus databases to help detect and partially > recover from this > malicious code. A list of vendor-specific anti-virus > information can > be found in Appendix A. > > Many anti-virus packages support automatic > updates of virus > definitions. We recommend using these automatic > updates when > available. > > Don't open e-mail attachments > > The Nimda worm may arrive as an email attachment named > "readme.exe". > Users should not open this attachment. > > Disable JavaScript End-user systems can become > infected with the > Nimda worm by browsing web sites hosted by infected > servers. This > method of infection requires the use of JavaScript to be > successful. > Therefore, the CERT/CC recommends that end user > systems disable > JavaScript. > > Appendix A. Vendor Information > > Antivirus Vendor Information > > Central Command, Inc. > > > http://support.centralcommand.com/cgi-bin/command.cfg/php/endus > er/std_adp.php?p_refno=010918-000005 > > Command Software Systems > > http://www.commandsoftware.com/virus/nimda.html > > Data Fellows Corp > > http://www.datafellows.com/v-descs/nimda.shtml > > McAfee > > http://vil.mcafee.com/dispVirus.asp?virus_k=99209& > > Sophos > > http://www.sophos.com/virusinfo/analyses/w32nimdaa.html > > Symantec > > > http://www.symantec.com/avcenter/venc/data/w32.nimda.a@mm.html > > Trend Micro > > > http://www.antivirus.com/vinfo/virusencyclo/default5.asp?VName= > TROJ_NIMDA.A > > > http://www.antivirus.com/pc-cillin/vinfo/virusencyclo/default5. > asp?VName=TROJ_NIMDA.A > > You may wish to visit the CERT/CC's computer virus > resources page > located at > > http://www.cert.org/other_sources/viruses.html > > References > > Authors: Roman Danyliw, Chad Dougherty, Allen > Householder, Robin > Ruefle > > ______________________________________________________________________ > > This document is available from: > http://www.cert.org/body/advisories/CA200126_FA200126.html > > ______________________________________________________________________ > > CERT/CC Contact Information > > Email: cert(a)cert.org > Phone: +1 412-268-7090 (24-hour hotline) > Fax: +1 412-268-6989 > Postal address: > CERT Coordination Center > Software Engineering Institute > Carnegie Mellon University > Pittsburgh PA 15213-3890 > U.S.A. > > CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) > / EDT(GMT-4) > Monday through Friday; they are on call for emergencies > during other > hours, on U.S. holidays, and on weekends. > > Using encryption > > We strongly urge you to encrypt sensitive information > sent by email. > Our public PGP key is available from > > http://www.cert.org/CERT_PGP.key > > If you prefer to use DES, please call the CERT > hotline for more > information. > > Getting security information > > CERT publications and other security information are > available from > our web site > > http://www.cert.org/ > > To be added to our mailing list for advisories and > bulletins, send > email to cert-advisory-request(a)cert.org and > include SUBSCRIBE > your-email-address in the subject of your message. > > * "CERT" and "CERT Coordination Center" are registered > in the U.S. > Patent and Trademark Office. > > ______________________________________________________________________ > > NO WARRANTY > Any material furnished by Carnegie Mellon University and > the Software > Engineering Institute is furnished on an "as is" > basis. Carnegie > Mellon University makes no warranties of any kind, either > expressed or > implied as to any matter including, but not limited to, > warranty of > fitness for a particular purpose or merchantability, > exclusivity or > results obtained from use of the material. Carnegie > Mellon University > does not make any warranty of any kind with respect to > freedom from > patent, trademark, or copyright infringement. > _________________________________________________________________ > > Conditions for use, disclaimers, and sponsorship information > > Copyright 2001 Carnegie Mellon University. > > Revision History > > September 18, 2001: Initial Release > > > > > > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 5.0i for non-commercial use > Charset: noconv > > iQCVAwUBO6fYPgYcfu8gsZJZAQEG4QQAoblNKbAX/bVmJBdXy2Juf9OsMZeO2bR5 > UW6hi7ddDkdUNBe52du2wU+n34tSjzA3c+0g9tYwKSXFeOp+m/CCLeYEXR+VTTel > RAmY1tOzDfMIDxD6+GrvfajYMz4pCGoSJgIdPGKxJm0Tnf6iv4akaYSAB4BPRw7A > FVp6JcCbatg= > =FizN > -----END PGP SIGNATURE----- >

1 0

automatic backups over ssh/scp
by Lukas Feiler 19 Sep '01

19 Sep '01

I want to do the following: backup all my sensitive date from my main server, pack it into one file and then get it transfered to my backup server. That's fine but my problem is that those two machines aren't in the same local network. So if I do not encrypt my data it would be (more or less) visible to everybody on the net (who has some hacking knowledge). But as I said this data is sensible (passwords, creditcards, ...)! So I thought of ssh or scp BUT how to automate this process of backing up? I would have to specify user AND password in my backup-script. How do specify a password for ssh / scp in a script?? Plese Help! Luke

14 30

SuSE firewall ipchain
by James McBoyle 19 Sep '01

19 Sep '01

Hi all, So that I can masquerade my home network and have it use my modem I've turn on the firewall that comes as standard with SuSE 7.0. The masqing works well and it was nice and easy to set up via YAST, but when it's on the rule set won't allow kmail to talk to my mail server, which I get to via the modem. I was thinking of doing something like 'ipchains -a ALLOW smtp mymachine' (better than adding allow smtp all, or allow all all (-: ) But wanted to make sure I was doing the correct thing to allow mail through (the fine manual is good, but had nothing specific) Is this correct, or is there a better way of allowing mail through an ipchains firewall? Many thanks for your time. Have Fun, Jim. -- James McBoyle /"\ james.mcboyle(a)sun.com \ / ASCII Ribbon Campaign Software Engineer X Against HTML Mail Integrated Software QED / \

1 0

nmap options
by Jesse yep 19 Sep '01

19 Sep '01

If all my ports are closed and someone does an 'nmap -sU -sT' scan on me and shows unfiltered ports. Could it be true, or is it just a false output? I heard somewhere that doing both of those options maybe give you false output, so im asking here ;) __________________________________________________ Terrorist Attacks on U.S. - How can you help? Donate cash, emergency relief information http://dailynews.yahoo.com/fc/US/Emergency_Information/

2 1

freeswan and suse 7.2
by Andreas Wahlert 18 Sep '01

18 Sep '01

Hi List, i attempt to run a freeswan ipsec for w2k Workstations with suse 7.2. I have no changes to the standart installation of the yast tool (no kernel changes, no changes in the ipsec.conf). At the start of freeswan i have an error number 22. The ipsec interface is up. Must i configure anyone before i start freeswan?? Must i configure the kernel. The doc says no. Thanx for Help Andreas

1 0