Welcome to Scribd. Sign in or start your free trial to enjoy unlimited e-books, audiobooks & documents.Find out more
Download
Standard view
Full view
of .
Look up keyword
Like this
1Activity
0 of .
Results for:
No results containing your search query
P. 1
Discovery of Compromised Machines by Dr. Anton Chuvakin

Discovery of Compromised Machines by Dr. Anton Chuvakin

Ratings: (0)|Views: 30|Likes:
Published by Dr. Anton Chuvakin
How to discover compromised machines?
How to discover compromised machines?

More info:

Published by: Dr. Anton Chuvakin on Oct 19, 2009
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as DOC, PDF, TXT or read online from Scribd
See more
See less

10/19/2009

pdf

text

original

 
Discovery of Compromised Machines
Dr. Anton Chuvakin
WRITTEN: 2003
DISCLAIMER 
:Security is a rapidly changing field of human endeavor. Threats we face literally changeevery day; moreover, many security professionals consider the rate of change to beaccelerating. On top of that, to be able to stay in touch with such ever-changing reality,one has to evolve with the space as well. Thus, even though I hope that this documentwill be useful for to my readers, please keep in mind that is was possibly written yearsago. Also, keep in mind that some of the URL might have gone 404, please Googlearound.
One of the latest security books I read had a fascinating example in the preface. Theauthors, well-known and trustworthy experts in the field of security, made an outrageousclaim that most of the Fortune 2000 companies are
already 
penetrated by hackers (andhave been in that state for years!). Hackers move in and out at will through thebackdoors and other covert channels without the security personnel knowing or evensuspecting it. Without being able to verify whether this claim is true or false, I decided tolook at the problem of reliably discovering the compromised machines on corporatenetworks. Reliability is of key importance here as there are lots of ways to obtain a
suspicion
that the machine is “owned” or infected, but sadly there are few truly reliableways to discover that short of full forensic analysis, likely requiring physical access to amachine as well as shutting it down for a potentially long time.In addition, as advanced blackhat community moves beyond buffer overflows into newexploit type areas and zero-days attacks (with non-public exploits against non-publicvulnerabilities) have a chance of becoming more common, traditional intrusion detectionrates might decrease even further, giving defenders no chance to detect, let along stopthe attack. Obviously, in case of a zero-day, detecting a second order (i.e. after-exploit)traces becomes the only option, as the attack itself will most likely fly through mostnetwork security monitoring gear, by the very nature of being a “zero-day”. Some of theexisting attacks can also be mutated and optimized to pass through some of thedetection filters.First, let us outline what we mean by a “compromised” machine. A machine isconsidered “compromised” if:
It was successfully exploited and used by attackers
It has a backdoor or other malicious software running without the knowledge of the system owner 
It was configured to allow access to unauthorized parties without the owner knowing itHere are some examples of the above that most people running the real-world networkscan identify with:
 
Example
1 A system is infected by a worm and then starts sending out humongousamounts of malicious traffic, trying to spread the infection in the organization’s networkand beyond
Example
2 System access privileges on the exposed FTP server are abused and it isthen taken over by amateur attackers to store and share their stash of porn and piratedsoftware
Example
3 A server is exploited by attackers and a rootkit is deployed. Several systembinaries are trojaned for easier and more covert attacker access. Also installed is anIRC bot that “calls home“ to a specific channel for commands.The above example might give the reader some hints on how to detect a compromise inthose specific cases, but we will treat the problem in a more general fashion.Let us first look at the current technologies used for detecting the activities of theattackers. There are attack detection systems (often mislabeled as “intrusion detection”)that look for various attack
attempts
and probes. Then, there are intrusion detectionsystems that look for known intrusion methods utilized by hackers. Here, however, weare talking about reliable compromise detection - detecting the machines that wereattacked, intruded and are now used by either human attackers or their automated aides – malware.As noted above, reliability of detection is critical since stakes here are much higher thanin attack and intrusion detection; the alerts we will raise will be immediately actionable(unlike what is coming from most deployed NIDS). It will be “your machine was hackedand is now used by attackers, run there and do
something
” vs “it seems like somebodymight be attacking you or something of that sort, you might want to pay attention.”How can we detect that the machine is indeed compromised? The answer heavilydepends upon what kind of information and tools are available as well as the position of the user. It is one thing to only go by the firewall data relevant to the potentiallycompromised machine and it is completely different if we have full access to thehardware, OS and application for such system in the forensics environment. Realizingthe benefits from the latter case obviously requires access to a skilled computer forensics professional as well as significant time investment.To get some background let’s briefly review some common activities occurring on thesystems compromised by attackers. These signs were discovered by the author over theyears of the honeypot research with the Honeynet Project as well as by other relatedefforts. Obviously, they refer to activities by the outside attackers and not by maliciousinsiders.1.A backdoor daemon can be launched by an attacker on a high-numbered port or an existing daemon trojaned. This is observed in most compromise cases.2.Installing an IRC bot or bouncer is a popular choice. Several IRC channelsdedicated entirely for communication of the servers compromised by a particular group were observed on several occasions3.In this age of DDoS and reflexive DoS, the classic point-to-point DoS tools arenot laid to rest. They are commonly used on some compromised machines todeal quick damage against the opponents on slower connections
 
4.Many attackers will use the compromised system for vulnerability scanning andwidespread exploitation. Used scanners and auto-rooters are capable of discovering and exploiting massive (thousands and more) numbers of systemswithin a short time period. Such large networks can be (and are!) used for devastating denial of service attacks5.Using a compromised machine to store pirated software or media is common aswell. On a high bandwidth servers, people are known to store gigabytes of “stuff”with active download and uploads occurring all the time. It is worthwhile to notethat one is often not required to exploit the server to use it for storage, sinceenough servers are misconfigured with extra privileges given to all connectingusers.
6.
“Earning” some cash by getting involved in stolen credit card trade (seehttp://www.honeynet.org/papers/profiles/cc-fraud.pdf for detailed reference) is anew choice, rapidly growing in popularity. Such activity utilized IRC with speciallymodified “trading” bots7.Another money-making “venture” is sending spam or “loaning” a compromisedbox to spammers for a reasonable fee.8.Another ominous activity is using the compromised machine for a “phishing” site.Attackers were observed to deploy a fake bank site and then launch waves of spam emails attracting visitors to be separated from their cash.In light of the above, we can summarize some of the compromise detection methods,given different available resources (both technical and human). Last column in the tablesbelow indicates detection reliability in the
absence
of any other information, ranging fromhighly uncertain (‘low’) to immediately actionable (‘high’). This subjecting rating,originating in author’s experience with compromised systems, still provides a usefulmetric of how much trust should be put into each event.We will start from simple compromise-related events and indicators.
Securitytechnology/resourceMethod Example Reliability
NIDSCompromisesignatureShell commands onSSL port TCP 443MediumNIDSPost exploit activitywhoamiincommand flowMediumNIDSVolume ooutbound exploits(same or different)Lots of SSL hits outMediumNIDSVolume ooutbound exploitsafter a similar inbound exploitLots of SSL hits outafter the system ishit by SSL exploitHighNIDS, firewallOutbound massiveport scanning, DoS,etcMany connectionsto port 1434 UDPfrom a singlesystemMediumHIDSAbuse-relatedsystem log recordsNew accountcreatedMediumHIPSApplication Connections, Medium

You're Reading a Free Preview

Download
scribd
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->