Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 40)

The first thing an intruder typically does is install a "rootkit". There are many prepackaged rootkits available

on the Internet. The rootkit is essentially a script, or set of scripts, that makes quick work of modifying the

system so the intruder is in control, and he is well hidden. He does this by installing modified binaries of

common system utilities and tampering with log files. Or by using special kernel modules that achieve

similar results. So common commands like ls may be modified so as to not show where he has his files

stored. Clever!

A well designed rootkit can be quite effective. Nothing on the system can really be trusted to provide accurate

feedback. Nothing! But sometimes the modifications are not as smooth as intended and give hints that

something is not right. Some things that might be warning signs:

be suspicious. Similarly, any weirdness with adding or changing passwords.

•

Wierdness with other system commands (e.g. top or ps) should be cause for concern as well.

System utilities are slower, or awkward, or show strange and unexpected results. Common utilities

that might be modified are: ls, find, who, w, last, netstat, login, ps, top. This is not a definitive list!

•

Files or directories named "..." or ".. " (dot dot space). A sure bet in this case. Files with haxor

looking names like "r00t−something".

•

Unexplained bandwidth usage, or connections. Script kiddies have a fondness for IRC, so such

connections should raise a red flag.

•

Logs that are missing completely, or missing large sections. Or a sudden change in syslog behavior. •

Mysterious open ports, or processes. •

Files that cannot be deleted or moved. Some rootkits use chattr to make files "immutable", or not

changable. This kind of change will not show up with ls, or rpm −V, so the files look normal at first

glance. See the man pages for chattr and lsattr on how to reverse this. Then see the next section

below on restoring your system as the jig is up at this point.

•

This is becoming a more and more common script kiddie trick. In fact, one quick test to run on a

suspected system (as root):

/usr/bin/lsattr `echo $PATH | tr ':' ' '` | grep i−−

This will look for any "immutable" files in root's PATH, which is almost surely a sign of trouble since

no standard distributions ship files in this state. If the above command turns up anything at all, then

plan on completely restoring the system (see below). A quick sanity check:

# chattr +i /bin/ps

# /usr/bin/lsattr `echo $PATH | tr ':' ' '` | grep "i−−"

−−−i−−−−−−−−−− /bin/ps

# chattr −i /bin/ps

This is just to verify the system is not tampered with to the point that lsattr is completely unreliable.

The third line is exactly what you should see.

Indications of a "sniffer", such as log messages of an interface entering "promiscuous" mode. •

Modifications to /etc/inetd.conf, rc.local, rc.sysint or /etc/passwd. Especially,

any additions. Try using cat or tail to view these files. Additions will most likely be appended to the

•

Security Quick−Start HOWTO for Red Hat Linux

6. Intrusion Detection 37

1 2 ... 35 36 37 38 39 40 41 42 43 44 45 ... 81 82

Commenti su questo manuale

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 40

Commenti su questo manuale