Introduction to the prevention of rootkit attacks on the Solaris Server

Article Title: Introduction to the prevention of rootkit attacks on the Solaris server. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

I. rootkit Definition

The term rootkit has existed for more than 10 years. It is a toolkit consisting of useful small programs, allowing attackers to maintain "root" access to the user with the highest permissions on the computer ". In other words, rootkit is a group of programs and code that can persist, reliably, and cannot be detected on a computer. In the above rootkit definition, the keyword is "unable to detect ". Most of the techniques and techniques used by rootkit are used to hide code and data on computers. For example, many rootkits can hide files and directories. Other features of rootkit are usually used for remote access and eavesdropping-for example, to sniff packets on the network. When these features are combined, they bring a devastating impact to safety.

To gain control of a host, the simplest of course is to attempt to log on by using a login program (such as login, ssh, telnet, etc.) and a program that guesses the password. However, because most login programs have a limit on the number of logins, it is not so popular to use password guesses. For the sake of system network security, Senior hackers write programs to Test Service vulnerabilities on their hosts. After detecting vulnerabilities in some services, they will report the maintenance groups of the services, or contribute your own repair methods to supplement the security of your system. After receiving such a notification, the Service Development/maintenance team will modify the program in the shortest time and notify and release the patch for the vulnerability on the Internet.

However, after the vulnerability is reported, some malicious hackers will launch attacks against the vulnerability by releasing the Sun window with the patch. These hackers also write programs to attack the vulnerability, at the same time, attackers can gain control of the attacked host, or implant trojans on the attacked host. The difference between these hackers and senior hackers is that they are proud to post the results of attacks on some websites that hackers often use to sell themselves. At the same time, they will also spread their malicious programs to the Internet. Some hackers collect these malware into software packages and make them more popular on the Internet. These malicious packages are called rootkit.

　　Ii. rootkit type

We can divide rootkit in unix and Linux into two categories: application-level rookit and kernel-level rootkit

1. application-level rootkit

The application-level rootkit is the most commonly used rootkit. Attackers replace normal applications and system files in the system with Trojans in rootkit. Trojan programs provide backdoors to attackers and hide their traces. Any activities performed by attackers are not stored in the recorded files. The following lists some files that attackers may replace:

Programs that hide traces of attackers

(1) ls, find, and du-trojan programs can hide attackers files and cheat the system, so that system files and directories can leak messages.

(2) ps, top, and pidof-these programs are program monitoring programs that allow attackers to hide their own programs during the attack.

(3) netstat-netstat is used to check links and listeners for network activities, such as open communication ports.

. The trojan program netstat can hide the attacker's network activities, such as ssh daemon or other services.

(4) killall-the trojan program killall prevents the Manager from stopping the program.

(5) ifconfig-when the listening software is being executed, the trojan ifconfig does not display PROMISC flag, so that attackers can be hidden and not noticed by the listening software.

(6) crontab-the trojan program crontab can hide the attacker's crontab entry.

(7) tcpd, syslogd-the trojan program tcpd and "syslog" won't record the attacker's behavior.

Backdoor Program

(1) chfn-improves user permissions. Execute chfn. when entering the new user name, you only need to enter the rootkit password to obtain the root permission.

(2) chsh-improves user permissions. Execute chsh. when entering the new shell, you only need to enter the rootkit password to obtain the root permission.

(3) passwd-improves user permissions. Execute passwd. when entering the new password, you only need to enter the rootkit password to obtain the root permission.

(4) login-records any user name, including the root login password.

(5) bd2-Trojan program rpcbind allows attackers to execute arbitrary program code on the victim host.

Trojan program

(1) inetd-the trojan program inetd can open the remote login communication port for the attacker, and the root permission can be obtained by entering the password.

(2) rshd-provides remote shell for attackers.

(3) rsh-the root password can be obtained through rsh.

(4) sshd: attackers can log on with a specific account and password to have the root shell permission.

Listener

(1) linsniffer-a small linux listener.

(2) sniffchk-This program can check and confirm whether the network listener is being executed.

(3) listening program for le-Solaris Ethernet packets.

(4) snif-listener for other linux packets.

(5) sniff-10mb-this is a listener designed to listen to 10 mbps Ethernet.

(6) sniff-100mb-this is a listener designed to listen to 100 mbps Ethernet.

Other types-

(1) fix-the time stamp changed when the trojan program is installed (for example, ls) and the packet value information.

(2) wted-wtmp editing program. Attackers can modify wtmp.

(3) z2-Remove wtmp/utmp/lastlog.

(4) bindshell: combines rootshell with a communication port. (Default port number: 31337)

(5) zap3-attackers will remove their traces from wtmp, utmp, lastlog, wtmpx, and utmpx.

. Zap3 usually finds the location of the record file based on the following directories, such as/var/log,/var/adm,

/Usr/adm, And/var/run.

2. kernel-level rootkit

The kernel-level rootkit is a more powerful rootkit than the application-level rootkit. Kernel-level rootkit

Operating and using the kernel has become the most difficult to find rootkit, because it can establish a bypass test channel in the application layer check. Although this software is mainly made for linux, it may be modified to attack a communication port or other operating systems. Once installed on the target host, the system can be said to be completely controlled by hackers, and the system administrator cannot even find the hidden traces of hackers. How does the kernel-level rootkit work? It basically uses the LKM "Loadable Kernel Module" function to allow attackers to perform illegal operations. LKM is a very useful tool in linux or other systems. systems supporting LKM include FreeBSD and Solaris. Some functions in the operating system are used by the system to construct the kernel. When these functions are counterfeited and tampered, the host cannot be trusted any more. The following describes how to operate the kernel-level rootkit:

(1) hide a program-during unix execution, the recorded information of the program is stored in "/proc" in the file system. The hidden program can operate sys_getdents () System Call functions, these additional and ongoing programs are invisible in the program architecture.

(2) Hide network links-similar to hidden programs, network links are recorded in the files "/proc/net/tcp" and "/proc/net/udp, when the Kernel rootkit is executed, attackers can hide the traces of the two files whenever they read them.

(3) Hide LKM signals-generally, the default value of LKM is visible, so that other users can use it easily. Attackers must use the "EXPORT_NO_SYMBOLS" command to hide these signals to prevent any signal from being leaked.

(4) After the LKM-LKM Kernel rootkit is installed, attackers can replace sys_settimeofday () with the kernel rootkit to notify the Kernel to hide another file (). Then, by using some special parameters, attackers can request the system to do what they want.

(5) Change File Execution-sometimes attackers may want to replace some files, such as "login", but do not want to change the file. In this case, the Kernel rootkit can replace sys_execve (). In this way, the system will continue to execute "login" and leak the version of the "login" program to attackers.

Currently, the most popular Kernel-level rootkit includes knark on linux and Loadable Kernel Module on Solaris. knark also contains the following programs:

(1) hidef: used to hide files.

(2) unhidef: Used to set execution file redirection so that attackers can execute Trojans.

(3) nethide: it can hide/proc/net/tcp and/proc/net/udp strings, which is also the place where netstat retrieves data, attackers can use this tool to hide online messages used on the target host.

(4) taskhack: attackers can change the program being executed to the root user account.

(5) rexec: It can execute commands remotely on the knark server or support ip spoofing.

(6) rootme: You can escalate the permission to root.

[1] [2] [3] [4] Next page