Protecting Firewalls

What is a Firewall?
A firewall is a tool that monitors communication to and from your computer. It sits between your computer and the rest of the network, and according to some criteria, it decides which communication to allow, and which communication to block. It may also use some other criteria to decide about which communication or communication request to report to you (either by adding the information to a log file that you may browse whenever you wish, or in an alert message on the screen), and what not to report.

What Is It Good For?
Identifying and blocking remote access Trojans. Perhaps the most common way to break into a home computer and gain control, is by using a remote access Trojan (RAT). (sometimes it is called "backdoor Trojan" or "backdoor program". Many people simply call it a "Trojan horse" although the term "Trojan horse" is much more generic). A Trojan horse, is a program that claims to do something really innocent, but in fact does something much less innocent. This goes to the days where the Greek soldiers succeeded to enter through the gates of Troy by building a big wooden horse, and giving it as a present to the king of Troy. The soldiers allowed the sculpture to enter through their gates, and then at night, when the soldiers were busy guarding against an outside attack, many Greek soldiers who were hiding inside the horse went out and attacked Troy from the inside. This story, which may or may not be true, is an example of something which looks like something innocent and is used for some less innocent purpose. The same thing happens in computers. You may sometimes get some program, via ICQ, or via Usenet, or via IRC, and believe this program to be something good, while in fact running it will do something less nice to your computer. Such programs are called Trojan horses. It is accepted to say that the difference between a Trojan horse and a virus, is that a virus has the ability to self-replicate and to distribute itself, while a Trojan horse lacks this ability. A special type of Trojan horses, is RATs (Remote Access Trojans, some say "remote admin Trojans"). These Trojans once executed in the victim's computer, start to listen to incoming communication from a remote matching program that the attacker uses. When they get instructions from the remote program, they act accordingly, and thus let the user of the remote program to execute commands on the victim's computer. To name a few famous RATs, the most common are Netbus, Back-Orifice, and SubSeven (which is also known as Backdoor-G). In order for the attacker to use this method, your computer must first be infected by a RAT.
Prevention of infections by RATs is no different than prevention of infection by viruses. Antivirus programs can identify and remove most of the more common RATs. Personal firewalls can identify and block remote communication efforts to the more common RATs and by thus blocking the attacker, and identifying the RAT.

Blocking/Identifying Other Types of Trojans and WQorms?
There are many other types of Trojan horses which may try to communicate with the outside from your computer. Whether they are e-mail worms trying to distribute themselves using their own SMTP engine, or they might be password stealers, or anything else. Many of them can be identified and blocked by a personal firewall.

Identifying/Blocking Spyware's/Adbots?
The term "spyware" is a slang which is not well defined. It is commonly used mainly for various adware (and adware is a program that is supported by presenting advertisements to the user), and that during their installation process, they install an independent program which we shall call "adbot". The adbot runs independently even if the hosting adware is not running, and it maintains the advertisements, downloads them from the remote server, and provides information to the remote server. The adbot is usually hidden. There are many companies that offer adbots, and advertisements services to adware. The information that the adbots deliver to their servers from the computer where the adbot is installed, is "how much time each advertisement is shown, which was the hosting adware, and whether the user clicked on the advertisement. This is important so that the advertisements server will be able to know how much money to get from each of the advertised companies, and how much from it to deliver to each of the adware maintainers. Some of the adbots also collect other information in order to better choose the advertisements to the users. The term "spyware" is more generic, but most of the spyware fall into this category. Many types of adbots can be identified and blocked by personal firewalls.

Blocking Advertisements?
Some of the better personal firewalls can be set to block communication with specific sites. This can be used in order to prevent downloading of advertisements in web pages, and thus to accelerate the download process of the web sites. This is not a very common use of a personal firewall, though.

Preventing Communication to Tracking Sites?
Some web pages contain references to tracking sites. e.g. instruct the web browser to download a small picture (sometimes invisible) from tracking sites. Sometimes, the pictures are visible and provide some statistics about the site. Those tracking sites will try to save a small text either as a small file in a special directory, or as a line in a special file (depending on what is your browser), and your browser will usually allow the saving site to read the text that it saved on your computer. This is called "web cookies" or sometimes simply "cookies". Cookies allow a web site to keep information that it saved some time when you entered it, to be read whenever you enter the site again. This allow the web site to customize itself for you, and to keep track on everything that you did on that site. It does not have to keep that information on your computer. All it has to save on your computer is a unique identifying number, and then it can keep in the server's side information regarding what has been done by the browser that used that cookie. Yet, by this method, a web site can get only information regarding your visits in it. Some sites such as "doubleclick" or "hitbox" can collect information from various affiliated sites, by putting a small reference in the affiliated pages to some picture on their servers. When you enter one of the affiliated web pages, your browser will communicate with the tracking site, and this will allow the tracking site to put or to read a cookie that identifies your computer uniquely, and it can also know what was the web page that referred to it, and any other information that the affiliated web site wanted to deliver to the tracking site. This way tracking sites can correlate information from many affiliated sites, to build information that for example will allow them to better customize the advertisements that are put on those sites when you browse them.
Some personal firewalls can be set to block communication to tracking sites. It is not a common use of a personal firewall, though, and a personal firewall is not the best tool for that, but if you already have one, this is yet another possible use of it.

Read More

Backdoors-Part2

Telnetd Backdoor

When a user telnets to the machine, inetd service listens on the port and receive the connection and then passes it to in.telnetd, that then runs login.  Some intruders knew the administrator was checking the login program for tampering, so they modified in.telnetd.  Within in.telnetd, it does several checks from the user for things like what kind of terminal the user was using.  Typically, the terminal setting might be Xterm or VT100. An intruder could backdoor it so that when the terminal was set to "letmein", it would spawn a shell without requiring any authentication. Intruders have backdoored some services so that any connection from a specific source port can spawn a shell.

Services Backdoor

Almost every network service has at one time been backdoored by an intruder.  Backdoored versions of finger, rsh, rexec, rlogin, ftp, even inetd, etc., have been floating around forever.  There are programs that are nothing more than a shell connected to a TCP port with maybe a backdoor
password to gain access.  These programs sometimes replace a service like uucp that never gets used or they get added to the inetd.conf file as a new service.  Administrators should be very wary of what services are running and analyze the original services by MD5 checksums.

Cronjob backdoor

Cronjob on Unix schedules when certain programs should be run.  An intruder could add a backdoor shell program to run between 1 AM and 2 AM.  So for 1 hour every night, the intruder could gain access.  Intruders have also looked at legitimate programs that typically run in cronjob and built
backdoors into those programs as well.

Library backdoors

Almost every UNIX system uses shared libraries.  The shared libraries are intended to reuse many of the same routines thus cutting down on the size of programs.  Some intruders have backdoored some of the routines like crypt.c and _crypt.c.  Programs like login.c would use the crypt() routine
and if a backdoor password was used it would spawn a shell.  Therefore, even if the administrator was checking the MD5 of the login program, it was still spawning a backdoor routine and many administrators were not checking the libraries as a possible source of backdoors.

One problem for many intruders was that some administrators started MD5 checksums of almost everything.  One method intruders used to get around that is to backdoor the open() and file access routines.  The backdoor routines were configured to read the original files, but execute the trojan
backdoors.  Therefore, when the MD5 checksum program was reading these files, the checksums always looked good.  But when the system ran the program, it executed the trojan version.  Even the trojan library itself, could be hidden from the MD5 checksums.   One way to an administrator could
get around this backdoor was to statically link the MD5 checksum checker and run on the system.  The statically linked program does not use the trojan shared libraries.

Read More

Backdoors-Part1

Since the early days of intruders breaking into computers, they have tried to develop techniques or backdoors that allow them to get back into the system.   In this paper, it will be focused on many of the common backdoors and possible ways to check for them.  Most of focus will be on Unix backdoors with some discussion on future Windows NT backdoors.  This will describe the complexity of the issues in trying to determine the methods that intruders use and the basis for administrators understanding on how they might be able to stop the intruders from getting back in.  When an administrator understands how difficult it would be to stop intruder once they are in, the appreciation of being proactive to block the intruder from ever getting in becomes better understood.  This is intended to cover many of the popular commonly used backdoors by beginner and advanced intruders.  This is not intended to cover every possible way to create a backdoor as the possibilities are limitless. The backdoor for most intruders provide two or three main functions:
Be able to get back into a machine even if the administrator tries to secure it, e.g., changing all the passwords. Be able to get back into the machine with the least amount of visibility.  Most backdoors provide a way to avoid being logged and many times the machine can appear to have no one online even while an intruder is using it. Be able to get back into the machine with the least amount of time.  Most intruders want to easily get back into the machine without having to do all the work of exploiting a hole to gain access.
            In some cases, if the intruder may think the administrator may detect any installed backdoor, they will resort to using the vulnerability repeatedly to get on a machine as the only backdoor.   Thus not touching anything that may tip off the administrator.   Therefore in some cases, the vulnerabilities on a machine remain the only unnoticed backdoor.

Password Cracking Backdoor

One of the first and oldest methods of intruders used to gain not only access to a Unix machine but backdoors was to run a password cracker.  This uncovers weak passworded accounts.  All these new accounts are now possible backdoors into a machine even if the system administrator locks out the
intruder's current account.  Many times, the intruder will look for unused accounts with easy passwords and change the password to something difficult.  When the administrator looked for all the weak passworded accounts, the accounts with modified passwords will not appear.  Thus the administrator will not be able to easily determine which accounts to lock out.

Rhosts + + Backdoor

On networked Unix machines, services like Rsh and Rlogin used a simple authentication method based on hostnames that appear in rhosts.  A user could easily configure which machines not to require a password to log into.  An intruder that gained access to someone's rhosts file could put a
"+ +" in the file and that would allow anyone from anywhere to log into that account without a password.  Many intruders use this method especially when NFS is exporting home directories to the world.   These accounts become backdoors for intruders to get back into the system.  Many intruders
prefer using Rsh over Rlogin because it is many times lacking any logging capability.  Many administrators check for "+ +" therefore an intruder may actually put in a hostname and username from another compromised account on the network, making it less obvious to spot.

Checksum and Timestamp Backdoors

Early on, many intruders replaced binaries with their own trojan versions.  Many system administrators relied on time-stamping and the system checksum programs, e.g., Unix's sum program, to try to determine when a binary file has been modified.  Intruders have developed technology that will recreate  the same time-stamp for the trojan file as the original file.  This is
accomplished by setting the system clock time back to the original file's time and then adjusting the trojan file's time to the system clock.  Once the binary trojan file has the exact same time as the original, the system clock is reset to the current time.  The sum program relies on a CRC
checksum and is easily spoofed.  Intruders have developed programs that would modify the trojan binary to have the necessary original checksum, thus fooling the administrators.  MD5 checksums is the recommended choice to use today by most vendors.  MD5 is based on an algorithm that no one has yet to date proven can be spoofed.

Login Backdoor

On Unix, the login program is the software that usually does the password authentication when someone telnets to the machine.  Intruders grabbed the source code to login.c and modified it that when login compared the user's password with the stored password, it would first check for a backdoor password. If the user typed in the backdoor password, it would allow you to log in regardless of what the administrator sets the passwords to.  Thus this allowed the intruder to log into any account, even root.   The password backdoor would spawn access before the user actually logged in and appeared in utmp and wtmp.  Therefore an intruder could be logged in and have shell access without it appearing anyone is on that machine as that account.  Administrators started noticing these backdoors especially if they did a "strings" command to find what text was in the login program.
 Many times the backdoor password would show up. The intruders then encrypted or hid the backdoor password better so it would not appear by just doing strings.  Many of the administrators can detect these backdoors with MD5 checksums.

Read More