Information Security - Compromised Systems

Because of the difficulty in being sure all backdoors are closed, a compromised system should be rebuilt from scratch - even restoring from a backup may simply restore the compromising code.

These CERT publications are very useful:

If a computer has been compromised, all the tools and data on that computer that you may want to use to determine the integrity of the machine are suspect. Sophisticated tools, commonly referred to as root-kits, are widely available that replace all the commands a person would use to investigate a Unix machine. Similar kits exist and are being refined for Windows machines.

A careful and sophisticated system cracker will not leave any evidence for you to find. Others may leave traces that may be picked up, but you will need to be familiar with the operation and layout of your particular system. Since most computers nowadays have tens of thousands of files and multiple running processes that vary widely during operation this can be a complex and tedious process. It's like finding a needle in a haystack. The cracker only has to plant one needle to get into your system and you have to examine every straw. If you're using your system to look at the straws, there is a chance that the cracker can effectively force you to wear rose-coloured glasses causing you to miss the needle. That said, relatively unsophisticated individuals do many compromises, by random execution of mass produced hostile code, and/or on untargeted computers. In those cases, the compromises leave readily identifiable fingerprints for us to find.

Some areas to check are:

On Windows machines

  • List of open sockets and network programs - TCPViewPro, FPort
  • Anti-virus tools  (Norton and BOClean) can detect known remote control trojans
  • Desktop firewalls can tell you what network activity they're seeing. Windows desktop firewalls may tell you what applications are accessing the network.
  • List of running processes - task list
  • Startup files (windows registry/win.ini/system.ini/autoexec/startup folders - tools like Startup Cop and msconfig make this easier) to see what processes are being started at boot time
  • Additional instructions on detecting remote control trojans on Windows machines
  • NT AT entries to see what regularly scheduled processes are being run
  • Windows file shares

On Unix machines

  • List of running processes- ps command
  • The chkrootkit tool will detect some rootkits http://www.chkrootkit.org/
  • List of open sockets and network programs - Netstat -an {p}, lsof
  • Desktop firewalls can tell you what network activity they're seeing.
  • Access logs to see what systems have accessed your system.
  • Audit logs if you have auditing turned on.
  • Unix shell histories.
  • Startup files - Unix inittab/rc/inetd - to see what processes are being started at boot time.
  • Unix crontab entries to see what regularly scheduled processes are being run.
  • Unix .rlogin files, particularly the one for root.
  • Unix NFS file shares

There are two basic ways to determine what your system is doing independently of the system itself:

  1. Analyze network traffic to and from your machine with an external protocol analyzer or firewall logs. This is not a practical option for most system owners and won't detect actions by locally logged on operators. Compare the contents and attributes of the files on your computer with the contents and attributes of the files that are supposed to be there. This requires advance preparation. Tools like tripwire will allow you to compute file information for files on your computer. These should be stored off the computer to be used for later comparisons.

  2. Scripts can compare the information nightly and alert you if something has changed. However, you must be aware of which files change during the normal course of operating your computer and adjust your monitoring and reaction accordingly.

    Files that should be checked include at a minimum:

    On Windows machines

    • Windows registry entries, win.ini, system.ini, autoexec, and startup folders
    • System and root path variable settings.
    • Windows \windows and system folders containing system DLLs.
    • Command folder.
    • Windows operating system images and loaders.
    • System and administrator path variable settings.
    • Security and audit information
    • Windows event log configuration, audit configuration
    • Critical services
    • Windows At configuration, web server configuration, file sharing configuration


    On Unix machines

    • Startup files Unix RC files, inittab, shell profiles, and inetd.conf
    • System binaries Unix bin, etc, and lib directories.
    • Unix operating system image and loaders.
    • System and root path variable settings.
    • System and administrator path variable settings
    • Security and audit information
    • Unix syslog configuration, ipchains configuration, audit configuration, tcpwrappers configuration
    • Unix cron configuration, web server configuration, NFS configuration, FTP server configuration, etc.
    • Red Hat Linux has a utility called RPM that can be used to check the installed files against prepared packages available from the vendor's web site or from CDROM distribution media.

There is a commercial version of Tripwire that will run on Windows OSes. Many other commercial tools are also available such as Axent's ESM. Dr. Solomon's anti-virus product included a tool called viverify that could be used to perform the same task.

Western provides the best student experience among Canada's leading research-intensive universities.