CERT^® Advisory CA-1992-14 Altered System Binaries Incident

A complete revision history is at the end of this file.

The Computer Emergency Response Team/Coordination Center (CERT/CC) has received information regarding a series of significant intrusion incidents on the Internet. Systems administrators should be aware that many systems on the Internet have been compromised due to this activity. To identify whether your systems have been affected by the activity we recommend that all system administrators check for the signs of intrusion detailed in this advisory.

This advisory describes the activities that have been identified as part of this particular incident. This does not address the possibility that systems may have been compromised due to other, unrelated intrusion activity.

I. Description

II. Impact

III. Solution

A. Check your systems for signs of intrusion due to this incident.

1. Check the login, telnet, and uucpd binaries (for example, "/bin/login", "/usr/ucb/telnet", and "/usr/etc/in.uucpd" on Sun systems) against copies from distribution media. Note that a check for creation or modification times and sizes is not sufficient to assure that the files have not been modified. The CERT/CC suggests that you compare the output of the "sum(1)" or "cmp(1)" command on both the distribution and installed versions of the binaries.

2. If the check from (A.1) indicates that your binaries have been modified, check for the presence of a password log file. Since the name of the logfile is often changed, the name of the file should be obtained using the "strings(1)" command on the Trojan login, uucpd, or telnet binary. Examples of filenames used on other systems are:

   "/usr/spool/. " (dot space)
   "/var/spool/secretmail/.l"
   "/var/spool/secretmail/.log"
   "/var/spool/secretmail/.tty"
   "/var/spool/secretmail/.lock"
   "/usr/tmp/.log"
   "/usr/spool/uucp/.sys"
   "/usr/spool/uucppublic/.hushlogin"
   "/usr/uucp/.sys"
   "/mnt2/lost+found/.tmp/.log"
   "/usr/spool/mqueue/.AFG001"
   

   Verify that the contents of files found using the "strings(1)" command do not contain valid username/password combinations.

3. Check for the presence of "+" in the "/etc/hosts.equiv" file.

   NOTE that Sun Microsystems installs the SunOS operating system with a default "+" in the /etc/hosts.equiv file for easy network access. This should be removed unless required in your operating environment and protected by a firewall network configuration. Leaving the "+" intact will allow any non-root user on the Internet to login to the system without a password.

4. Check the home directory for each entry in the "/etc/passwd" file for the presence of a ".rhosts" file containing "+ +" (plus space plus).

5. Assure that your "/etc/fstab", "/etc/inetd.conf", and "/etc/exports" files have not been modified.

B. Take the following steps to secure your systems.

1. Save copies of the identified files to removable media and remove any password log files as found in (A.2) above.

2. Replace any modified binaries with copies from distribution media.

3. Remove the "+" entry from the "/etc/hosts.equiv" file and the "+ +" (plus space plus) entry from any ".rhosts" files.

4. Change ownership of the "/etc" directory to userid "root" if it is owned by "bin" (as distributed by Sun).

5. Change every password on the system and assure that the new passwords are robust using a package such as Crack or Cops (available via anonymous ftp from cert.org).

6. Inspect and restore any changes made to your "/etc/fstab", "/etc/exports", or "/etc/inetd.conf" files. If any modifications are found in these files, you will need to unmount file systems and restart daemons once the files have been restored. Alternatively the system could be rebooted.

7. Remove the "decode" alias from your global mail aliases file ("/etc/aliases" on Sun systems, "/usr/lib/aliases" on other UNIX systems).

CERT/CC Contact Information

Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:

CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.

CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends.

Using encryption

We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from

http://www.cert.org/CERT_PGP.key

If you prefer to use DES, please call the CERT hotline for more information.

Getting security information

CERT publications and other security information are available from our web site

http://www.cert.org/

* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.

NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement.

Copyright 1992 Carnegie Mellon University.

September 19,1997  Attached copyright statement