| Analysis of the T0rn rootkit | ||||||||||||||||||||
| Analysis
of the T0rn rootkit
Toby Miller, a frequent contributer to GIAC and an author for New Riders has submitted a paper after analyzing the T0rn rootkit. Purpose The purpose of this paper is to inform the IDS community of signatures related to the t0rn rootkit. This paper will not serve as a how-to guide to the t0rn rootkit; rather, it is designed to identify binaries and ports that t0rn uses. This paper will also provide md5sums of binaries and analysis on how to detect t0rn. T0rn Rootkit The t0rn rootkit is designed for speed. By that I mean t0rn was designed to install quickly on Linux machines. T0rn can do this because it takes very little skill to install and run t0rn. All of the binaries that the attacker would need comes pre-compiled and the installation process is as simple as ./t0rn. T0rn comes standard (sounds like a car package : ) with a log cleaner called t0rnsb, a sniffer named t0rns and a log parser called t0rnp. Red Hat 6.1 Details T0rn has many details that need to be discussed and analyzed in order to detect it in the wild. The computer that was used in this analysis is a RH 6.1 box with no applied patches, the inetd.conf file had been secured, the password has 6 characters and was connected to an internal network. In order to analyze t0rn I had to complete some pre-installation t0rn data collection that included documenting the sizes and creation dates of both the RH binaries and the pre-compiled t0rn binaries. First, we want to take a look at the Red Hat 6.1 binaries (before t0rn
is installed) their date, size and timestamps. Figure 1 is a list of RH
6.1 binaries and their characteristics.
Figure 1. RH 6.1 Binaries and properties
Figure 2. RH 6.1 md5sums(before t0rn) T0rn Details Now that we have analyzed the Red Hat binaries, lets look at the t0rn
binaries before installation. After unpacking t0rn I made a list (Figure
3) of the t0rn binaries and their properties (did not get the year but
that’s not important).
Figure 3. t0rn binaries and properties (before installation).
Figure 4. t0rn md5sums. When t0rn is installed there are a couple of things that happen. First,l it creates its own directory /usr/src/.puta. There you will find all the files (sniffer, log cleaner, etc.) needed to run t0rn. Default t0rn is not really hard to detect. The first command I ran after installing the rootkit was ps –ef. The output of ps –ef was totally different then running the binary /bin/ps. The next step I took was to check the file(s) size and timestamp. T0rn is tricky in this department, the trojaned binaries keep the same exact timestamp as the good binaries. What stands out like an eye sore is the file size. An example of this is /bin/ps. Normally, if you were to run ls-la on /bin/ps (Red Hat 6.1) you would have the following output: -r-xr-xr-x 1 root root 61244 Sept 26 1999 If t0rn is installed the user would see the following: -r-xr-xr-x 1 root root 31336 Sept 26 1999Notice the difference in the file size. Also, just as a side note that the file size is one byte off from being eleet. This holds true for all t0rn binaries. The one binary that I found the most interesting was netstat. Why? Well, t0rns version of netstate causes a segmentation fault. T0rn can be detected by using lsof. (Yes. The guys who wrote this rootkit
forgot to change an important tool.) Running lsof | grep LISTEN will show
port 47017(bolded) is the listening state (Figure 5).
Figure 5. lsof | grep LISTEN output
Figure 6. Output of lsof Finally, I also found t0rn by running nmap and scanning for destination ports 45k –48k. The nmap output would look like this: Starting nmap V. 2.54BETA7 ( www.insecure.org/nmap/ ) Interesting ports on (192.168.1.3): (The 4000 ports scanned but not shown below are in state: closed) Port State Service 47017/tcp open unknown TCP Sequence Prediction: Class=random positive increments Difficulty=3980866 (Good luck!) Remote operating system guess: Linux 2.1.122 - 2.2.16 Nmap run completed -- 1 IP address (1 host up) scanned in 5 secondsRecommendations Detecting t0rn or any other rootkit requires planning when installing the operating systems. The best way to prevent these kinds of attacks is by using programs like Tripwire, maintaining good backups and keeping up with the latest patches. One other suggestion is to run md5sum on binaries such as /bin/ps, /bin/ls and many others and save the results to a floppy that will be stored in a secure place. Conclusions T0rn is a very sneaky toolkit and can be hard to detect if an administrator does not know what to look for. If a person follows the recommendations stated above he or she could save themselves a lot of heartache and time trying to look for programs like this. |
||||||||||||||||||||
|
|
||||||||||||||||||||