lkml.org 
[lkml]   [1999]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Unexecutable stack
On Tue, 28 Dec 1999, Gregory Maxwell wrote:

>
> Because of this message, I have already recieved three emails with the
> belif that I am the attacker, I suppose because I am the 'to'.
>
> If you intended to claim this, then please state it outright so that I may
> defend myself. Obviously, I am saying that I am not your attacker, my
> careere has little to do with security, I'm just a kernel hacker wanna be
> and the network I control, is likely less secure then yours (but I
> inherited it and I'm trying to fix it. :) )
>

I just presented evidence and a claim. There are three who sent me private
email so hot it can burn holes in hard disks. You were not one of them.

> If not, then if you post again on the subject can you indicate who you do
> think it is, or that you don't know.
>

Because we have a Cisco Router, all the packets came from the hardware
address of the router. So, without putting a monitor on the UU.NET side
there is no way I could tell where they are coming from. Even then,
the real prober could hide because the 'dirty work' is done by
RPC Services locally.

>
> > Note that all the 'from' addresses are legit local addresses. This
> > is a typical log of a system under attack. No "stack patches" will
> > help you here.
>
> Of course stack patches wouldn't help. This is a DOS attack, not a hack
> attempt.
>

Well it's not a DOS attack. DOS means "denial of service". It is a
break-in attempt. They are different. What is happening is the
network intruder is trying to get a copy of the password file. So,
he does the essential equivalent of `showmount -e` to see what
if any hosts are allowed to mount either '/' or '/etc'. If any
such hosts are found, he attempts to emulate them. If it can
mount '/' or '/etc' it can read the password file. Once the
root password is copied to the intruders "den", a password-cracker
program will make quick work of finding a root password. Note that
crypt() is "lossy". There may be many combinations of letters and
characters that may satisfy the password.

Once the intruder gets the root-password, it doesn't mean that he's
in. Most systems default to not allowing root to login from the
network. Root must first log into another account. So, the intruder
usually has to find two passwords that work. Also, the intruder
had better copy the whole password file and look at it. On
many systems 'root' is not uid(0)/gid(0). Some other name is
chosen. For instance, on this system 'root' is just a user-account.
It is used to defray spam. Most spammers don't send email to root,
bin, etc., although many do send spam to ftp.

The reason why I logged so many errors during the attack was because
the data returned from the initial probe was wrong. When you have
the source, you can be sneakey.

The attacker then started to try all possible combinations of hosts
IPs to see if any would satisy constraints. But, alas, nobody anywhere
could really mount either / or /etc. The attacker __should__ have
tried to log in first to save time. He would have found that those
ports are blocked through the Cisco.

If anybody wants a copy of the unedited log, let me know privately.
I will email it to you.

Cheers,
Dick Johnson

Penguin : Linux version 2.3.13 on an i686 machine (400.59 BogoMips).
Warning : The end of the world as we know it requires a new calendar.
Seconds : 282149 (until Y2K)


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:6.064 / U:0.052 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site