Four weeks ago yesterday, Kathleen Lamb entered my office with a sheaf of email printouts saying: "baby_doe is one of your machines, right?". I have responsibilities in the mathematics and the mining departments, and baby_doe was one of Robin Murphy's machines, an obscure Sun in the robotics lab in the Brown Building. It serves passwords to 2 machines and files to 6, has anonymous ftp, and is logged into directly by Dr. Murphy's students.
These emails were from various sites around the world that were complaining that some machine of theirs had been probed by baby_doe the previous night. After some time-zone conversions, their logs suggested that things had been going on through the night. Their logs would have several probes in rapid succession, suggesting an automated program at work.
I logged on to baby_doe and began poking around.
No one appeared to be logged on, and no unusual processes appeared to be running. The "last" log showed the usual activity, and a couple of ftp entries from victor.brad.ac.uk.
Having in hand several names of sites which had been probed, I initiated a find that spawned greps for one of those strings. Paydirt: in an out-of-the-way directory, /usr/include/rpc, there was a subdirectory named ".. ", and relative to the file scan/bug was reported by grep to contain the name of the site. The probes had indeed come from baby_doe, and the nest of the attacker had been uncovered.
I went over to the robotics lab, pulled baby_doe off of the network and rebooted in single user mode. Somewhat at leisure, I could now examine the files that had been left behind.
Half of the files consisted of what I have since learned is called a "Root Kit" -- a collection of hacked source code to various important system files and shell scripts to compile and install them, for use by someone who has broken root on a machine of a given operating system, in this case SunOS 4. Versions for SunOS 5 and Linux are also in wide circulation. There were hacked versions of login, netstat, ps and ifconfig. Netstat and ps were hacked to not report the processes and network connections made by the attacker. ifconfig was modified to not announce when the network interface had been placed into so-called "promiscuous mode", where it can listen to all packets in the vicinity. And login? It had both a backdoor, enabling a particular password to gain one root access, and was recording all username/password entries made.
These files were restored from elsewhere, and checked to be un-hacked. The password file was cleansed, and users of the system required to change their passwords.
The other half of the files consisted of the attacker's tools for probing other systems. There was a program to listen to all packets on the network in Brown. And there was "piss = ph0bos' internet security scanner".
This latter initiated probes for information and weaknesses in SMTP, FTP, RPC, POP, HTTPD. And there was a list of 1300 sites, and a log file telling of its night (it ran for perhaps 10 hours) of adventure, with another list of 3000 sites waiting in the wings.
How did the perpetrators break root? This we are uncertain about. The machine in question had a stock installation of SunOS 4.1.3, running such entry points as sendmail, anonymous ftp, nfs and yp. A graduate student had recently moved a disk over and rebuilt the exports file, erroneously giving world access to mount that disk -- this would give fairly easy access to baby-doe as a user. But alas, it turns out CSM is filtering NSF mounts at the gateway, so it was another way. Once in, there are a number of cert advisories that point to ways to break root.
Who were the perpetrators? The "last" log had been cleansed of the logins by the intruder, but he neglected to cleanse his ftp entries, used to bring over his tools, and perhaps pick up some of his results. They pointed to victor.brad.ac.uk, a machine in the engineering department of the University of Bradford in Yorkshire, England. sendmail had dumped core during the hack, and this pointed to a throw-away account on cyberspace.org, an "electronic town hall" in Ann Arbor, MI. But once there, I found that ph0bos, the purported author of piss, also had an account there, and was occasionally on, evidently primarily to do a little mail, from a variety of sites, mostly academic sites in England, including victor.brad.ac.uk. The Computing Center has not been accorded much cooperation to date from sites that might be able to give information as to the identity of the attacked (and which might have themselves been compromised).
Tools that might make breaking in harder, or early notification or tracing the attacker easier: