Professional Documents
Culture Documents
WRITTEN: 2003
DISCLAIMER:
Security is a rapidly changing field of human endeavor. Threats we face literally change
every day; moreover, many security professionals consider the rate of change to be
accelerating. On top of that, to be able to stay in touch with such ever-changing reality,
one has to evolve with the space as well. Thus, even though I hope that this document
will be useful for to my readers, please keep in mind that is was possibly written years
ago. Also, keep in mind that some of the URL might have gone 404, please Google
around.
Among other benefits, running a honeynet makes one acutely aware about "what is going on" out
there. While placing a network IDS outside one's firewall might also provide a similar flood of
alerts, a honeypot provides a unique prospective on what will be going on when a related server
is compromised used by the intruders.
As a result of our research, many gigabytes of network traffic dumps are piling up on the hard
drives, databases are filling with alerts, rootkits and exploit-pack collections are growing.
First, let us summarize the common exploits hurled at the exposed Linux machine. It won’t likely
be news to people who monitor activity outside their firewalls, but it may provide some insight into
current security threats to others. Scans, "innocuous" connection attempts and various spam (on
port TCP 25 and UDP 13x) are not included.
Jan 24 20:46:41 bastion snort: [1:1282:1] RPC EXPLOIT statdx [Classification: Attempted
Administrator Privilege
Gain] [Priority: 1]: {UDP} 10.0.0.10:931 -> 1.2.3.4:1024
And here is how this attack looks to the anomaly-based Bro NIDS,
recently deployed in our honeynet:
Jan 26 20:37:16 bastion snort: [1:1378:7] FTP wu-ftp file completion attempt { [Classification:
Misc Attack] [Pr
iority: 2]: {TCP} 10.0.0.10:33761 -> 1.2.3.4:21
Jan 26 20:37:16 bastion snort: [1:1622:5] FTP RNFR ././ attempt [Classification: Misc Attack]
[Priority: 2]: {TC
P} 10.0.0.10:33761 -> 1.2.3.4:21
and to Bro:
/scripts/..%2f../winnt/system32/cmd.exe?/c+dir
/scripts/..%35c../winnt/system32/cmd.exe?/c+dir
/scripts/..%5c%5c../winnt/system32/cmd.exe?/c+dir
/scripts/..%5c../winnt/system32/cmd.exe?/c+dir
/scripts/root.exe?/c+dir
/scripts/..\xc0/../winnt/system32/cmd.exe?/c+dir
/scripts/..\xc0\xaf../winnt/system32/cmd.exe?/c+dir
/scripts/..\xc1\x1c../winnt/system32/cmd.exe?/c+dir
/scripts/..\xc1\x9c../winnt/system32/cmd.exe?/c+dir
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
/msadc/..%5c../..%5c../..%5c/..\xc1\x1c../..\xc1\x1c../..\xc1\x1c../winnt/system32/cmd.exe?/c+dir
/MSADC/root.exe?/c+dir
/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe?/c+dir
/default.ida?
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u78
01%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
It is obvious that those cannot affect the Linux Apache web server of
the honeypot and are provided here only due to their extreme
volume. It is interesting to note that some IP addresses receive much
more than their share of such hits. This phenomenon is not explained
yet.
[Mon Mar 3 06:40:48 2003] [error] mod_ssl: SSL handshake failed (server
ns1.bkwconsulting.com:443, client 10.0.0.10) (OpenSSL library error follows)
[Mon Mar 3 06:40:48 2003] [error] OpenSSL: error:1406908F:lib(20):func(105):reason(143)
Feb 2 00:45:53 bastion snort: [1:1887:1] EXPERIMENTAL WEB-MISC OpenSSL Worm traffic
[Classification: Web Application Attack] [Priority: 1]: {TCP} 10.0.0.10:2328 -> 1.2.3.4:443
f. Here are some other less frequent attacks that flash by. A number
of hits against vulnerable PHP were observed. The attack did not
succeed and was seen only once or twice:
g. What is not there? Old bind attacks (very popular in 1999) are
gone, hopefully for good, and new ones (based on the recent Bind bigs)
failed to materialize. SSH bugs are not actively exploited, while
version surveying is observed pretty often. It is not clear why this is
the case.
<<<<PICTURE 1>>>>
Most of the captured kits are very simple, use only publicly available
technology and carry all the signs of being created by unskilled
people. They often corrupt the system and utilize such amazingly
"stealthy" capabilities as using the root directory of the system to
store their files or changing the root password ("owned means owned,
right?")
However, new and innovative tools do get brought in by the tide. For
example, the covert channeling binary (http://project.honeynet.org) or
the IPv6 tunnel tool were discovered.
The classic WU-FTPD incident starts from an anonymous login to the FTP
server. Then in a few minutes or hours the server is hit by the TESO
"wurm" exploit. It has a recognizable signature of trying to create a
directory 7350 (TESO).
In a few seconds, intruder tries to get his rootkit from a drop site
(often some free storage site or even a Yahoo account) which is then
deployed. Most observed rootkits start a ssh daemon on high port as a
main backdoor method. On the next session (which occurs within hours
or even days), we often see him getting scanners and trying to exploit
more machines.
The more recent openssl incidents are more interesting since the
attacker does not have root upon breaking into the system (such as, user
"apache"). One might think that owning a
system with no "root" access is useless, but we usually see active
system use in these cases. Here are some of the things that such
non-root attackers do on such compromised systems:
Throwing everything they have at the Holy Grail of root access seems
common as well. Often, the attacker will try half a dozen different
exploits trying to elevate his privileges from mere "apache" to
"root".
3. "Evil daemon"
While spoofed DoS is more stealthy and harder to trace, many of the
classic DoS attacks do not require root access. For example, ping
floods and UDP floods can be initiated by non-root users. This
capability is sometimes abused by the intruders, using the fact that
even when the attack is traced the only found source would be a
compromised machine with no logs present.
5. "More boxes!"
Worms and other automated entities are also common. We observed many
different OpenSSL worms (for their taxonomy, see
http://isc.incidents.org/analysis.html?id=177), including some with
novel components such as Windows OpenSSL exploit, DoS agents, IRC bot
deployment by the worm, automated local exploitation via ptrace bug,
different backdoors, etc.
Windows worms are also on the prowl. CodeReds, MS SQL and others are
not gone. Their traces surface in the logs on the regular basis. They
seem to be leading their own lives with ups and downs, sudden bursts
of activity, and never seem to go away.
Many other "fun things" are also hitting the shores of our
honeynet. Among them are such beasts as the packets from
255.255.255.255, port 31337, various kinds of spam (email, MS RPC, web
forms), a lot of various reconnaissance attempts (mostly scans and
pings). Scans for proxies (1080,8080, 3128) are also extremely
popular, as mentioned above.
This is an updated author bio, added to the paper at the time of reposting in
2009.