Re: Compromised Win2000 machine.

From: H C (keydet89@yahoo.com)
Date: 05/30/02 

Date: Wed, 29 May 2002 19:09:32 -0700 (PDT)
From: H C <keydet89@yahoo.com>
To: Mark Newby <mark@dranton.com>

Some additional thoughts on this particular issue...

> ...but I thought the advice for a (possibly)
> compromised box was *not*
> to run executable programs that resided on that
> host, as they can't be trusted?

While I definitely recommend burning your tools...even
the ones shipped w/ NT/2K, including cmd.exe...to a
CD, to be quite honest, has anyone ever actually seen
a system w/ a trojaned netstat? Now, I know many
folks are going to pump their arms into the air...so
let me clarify...this is a 2K box. Has anyone ever
seen a trojaned cmd.exe or netstat.exe? Has anyone
seen netstat.exe on an NT or 2K system "trojaned" so
as to NOT show certain connects...but otherwise, it
works fine?

Remember...the Linux/*nix architectures are different
from that of NT/2K...and XP. I'm not saying that this
can't be done...I'm simply asking if anyone can show,
with proof, that this *has* been done? And it doesn't
have to be just netstat.exe...it can be any other
native tool. And binding the .exe file using
SaranWrap or EliteWrap doesn't count, as the basic
functionality still exists and all network connects
(netstat) will still be shown...

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • [Full-Disclosure] [Fwd: Re: [Cafe_OA] *OT* Leave the bots alone]
    ... >While insulting the spambots is momentarily satisfying, ... >are getting smarter or is Yahoo just getting slack? ... I have actually saved money because they gave me good advice. ... called "Geekspeak" on radio station KUSP. ...
    (Full-Disclosure)
  • Re: grub is gone
    ... > I just rebooted my computer so I could try the advice ... > Do you Yahoo!? ... Try booting from CD into rescue mode and see if the linux partitons will ...
    (Fedora)
  • where should I start?
    ... I want to learn how to use sniffer tools such as ... traffic...Any advice or link will be greatly ... Win 1 of 4,000 free domain names from Yahoo! ... are guaranteed to be 12 students or less to facilitate one-on-one ...
    (Security-Basics)
  • Re: cant receive emails
    ... If you have an account with Yahoo!, Excite or Hotmail try sending yourself a ... A word of advice for you: do not reveal, ...
    (microsoft.public.internet.mail)