Hackers Beware

The get home info option retrieves the current user’s personal information. This only works if the victim entered any of his or her personal information.

The server options window allows remote configuration of the server. It allows changes to the listening port—changing or removing the password, restarting the server, removing or closing the server—and it updates the server file from a local file or a web site.

IP notify enables the attacker to remotely reconfigure the IP notification options.

Key/Message Features

The keyboard feature enables the attacker to do the following: see what the victim is currently typing at the keyboard, send keystrokes to the victim’s system, retrieve the victim’s keystrokes while offline, and disable the victim’s keyboard, as shown in Figure 15.8.

Figure 15.8. Keyboard window that enables the attacker to control the victim’s key strokes.

If for some reason the attacker wants to chat with the victim, the attacker can use the chat utility. This feature opens a chat window on both the client and the server that enables chat functionality.

The matrix takes over the victim’s screen and basically establishes a oneway (attacker to victim) chat session.

With the msg manager, the attacker can create different types of windows to appear on the victim’s system. The status bar at the bottom of the SubSeven window tells the attacker which button the victim selected from the crafted window.

Spy enables the attacker to see the victim’s ICQ, AOL Instant Messenger, MSN Messenger, and Yahoo Messenger communications on the Internet.

As the name implies, ICQ takeover lists the existing ICQ sessions and enables the attacker to take them over.

Advanced Features

Ftp/http establishes a listening ftp server on the victim, as shown in Figure 15.9. The attacker can configure the ftp server’s listening port, password, and maximum number of users.

Figure 15.9. Enables the attacker to create a connection through ftp or http to the victim.

Find files enable the attacker to use a web browser to view the victim’s files by using the URL ftp://password@ip_address:port.

The password’s function checks for cached, recorded, or received passwords on the victim’s system as well as retrieve dial-up, ICQ, and AOL Instant Messenger passwords.

Regedit gives the attacker full control of the victim’s registry. The attacker can add, delete, or modify any registry key.

The app redirect and the port redirect options enable the attacker to execute applications and redirect ports on the victim’s system. The output of the applications appear on the attacker’s window.

Miscellaneous Features

The file manager option gives the attacker full control of the victim’s magnetic media. The attacker can upload, download, delete, edit, view, execute, and gather information on any file on the victim’s system.

The next two options, window manager and process manager, show all active windows and running processes, respectively, on the victim’s system. From here, the attacker can stop, hide, or upgrade the priority of any window or process on the victim’s system.

Fun Manager Features

The fun manager gives the attacker three very interesting options, as shown in Figure 15.10. The first option is screen preview, which can be configured to update every few seconds and enables the attacker’s mouse click to execute on the victim’s system. The next option is a full screen capture. This does not allow for continual update or mouse execution, but it gives the attacker a full size picture of the victim’s screen. Finally, if the victim has a video camera attached to the system, the attacker can retrieve live video (which uses a different pre-configured port).

Figure 15.10. The fun manager, which enables the attacker to play some tricks on the victim.

Flip screen flips the victim’s screen vertically or horizontally or both.

The print option will print attacker-specified text to the victim’s printer, and the browser option will start the victim’s default web browser to an attacker-specified URL. As the names imply, the resolution option provides the victim’s possible screen resolutions, and the win colors enables the attacker to change the default window colors on the victim’s system.

Extra Fun Features

The extra fun menu begins with the screen save option. If the victim has the scrolling marquee screen saver installed, this option enables the attacker to reconfigure the screen saver and execute it.

With restart win, the attacker can shutdown windows, log off the current user, shutdown the system, or reboot the system.

The mouse option enables the attacker to really confuse and irritate the victim. The mouse option is shown in Figure 15.11. Everything from hiding the mouse cursor to switching the mouse buttons can be performed with this option.

Figure 15.11. The mouse option gives the attacker full control of the mouse.

The sound option retrieves the victim’s current sound settings and provides a limited configuration capability. However, if the victim has a microphone attacked to the system, the attacker can record and retrieve sound files of the victim.

As the name implies, the time/date option reports the victim’s current time and date settings. It also provides the capability to change the time and date settings on the victim’s system.

