Re: Exploit or trojan

At 02:33 AM 12/16/2003, Felipe Franciosi wrote:
>Doing so on Linux systems doesn't help much,  since  recently there
>have been several kernel  backdoors  (some  are  loadable  modules,
>others just patch /dev/kmem on the fly)  which  actually  hide  the
>proccesses from 'ps'.

As Konrad Rieck said - Kernel backdoors exist in Solaris as well.

Darren -

It does indeed look as if someone is using your machine as a warez dumpsite,
The bad news: it means that someone has gained access to your computer
The good news: A real hacker would not use a solaris station as a warez 
warehouse, so we are probably dealing here with a script kiddie... 
shouldn't be that hard.

Other than installing the server from scratch - as a minimum I would 
suggest that in case and you have a similar unaffected system - boot the 
allegedly affected system off a cdrom and md5 the entire system (hoping 
there aren't too many files out there, if they are - you may selectively 
md5 portions of your fs) make sure to cover the location of most of your 
binaries (/bin /usr/bin/ etc...) oh and don't forget /platform... your 
kernel is there (probably under /platform/sun4u/kernel (could be /kernel, 
depending on your version)
Also - search for unusual things in your /etc/rc*.d and /etc/init.d - it 
could be that a backdoor is running from there, many people simply assume 
no one would do something that obvious and easy to be found and don't check 
there...

Once you have a list of checksums you may compare it to a similar system on 
your network (sort and diff...)

And, as a friendly advice - ALWAYS install recommended patches for Solaris, 
and clear up some junk from /etc/inetd.conf
I really hope this machine is firewalled - nfs and nis are very easy to 
hack into.




Regards

Gil Disatnik
UNIX system administrator.

GibsonLP@EFnet
http://gil.disatnik.com

_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
apt-get install slackware
--------------------------------------------------------------------
"Windows NT has detected mouse movement, you MUST restart
your computer before the new settings will take effect, [ OK ]"
--------------------------------------------------------------------
Windows is a 32 bit patch to a 16 bit GUI based on a 8 bit operating
system, written for a 4 bit processor by a 2 bit company which can
not stand 1 bit of competition.
-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-