Re: Compromised...

[j5 () NEUTRAL ORG (Japheth)]

What a strange coincidence. One of my friends/colleagues who has a Linux
box called me this morning thinking that she was compromised. After some
snooping I came across the same thing - the ADMROCKS in /var/named, etc.
Aside from what you mentioned there were two users added to the system
"web1" and "web3". web3 was UID 10 (same as the uucp user on her box) and
web1 was UID 0.

I was JUST firing up the email client to compose a pretty much identical
message.

I talked to a couple people this afternoon and they conceded that it was
in fact intrusion via named and that many services and programs would need
to be re-installed to clean up the mess.

So this ADMROCKS must be a mainstream method/kit, but I was unable to find
anything online via normal means.

Please let me know if you come up with anything. Thank you in advance!

Japheth Benfield
j5 () neutral org
http://j5.neutral.org

On Mon, 7 Feb 2000, Steve Logan wrote:

> This morning I tried to ssh to a domain I host on one of my boxes.  I soon
> realized the domain wasn't resolving.  I then ssh'd to the ip of the box.
> I discovered that named wasn't running.  I restarted it.  I was curious to
> find out why it had died.  I started looking through the logs and I soon
> realized my machine had been broken into. Several binaries had been
> replaced.  (ps, ls, netstat, ...).  I replaced the ps and ls and found
> some interesting things.  There was a process running called in,telnetd
> (notice the comma).  I found this in "/usr/ /":
>
> rwxr-xr-x   2 root     root         4096 Feb  6 21:41 .
> drwxr-xr-x  20 root     root         4096 Feb  6 21:38 ..
> -rw-r--r--   1 root     root           39 Feb  6 21:38 .l
> -rw-r--r--   1 root     root           44 Feb  6 21:38 .n
> -rw-r--r--   1 root     root           31 Feb  6 21:40 .p
> -rws--x--x   1 root     root       281416 Feb  6 21:38 .tt
> -rwxr-xr-x   1 root     root       373176 Feb  6 21:38 .ttb
> -rw-r--r--   1 root     root          698 Feb  6 21:38 .ttf
> -rwxr-xr-x   1 root     root         7860 Feb  6 21:38 in,telnetd
> -rw-r--r--   1 root     root      2518030 Feb  7 10:52 sniff.log
>
> After running strings on these files it appears they are a shell program
> and password files.  The in,telnetd is logging all network traffic to
> sniff.log.  All of the log files had been modified.  History was modified.
> wtmp was modified.  inetd.conf was changed.  Several other things were
> also changed.  There was a directory called ADMROCKS in /var/named.
>
> Has anyone else experienced this?  How did they get in?  At this point
I'm
> pretty sure it was through named.  How should I go about cleaning it up?
> Right now I think I'll just reinstall the RPM's off of the cd.  Will this
> be enough (along with upgrading BIND)?  If anyone could share any useful
> information please do so.
>
> Thanks,
> Steve Logan