<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1528" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Arial; MARGIN-LEFT: 2px">
<DIV>Thanks for that, it's a little too late to get the netstat dump as the
server was turned off before I could get to it. So I now have it in the
shop. I'm going to replace the drives with new ones and rebuild the system
to get it back to the client. Then I'll put on my Sherlock Holmes kit and
starting looking for some evidence.</DIV>
<DIV> </DIV>
<DIV>Thanks</DIV>
<DIV><BR><BR>>>> mike.benjamin@clarinet.com.au 12:11:46 pm 20/03/2006
>>><BR><BR>Hi Jon,<BR><BR>Because of the way NAT/NAPT works, the port
mapping on the NAT should<BR>reference<BR>not only the port number to hold open,
but also the NAT mapping for the<BR>internal <BR>address it should be held open
for.<BR><BR>Therefore an attacker trying to come in on an internally opened
port<BR>should only <BR>be able to reach the infected machine, and a good
firewall may apply<BR>other rules <BR>to prevent this, as the internal machine
should be contacting the<BR>attacking machine <BR>in order for the firewall to
see it as a "legitimate" session. A decent<BR>firewall<BR>will assume that the
user has opened a SSH 22 session to a trusted host,<BR>and thereby<BR>will allow
traffic in from that host, as opposed to letting the whole<BR>world into
that<BR>port.<BR><BR>This is not impossible, as the attacker may have access to
a compromised<BR>Unix box <BR>out there on the net for example that his trojan
contacts to hold the<BR>NAT mapping open, <BR>but it is a big glaring arrow as
to where the attacks come from if<BR>anyone examines <BR>the trojan
traffic.<BR><BR>Now if the internal PC has a trojan running something like "nc"
(netcat)<BR>which <BR>then forwards to an arbitrary address the attacker can
specify on your<BR>internal <BR>network, then this is entirely possible, with
the PC acting as an<BR>attacking proxy<BR>if you like, and holding the NAT port
open.<BR><BR>So I would say it's possible. Is it easy to do? No. Would the
attacker<BR>have a pretty<BR>advanced understanding by creating the trojan to do
this? Definately. <BR><BR>I doubt you were attacked in this way.<BR><BR>One of
the big things when doing forensics on a successful attack, is to<BR>take the
machine<BR>off the network ASAP, but not restart it. There can be a lot of
good<BR>information gathered<BR>about the attack if it's still in a compromised
state, but no longer in<BR>the attackers control.<BR><BR>Before taking it off
though, if possible, get a netstat dump of active<BR>(or recently active)
<BR>connections, tcpdump, and lsof output, then take it off the
network.<BR><BR>If you reboot the machine, the memory state is lost, and there
can be a<BR>lot of good stuff there.<BR><BR>Mike.<BR><BR><BR>-----Original
Message-----<BR>From: plug-bounces@plug.org.au [<A
href="mailto:plug-bounces@plug.org.au]">mailto:plug-bounces@plug.org.au]</A>
On<BR>Behalf Of Jon Miller<BR>Sent: Monday, March 20, 2006 01:45 AM<BR>To:
plug@plug.org.au<BR>Subject: [plug] hacked system<BR><BR>Looking for a
procedure/suggesstions to determine how and when a hacked<BR>system was
compromised. I'm currently rebuilding another system and<BR>would like to
put in preventive measures to insure this does not happen<BR>again. I have
a feeling that one of the packages was outdated, but not<BR>sure.<BR>Since the
only apps the client uses is ssh and mail these should be the<BR>only ports
open. <BR>Just curious is it possbile for an infected computer to make
available<BR>an open open port from a clients desktop? By this I mean if a
infected<BR>PC is sending information out a socket will open on the firewall, is
it<BR>possible for this socket to be compromised and leave open a
port?<BR><BR>Thanks<BR><BR><BR>Jon<BR>I will tighten the ssh port to only allow
ssh access from certain ip<BR>addresses and only as a user with an
account.<BR>_______________________________________________<BR>PLUG discussion
list: plug@plug.org.au<BR><A
href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A><BR>Committee
e-mail:
committee@plug.linux.org.au<BR>_______________________________________________<BR>PLUG
discussion list: plug@plug.org.au<BR><A
href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A><BR>Committee
e-mail: committee@plug.linux.org.au<BR></DIV></BODY></HTML>