Messages in this thread | | | Date | Tue, 28 Dec 1999 17:37:31 -0500 (EST) | From | "Richard B. Johnson" <> | Subject | Re: Unexecutable stack |
| |
On Tue, 28 Dec 1999, Gregory Maxwell wrote:
> > Because of this message, I have already recieved three emails with the > belif that I am the attacker, I suppose because I am the 'to'. > > If you intended to claim this, then please state it outright so that I may > defend myself. Obviously, I am saying that I am not your attacker, my > careere has little to do with security, I'm just a kernel hacker wanna be > and the network I control, is likely less secure then yours (but I > inherited it and I'm trying to fix it. :) ) >
I just presented evidence and a claim. There are three who sent me private email so hot it can burn holes in hard disks. You were not one of them.
> If not, then if you post again on the subject can you indicate who you do > think it is, or that you don't know. >
Because we have a Cisco Router, all the packets came from the hardware address of the router. So, without putting a monitor on the UU.NET side there is no way I could tell where they are coming from. Even then, the real prober could hide because the 'dirty work' is done by RPC Services locally.
> > > Note that all the 'from' addresses are legit local addresses. This > > is a typical log of a system under attack. No "stack patches" will > > help you here. > > Of course stack patches wouldn't help. This is a DOS attack, not a hack > attempt. >
Well it's not a DOS attack. DOS means "denial of service". It is a break-in attempt. They are different. What is happening is the network intruder is trying to get a copy of the password file. So, he does the essential equivalent of `showmount -e` to see what if any hosts are allowed to mount either '/' or '/etc'. If any such hosts are found, he attempts to emulate them. If it can mount '/' or '/etc' it can read the password file. Once the root password is copied to the intruders "den", a password-cracker program will make quick work of finding a root password. Note that crypt() is "lossy". There may be many combinations of letters and characters that may satisfy the password.
Once the intruder gets the root-password, it doesn't mean that he's in. Most systems default to not allowing root to login from the network. Root must first log into another account. So, the intruder usually has to find two passwords that work. Also, the intruder had better copy the whole password file and look at it. On many systems 'root' is not uid(0)/gid(0). Some other name is chosen. For instance, on this system 'root' is just a user-account. It is used to defray spam. Most spammers don't send email to root, bin, etc., although many do send spam to ftp.
The reason why I logged so many errors during the attack was because the data returned from the initial probe was wrong. When you have the source, you can be sneakey.
The attacker then started to try all possible combinations of hosts IPs to see if any would satisy constraints. But, alas, nobody anywhere could really mount either / or /etc. The attacker __should__ have tried to log in first to save time. He would have found that those ports are blocked through the Cisco.
If anybody wants a copy of the unedited log, let me know privately. I will email it to you.
Cheers, Dick Johnson
Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips). Warning : The end of the world as we know it requires a new calendar. Seconds : 282149 (until Y2K)
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |