Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 60)

even kernel version, and thus get even more information. "Worms", on the other hand, are automated and

scan blindly, generally just looking for open ports, and then a susceptible victim. They are not trying to

"learn" anything, the way a cracker might.

The distinction between "scan" and "probe"is often blurred. Both can used in good ways, or in bad ways,

depending on who is doing it, and why. You might ask a friend to scan you, for instance, to see how well

your firewall is working. This is a legitimate use of scanning tools such as nmap. But what if someone you

don't know does this? What is their intent? If it's your ISP, they may be trying to enforce their Terms of

Service Agreement. Or maybe, it is someone just playing, and seeing who is "out there". But more than likely

it is someone or something with not such good intentions.

Full range port scans (meaning probing of many ports on the same machine) seem to be a not so common

threat for home based networks. But certainly, scanning individual ports across numerous systems is a very,

very common occurrence.

8.4.2. Rootkits

A "rootkit" is the script kiddie's stock in trade. When a successful intrusion takes place, the first thing that is

often done, is to download and install such "rootkits". The rootkit is a set of scripts designed to take control

of the system, and then hide the intrusion. Rootkits are readily available on the web for various Operating

Systems.

A rootkit will typically replace critical system files such as ls, ps, netstat, login and others. Passwords may

be added, hidden daemons started, logs tampered with, and surely one of more backdoors are opened. The

hidden backdoors allow easy access any time the attacker wants back in. And often the vulnerability itself

may even be fixed so that the new "owner" has the system all to himself. The entire process is scripted so it

happens very quickly. The rightful owners of these compromised systems generally have no idea what is

going on, and are victims themselves. A well designed rootkit can be very difficult to detect.

8.4.3. Worms and Zombies

A "worm" is a self replicating exploit. It infects a system, then attempts to spread itself typically via the same

vulnerability. Various "worms" are weaving their way through the entire Internet address space constantly,

spreading themselves as they go.

But somewhere behind the zombie, there is a controller. Someone launched the worm, and they will be

informed after a successful intrusion. It is then up to them how the system will be used.

Many of these are Linux systems, looking for other Linux systems to "infect" via a number of exploits. But

most Operating Systems share in this threat. Once a vulnerable system is found, the actual entry and take over

is quick, and may be difficult to detect after the fact. The first thing an intruder (whether human or "worm")

will do is attempt to cover their tracks. A "rootkit" is downloaded and installed. This trend has been

exacerbated by the growing popularity of cable modems and DSL. The number of full time Internet

connections is growing rapidly, and this makes fertile ground for such exploits since often these aren't as well

secured as larger sites.

While this may sound ominous, a few simple precautions can effectively deter this type of attack. With so

many easy victims out there, why waste much effort breaking into your system? There is no incentive to

Security Quick−Start HOWTO for Red Hat Linux

8.4.2. Rootkits 57

1 2 ... 55 56 57 58 59 60 61 62 63 64 65 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 60