RE: Removing ShKit Root Kit

[John.Airey () rnib org uk]

> -----Original Message-----
> From: Cael Abal [mailto:lists () onryou com]
> Sent: 23 December 2003 15:08
> To: full-disclosure () lists netsys com
> Subject: Re: [Full-disclosure] Removing ShKit Root Kit
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> |>> OK, so how does the attacker get the ADS to run? If you open
> |>> something.txt in notepad, it doesn't launch the ADS 
> 'trouble.exe' as
> |>> an executable file. It's ignored.
> |
> | The easy answer is start a command prompt and type
> |
> | start something.txt:trouble.exe
> |
> | it does not even have to be tagged .exe or .com or whatever. As an
> | exercise, copy notepad.exe to calc.exe:notepad and then 
> launch a command
> | prompt and type "start calc.exe:notepad" You should be looking at
> | notepad. I no longer have a handy M$ system to verify the 
> steps on so if
> | it does not work play with it for a few minutes.
>
> Although Jason is exactly right about ADS' under NTFS as covert data
> storage (in theory, even if his examples don't quite work) it's all a
> bit off topic -- the server in question was a RH 8.0 box and besides,
> ADS' are trivial to find if you're looking for them and 
> aren't likely to
> see much use in the wild.
>
> All this discussion about particulars is beside the point -- 
> the thrust
> of the matter is that attacker/defender roles have been reversed,
> leaving the good guy in an untenable position.  Do you really 
> think it's
> wise to bet you're smarter or more resourceful than a person who has
> (already) rooted the box once?
>
> take care,
>
> Cael
An even better solution is to have a method of installing a machine where
the latest program packages can be installed and the configuration can be
repeated. Red Hat comes with this ability, by combining the "genhdlist"
program (comes with the anaconda-runtime package) with a script run via NFS.
Once you have that, you only need to backup the actual data, not the
configuration (so the issue of trusting the backup goes away).

Of course, you'll need an RHCE who really knows his/her stuff to set it
up...

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey () rnib org uk 

There is more historical evidence for the existence of Jesus Christ than for
either Henry VIII or Julius Caesar.

- 
DISCLAIMER: 

NOTICE: The information contained in this email and any attachments is 
confidential and may be privileged. If you are not the intended 
recipient you should not use, disclose, distribute or copy any of the 
content of it or of any attachment; you are requested to notify the 
sender immediately of your receipt of the email and then to delete it 
and any attachments from your system. 

RNIB endeavours to ensure that emails and any attachments generated by 
its staff are free from viruses or other contaminants. However, it 
cannot accept any responsibility for any  such which are transmitted.
We therefore recommend you scan all attachments. 

Please note that the statements and views expressed in this email and 
any attachments are those of the author and do not necessarily represent 
those of RNIB. 

RNIB Registered Charity Number: 226227 

Website: http://www.rnib.org.uk 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html