Re: Tracking tools?

[neill () en com (neill)]

> One thing you might consider. We made a login shell call Csh (looks like
> csh in /etc/passwd) that is really a C program that sends me mail and
> calls the unix script command. We modified the script binaries to not
> print out the "script starting" and "script ending" messages. When the
> suspect account logs in with this as their shell, it writes all their
> keystrokes to a file. The down side is if they do a w command, they will
> see some funny stuff happening on their account.
>
> Anyone else have any keystroke catching ideas?
>
> Gene.
>
> On Wed, 14 Aug 1996, David Miller wrote:
>
> > Please forgive me if this message is a bit off subject, as it doesn't
> > expose any holes....
> >
> > I've got a tcpdump of the network while a hacker broke into a machine. I
> > created it on a FreeBSD system with tcpdump -w .... (filters omitted).
> >
> > I can read the file back just fine with a tcpdump -r, and dump the raw
> > data with a -x, but that's less than real useful.
> >
> > Can anyone point out some tools I might apply to this dump file in order
> > to track the session which actually hacked root?  I'd most like to see
> > one of the monitoring programs which can be fed from the dump file, but
> > I'd be happy with something which would give me an ascii dump of the
> > data portions of selected packets.
> >
> > Thanks in advance:)

You have to be kidding. There are plenty of sniffers available for all
sorts of platforms.. Hell, you could even patch telnetd to capture
keystrokes.. The major drawback of what Gene seems to be trying to
do is that, well, it targets only one user. Unfortunately, to
get a root breakin, you would have to sniff all the time.. and
that brings up some nasty privacy issues..

And another thing.. yeah, you could patch all your shells (including
Bourne) to capture keystrokes, but where are you going to store the
no-doubt large logs it will create? Its difficult to catch a hacker this
way unless you are doing it realtime as the breakin is occuring or are
willing to store loads of logs of connections coming into your machine.
What if your hacker is smart enough to come in and pad his session with
enough garbage that its hard for the admin to decipher? Say he logs on,
ftps some sources in, runs them, removes the source but still has root..
all you know is that he ran a program.. hackers are lazy, they dont type
out root exploits by hand most of the time if they can avoid it.