From: weber@rhrk.uni-kl.de (Christoph Weber-Fahr [KIT])
Subject: Strange security problem with phantom user
Organization: University of Kaiserslautern, Germany
Date: Tue, 5 Jan 1993 18:11:22 GMT

Hello,

for some time now I've got a problem here. The Server in question is
a 3.11 Server with stations on a token-ring. The server is also connected
to the IPX routing ethernet university backbone. The station of the token
ring can be considered secure and trusted.

It started in October when I noticed occasionally someone logging into my
printserver account. This person used a non-existing (but according to our 
numbering scheme legal) network number and a certain NIC number. 

Ok I thought, some hacking student got hold of Brad Clement's Loader.exe
(or something similar) and is playing around. Maybe he set up a nondedicated 
router - this would explain the odd network number.
Later I installed that first securefx.nlm, which alerted and disconnected 
attacked connections. Intrestingly, everytime this printserver-login occured
now, a connection on the token ring (!) was claimed to be under attack.
This was annoying enough that I put a password on the printserver account.
The problem diappeared.

But now there seems to be round two: Yesterday I discovered a guest-login, 
when the department was closed in the evening. My GUEST-Account is restricted
to stations on my local token-ring. So I went around and checked all 
machines, assuming someone forgot to shut off his machine. 
Nothing - they all were shut off. 
Checking in Monitor I saw that this guest ws logged in with the 
Network-Number of the Token-Ring (!!), but with the NIC number my 
Printserver-Hacker always had used. Scanning my logs I discoverd that this
had occurred two or three times before.
So something is going on there

Now I am looking for ideas, what could have happened:

- the file-server occasionally creates delibertely phantom-users.
But - I never heard of something like that. Quite unlikely.
Has anyone heard something like this ?

- someone has physically attacked (tweaked) the token-ring now trying to
  hack the system.
But - this is pure nonsense. There is nothing secret in my server justifying 
even 1 % of the cost and work necessary doing something like this. The 
cables of the token ring all lie within one department and floor. It is 
extremely difficult to establish a link to the outside without beeing
seen.

- there is some piece of software in the server acting as trojan. 
  Such software (an NLM) is typically available from dubious sources
  and accessible via TCP/IP and/or IPX.
But - this is not very logical. An nlm running on the server already has
all rights. It doesn't need to fake printserver accounts etc.
Additional to that, I assume it would be extremely difficult to play in the
server's internal connection tables to simulate a connection to an 
existing (and routed) network.

Any Ideas out there ? Did I miss something obvious ?

Thanks in advance for any idea..

Regards

Christoph Weber-Fahr


-- 
  Christoph Weber-Fahr                  |  E-Mail:  weber@rhrk.uni-kl.de 
  Universitaet Kaiserslautern,  KIT     |  S-Mail:  Postfach 3049
  Tel. 0631/205-3391                    |           D-6750 Kaiserslautern
--------------------------  My personal opinion only    ---------------------
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU