# MA-026.062001: MyCERT Advisory - Rootkit Attack

**Date:** 21 Jun 2001  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-026.062001  
**Advisory ID:** MA-026.062001

---

1.0 Description
#### 1.1 Overview
MyCERT received reports lately of intruders activity of root compromise involving Linux and SUNOS machines. Upon analysis of victim's machines, MyCERT discovered that the machines have been attacked and installed with rootkit, versions 't0rnkit', or 'tornkit', lrk, adore and rootkitsunos which cause root compromise of the machines.
Rootkits are not something new and have been used by intruders for several years.Rootkit's lineage can be traced back to as early as 1994 and since then it has been anonymously referred to in various CERT and CIAC advisories.
Rootkit is a collection of programs which allows an intruder by hiding his/her presence to install and run an Ethernet sniffer on a SUNOS or Solbourne host using /dev/nit or Linux host using the eth0 interface. Using the sniffer program, an intruder can obtain the userids and passwords, including root to your most sensitive networked system.
Most versions also include a trojan horse version of tcp\_wrappers in RPM format named 'tcpd.rpm'.
The important thing here is to be aware of the widespread nature of this particular attack and to insure compromised hosts are recovered using appropriate procedures and techniques including preventive measures in order to prevent such attacks in future.
#### 1.2 Versions of Rootkit
lrk3, lrk4, lrk5, lrk6 (and some variants);
Solaris rootkit;
FreeBSD rootkit;
t0rn (including some variants and t0rn v8);
Ambient's Rootkit for Linux (ARK);
rh[67]-shaper;
Romanian rootkit;
RK17;
kenny-rk;
Adore LKM;
Maniac-RK;
dsc-rootkit.
#### 1.3 Affected Machines
Linux
SUNOS
Win NT
Win 2000
#### 1.4 Cause
A rootkit attack causes the intruder to hide his/her presence to compromise and get full control of the server. Consequently, a compromised server can be used as launching pad to penetrate and further propagate other networks.
### 2.0 Technical Matters
#### 2.1 What a malicious user could do?
The intruders use a stolen or easily guessed password to log in to a host. They then gain unauthorized root access by exploiting known vulnerabilities in rdist, sendmail, /bin/mail, loadmodule, rpc.ypupdated, lpr, or passwd. The intruders ftp Rootkit to the host, unpack, compile, and install it; then they collect more username/password pairs and attack more hosts.
#### 2.2 Scope
Rootkit includes an installation of malicious script which attempts the followings:
- killing syslogd
- alerting the intruder to remote logging facilities by searching the syslog configuration file for the '@' character
- storing an intruder-supplied password for trojan horse programs in /etc/ttyhash
- installing a trojan horse version of sshd configured to listen on an intruder-supplied port number with intruder- supplied SSH keys stored in a directory which was predefined by intruder. The same command is appended to /etc/rc.d/rc.sysinit or /etc/rc.d/init.d/network start the daemon at system boot time.
- locating trojan horse configuration files to hide file names, process names, etc. in hidden directory.
- replacing the some system binaries with trojan horse copies such as:
- /bin/login
- /sbin/ifconfig
- /bin/ps
- /usr/bin/du
- /bin/ls
- /bin/netstat
- /usr/sbin/in.fingerd
- /usr/bin/find
- /usr/bin/top
- installing a password sniffer, sniffer logfile parser, and system logfile cleaning tool in hidden directory.
- attempting to enable telnet, shell, and finger in /etc/inetd.conf by removing any leading '#' comment characters or appending some other services in /etc/inetd.conf.
- alerting the intruder about the word 'ALL' appearing in /etc/hosts.deny
- some versions attempt to patch rpc.statd and wu-ftpd with versions that are not vulnerable.
- restarting /usr/sbin/inetd
- starting syslogd
### 3.0 Prevention
#### 3.1 Detection
If the intruder has removed or deleted his/her traces in the logs, attcaks would be difficult to be detected. Most system administrators don't know their site has been attcked with rootkit until they are contacted by someone at another site or their disks begin filling up due to the sniffer's logs.
If you suspect disk usage, you should become alarmed, especially in light of the du and ls Trojans. Once you suspect your machine has been attacked with rootkit, you can do several things to verify this. The simplest is to try du, ls, ps, and netstat with the -/ option. If any of them accept this option, then Rootkit has been installed. Also, there is no short-circuiting in the mask list processing; even when you have a hit with a mask specification, the checking continues. So, a large specification list could conceivably cause a noticeable slowdown in the program. Text files found with file in /dev (especially with names of the form /dev/pty without device numbers) are also suspect.
Another way to verify intrusion is to use system programs whose integrity is known, such as Tripwire even a simple security checking script, that records the file sizes and parameters. Some of the trojaned commands may behave oddly or even wrong if the hacker didn't fully know the system. Putting original copies of ps, ls, du, ifconfig, and netstat on a write-protected floppy disk is a good idea. These may be used in situations in which the integrity of the system programs on the hard disk are questionable.
Some Checking program and script can be download from
> http://www.chkrootkit.org
> http://vancouver-webpages.com/rkdet/
> http://www.hsc.fr/ressources/outils/rkscan/index.html.en
However, you will discover all these symptoms too late, when the harm has already been done.
#### 3.2 Removal
- Disconnect the host from the network during the recovery. This will keep users and intruders from accessing the system.
- Make back-ups into another disk.
- Clean up the binaries.
- Reinstall the OS.
#### 3.3 Prevention
- Installing and run system security programs such as Tripwire to check for system file integrity.
- Installing an IDS which can detect any illegal and suspicious activities.
- Regular checking/monitoring/back ups of the system.
- Look for any odd behavior of your system, ie high usage of disk.
- Run md5sum on binaries such as /bin/ps, /bin/ls and many others and save the results to a floppy that will be stored in a secure place.
### 4.0 More Information
To obtain more information on this rootkit, please refer to the following site:
http://www.cert.org/advisories/CA-2001-05.html
http://www.sans.org/y2k/t0rn.htm
http://www.linuxsecurity.com/articles/intrusion\_detection\_article-2680.html