The extra option toggles on or off the desktop, Start button, taskbar, CDROM, speaker, and monitor. It also disables Ctrl+Alt+Del, Scroll Lock, Caps Lock, and Num Lock.

Local Options Features

The local options enable the attacker to configure the quality of screen captures and video captures from the remote system. It enables the attacker to redefine the default folder where the screen captures and any downloaded files will be stored. It can also redefine other appearance changes to the client GUI.

As you can see, SubSeven has a large number of features ranging from those that are very useful to those that are pure fun for the attacker. In

most cases, the attacker has just as much control (if not more) over the victim’s computer than the victim does.

Program Protocol Analysis

SubSeven accomplishes network communications by using TCP/IP. After startup, the server notifies the client by sending an email that the following traffic was generated (TCPDump):

victim.1025 > redmaze.home.smtp: S 44331:44331(0) win 8192 <mss

1460,nop,nop,sackOK> (DF)

redmaze.home.smtp > victim.1025: S 30637657:30637657(0) ack 44332 win 32120 <mss

1460,nop,nop,sackOK> (DF)

victim.1025 > redmaze.home.smtp: . 1:1(0) ack 1 win 8760 (DF)

As you can see, SubSeven uses the victim’s system to directly connect to the configured mail server. It does not use the victim’s email application; therefore, it will not leave traces of notification on the victim’s system.

However, if the victim’s email clients download their mail from a central mail server, the victim can use the SubSeven email notification as a possible intrusion detection fingerprint. Your mail server should be the only machine establishing a connection to your SMTP port 25.

Next, we see the attacker connecting to the victim to gain access (TCPDump):

badguy.1269 > victim.asp: S 98382:98382(0) win 8192 <mss 1460> (DF)

victim.asp > badguy.1269: S 1895687:1895687(0) ack 98383 win 8760 <mss

1460> (DF)

badguy.1269 > victim.asp: . 1:1(0) ack 1 win 8760 (DF)

As you can see, it establishes a connection using TCP/IP. The majority of the communication traffic is cryptic, but passwords and answers to attacker requests are sent in plain text (the following is the snort output).

192.168.0.2:1275 -> 192.168.0.15:27374 TCP TTL:128 TOS:0x0

42 4F 4F 54 4C 4F 47 2E 54 58 54 0D 0A 53 59 53 BOOTLOG.TXT..SYS

54 45 4D 2E 31 53 54 0D 0A 49 4F 2E 53 59 53 0D TEM.1ST..IO.SYS.

0A 3C 4D 79 20 44 6F 63 75 6D 65 6E 74 73 3E 0D .<My Documents>.

0A 3C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 3E .<Program Files>

0D 0A 53 43 41 4E 44 49 53 4B 2E 4C 4F 47 0D 0A

..SCANDISK.LOG..

Signature of the Attack

SubSeven leaves several clues for a watchful system administrator to find. First, if the attacker configures the server to notify him in some manner, the system administrator will see the infected system connecting to the Internet. If the network has a central mail server and does not support ICQ or IRC services, traffic from machines on the network to these ports should be an immediate alert of illegitimate network communication. Next, the server start-up configuration places several commands on the infected system. The program also makes several additions to the registry in HKEY_LOCAL_MACHINE. Finally, the program adds several new files including the following in the Windows directory:

•aatrbdxugj.exe, Size: 382 371

•umapwsoap.exe, Size: 10 769

How to Protect Against It

The first, and possibly the most preventive measure, is a statefull firewall. With rules to allow only inbound traffic initiated by the legitimate network, the attacker will not be able to establish a connection to a targeted system.

Anti-viral software companies regularly publish new virus definitions. To find compromised systems or infected files, establish a procedure for downloading and updating existing anti-viral software weekly (new versions of SubSeven exist every couple of weeks that current virus definitions will not identify).

If possible, acquire a tool, such as RegSnap, that enables the system administrator to take a system “snap shot” prior to installing the system on the network. Then, regularly, take new snap shots and compare them to the initial snap shot to find illegitimate additions or modifications to the registry. Some of these programs also include changes to system files, which may indicate illegitimate modifications.

The operating system itself can tell whether something is amiss. Running netstat –na will display all listening ports and established connections. The following netstat output line gives SubSeven away:

Note: The listening port is configurable by the attacker, but it will still be listening at IP 0.0.0.0. Another place to check is the process list. The attacker can configure the process name, but the system administrator should be familiar with legitimate processes and be able to identify the illegitimate process. “Knowing thy system” is a key requirement to having a secure network.

Finally, monitor network traffic to ensure legitimate network communications. If specific systems on the network, other than actual mail servers, are connecting to remote mail servers, the system may be infected. The same procedure applies to ICQ and IRC. These services are used by SubSeven to notify the attacker of system startup and IP address changes.

Back Orifice

Back Orifice is similar to the other backdoor programs mentioned, however it is covered here to complete this section. Because most people are more familiar with this program, we do not cover it in as much detail. Also, because most of these programs have similar features, and we’ve covered two other programs in detail, only an overview of the key features of Back Orifice are covered in this section. Back Orifice probably accounts for the highest number of infestations on Microsoft computers. You can tell from the name that it is a run on Microsoft’s Back Office applications. Back Orifice is written by the Cult of the Dead Cow (CDC) and can be found at http://www.bo2k.com. This program is so powerful that as CDC states, “On a local LAN or across the Internet, BO gives its user more control of the remote Windows machine than the person at the keyboard of the remote machine has.” And if you have ever played with Back Orifice, you know that statement is true.

Back Orifice Features

The following are some of the key features of the program:

•System control L:

o Log keystrokes

o Creates dialog boxes with the text of your choice o Can lockup or reboot the machine

oGets detailed system information

•Gathering passwords cached by the user, including:

oThe screensaver password

oDialup passwords

oNetwork access passwords

•For NT:

oDumps hashed passwords from the SAM database (for

cracking in L0phtCrack)

•File system control:

o Copies, renames, deletes, views, and searches files and directories

o File compression

oMounts network drives

oAdds or removes shares

•Process control:

oLists, kills, and spawns processes

•Registry control:

oLists, creates, deletes, and sets keys and values in the registry

•Network control:

oViews all accessible network resources

•Multimedia control:

oStreaming video of a screen

oCaptures input from an attached camera

•Packet redirection:

oRedirects any incoming TCP or UDP port to any other address and port

•Application redirection:

oSpawns console applications on any TCP port, enabling control of DOS applications through a telnet session

•HTTP file server:

oDownloads files on any port using a browser

Back Orifice Plug-ins

As if Back Orifice does not have enough features, it also has a large number of plug-ins. Plug-ins are additional features you can add to the program. Plug-ins also enable back orifice to interface with other software tools for even more power. The following are some of the more popular plug-ins available:

•Encryption Plug-ins:

o Serpent (256-bit crypto) o IDEA (128-bit crypto)

o RC6 (384-bit crypto) o Blowfish

oCAST (256-bit crypto)

•Communication Plug-ins:

oSTCPIO—Encrypted flow control system to make BO2K TCP traffic virtually impossible to detect

•Server Enhancement:

oRattler & BT2K—Emails BO server address upon activation

oBored—Turns BO server into a dumb terminal

•Client Enhancement:

oBOTOOL—Graphical file viewer and registry editor

•Others:

oBO Peep—Supports streaming video of the server’s screen and accessibility of remote keyboard and mouse

o BOSOCK32

o Reliable ICMP tunneling for BO2K Traffic o BOSCRIPT

o Scripting language for both client and server automation

Wrappers

One of the things someone might ask is, “These programs are great and have a lot of features, but how does an attacker actually create a Trojan program?” For example, an attacker has an overt program that everyone would love, but how would he modify it to insert Back Orifice into the program, so whenever the users run the overt program, Back Orifice automatically gets installed? Well, Back Orifice has several wrapper programs that an attacker can run, which combines an overt and covert program together. So now an attacker can use one of these wrapper programs to wrap a program around anyone one of these backdoor programs that exist for Windows operating systems. Several of these programs can be found at http://packetstorm.securify.com, and the following are three of these type of wrapper programs:

•SilkRope 2000— Easy-to-use GUI

•SaranWrap— Command-line interface

•EliteWrap— Command-line interface

Just to give you an idea of how easy these program are to run, Figure 15.12 shows the main screen for SilkRope 2000.

Figure 15.12. Main screen for SilkRope 2000.