Re: How to detect a trojan on a Unix server?

From: Juergen P. Meier (news-reply@news.jors.net)
Date: 05/30/02 

From: "Juergen P. Meier" <news-reply@news.jors.net>
Date: Thu, 30 May 2002 11:54:34 +0000 (UTC)

followup to Ryo Furue:
> A user reported that when she connected to our FTP server, the Norton
> security software on her PC said that the PC got a Trojan attack from,

Does that user perhaps said this ``attack'' targets port 113? In that
case its a false alarm (as usual with Personal Firewall crap) - your
FTP server just uses the Ident protocol. (see RFC 1413 for details)

Or does that User try to do directory-listings or download files and
that does not work while here Norton crapware reports "attacks" from
port 20 to high ports? (hit her with RFC 959).

> say, 1.11.11.111 (This is a fictious IP address), which is the FTP
> server's IP address. I'm worried because I'm an admin of the server.
> Does this mean that the server has some malicious software installed
> which scans the ports of hosts connecting to it? How can I examine
> what's going on? Could some kind soul refer me to some information
> sources? The server is a Sun Ultra 1 with Solaris 2.5.1.

The only *sure* way to detect a trojan horse is a Post Mortem
Anlaysis, which implies that the FTP-server needs to be taken offline
powered down and then bootet from a safe medium (i.e. CDRom), so you
can use the tools on that medium (i.e. CDRom) to analyze the contents
of our Harddisk. This is nessecary because you cannot trust any
programm on your harddisk to show you correct information. Modern
rootkits modify almost any useful programm on the "infected" machine
so that the Admin can no longer use these tools to find the trojan
horse.

Since many scriptkiddies and their rootkits are far from perfect,
there exitsts a tool called chkrootkit that can be run on the
suspected server and report many imperfect rootkits. When this does
not find anything it does not mean you are clean however ;)

RFC documents are available at various locations including
http://www.ietf.org/rfc.html

Juergen 

-- 
begin  signature:
Juergen P. Meier - "This World is about to be Destroyed!"
This is it. Nothing more to come. There is no more text. It's the
end

Relevant Pages

  • RE: FTP Proxy
    ... You're right about the server specifying the port -- I ... to get to a single specific outside FTP server. ... And allowing PASV mode means you can't do that with a simple packet ...
    (Security-Basics)
  • Re: FTP port number
    ... >I'd like to create a little FTP server for a few clients of ours. ... > avoid using the port 21 for security reasons. ... Are you sure that's really a good security measure? ... Hiding a server like that is really not all that strong of a security ...
    (microsoft.public.inetserver.iis.ftp)
  • Re: Exchange wont start, problems with the event viewer
    ... Port 21 was open and MS FTP server was running. ... Exchange depends on the Event Log, ...
    (microsoft.public.windows.server.sbs)
  • Q: Problem for invalid transfer mode in the ISA2004 FXP(SITE TO SITE).
    ... as we know, majority of FTP Server supports FXP mode, it means to transfer ... current famous FXP tool has FLASHFXP. ... then, I encounter another problem, my local ISA2004 server does not support ... 500 Invalid PORT command. ...
    (microsoft.public.isa.vpn)
  • Q: Problem for invalid transfer mode in the ISA2004 FXP(SITE TO SITE).
    ... as we know, majority of FTP Server supports FXP mode, it means to transfer ... current famous FXP tool has FLASHFXP. ... then, I encounter another problem, my local ISA2004 server does not support ... 500 Invalid PORT command. ...
    (microsoft.public.isa.clients)