Re: Server Compromised ?

[Leif Ericksen <leife () dls net>]

Much snippage will have been done...

On Thu, 2006-01-26 at 15:08 -0300, Daniel Gil wrote:

> 123.123.123.124) behind my ISP firewall.

You are actually trusting that your ISP is providing a firewall or do
you have your own firewall that you manage between your servers and your
ISP?  What ISP do you use that provides a firewall?  I was once told by
a tech at an ISP I have used that a NAT box i.e my router would be a
decent firewall and I needed no more than that! >shudder<  I balled him
out and asked for there security go to person so I could get my
questions answered.

Now, if your server is responding on a port that you are not
anticipating to be active you seem to have a problem.
1) run a sniffer on the network and see what kind of traffic is going
back and forth.
2) Isolate the 'bad' system from the net and see if it is trying to
generate traffic (does it have a smtp engine sending spam?)
> TCP    123.123.123.124:25        85.250.57.67:1278      TIME_WAIT
> TCP    123.123.123.124:25        201.25.170.200:4174    TIME_WAIT

should pop be in use?
> TCP    123.123.123.124:110       200.59.34.91:1050      TIME_WAIT
> TCP    123.123.123.124:110       200.59.34.91:2089      TIME_WAIT
> TCP    123.123.123.124:110       200.59.34.91:2090      TIME_WAIT >TCP
123.123.123.124:110       200.59.34.91:2091      TIME_WAIT

3) LOTS of listening ports is always a scary thing...  Do you have a
fresh install Dozer box that you can use to compare netstat info on?

For instance on my *nix system. This is what I have listening.
# lsof -i TCP
COMMAND    PID   USER   FD   TYPE DEVICE SIZE NODE NAME
mDNSRespo 1945 nobody    7u  IPv4   5539       TCP mybox:5335 (LISTEN)
cupsd     1980   root    0u  IPv4   5749       TCP mybox:ipp (LISTEN)
sshd      2012   root    3u  IPv4   5769       TCP X..X.X.X:ssh (LISTEN)
sendmail  2054   root    4u  IPv4   5935       TCP mybox:smtp (LISTEN)
httpd     2100   root    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2107 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2108 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2109 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2110 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2111 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2112 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2113 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)
httpd     2114 apache    3u  IPv4   6008       TCP X.X.X.X:http (LISTEN)

4) If in doubt, remove the system form the network and reload the OS
scrub and reload.

--
Leif Ericksen




---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------