Information Networking Security and Assurance Lab National Chung Cheng University Investigating Unix System

Information Networking Security and Assurance Lab National Chung Cheng University 2 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 3 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 4 4W + 1H Who What When Where How

Information Networking Security and Assurance Lab National Chung Cheng University 5 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 6 Common Directory /var/log/ /usr/adm/ /var/adm/ On the log server Depend on what flavors of Unix you use!!

Information Networking Security and Assurance Lab National Chung Cheng University 7 System log(1/3) Captures events from programs and subsystems within Unix Controlled by /etc/syslog.conf syslogd Can log messages across a network

Information Networking Security and Assurance Lab National Chung Cheng University 8 System log(2/3) The facility Type: auth (security), authpriv, cron, daemon, kern, lpr, mail, mark, news, syslog, user, uucp, local0-7 The priority Level: debug, info, notice, warning, err, crit, alert, emerg The action /etc/syslog.conf

Information Networking Security and Assurance Lab National Chung Cheng University 9 System log(3/3) Time/Date HostName Program and PID Operation IP Address If the action field contain the string ” the use of a remote syslog server

Information Networking Security and Assurance Lab National Chung Cheng University 10 TCP Wrapper A host-base access control service (/etc/inetd.conf) /usr/sbin/tcpd 檢查 /etc/hosts.allow 有無符合的 rules 檢查 /etc/hosts.deny 有無符合的 rules 連線請求 Allow Yes No Yes Deny No Allow

Information Networking Security and Assurance Lab National Chung Cheng University 11 Other Network Logs Example  xferlog Time/DateThe number of seconds that the transfer took The remote host The number of bytes The transferred file The type of file transfer The direction of transfer The access mode

Information Networking Security and Assurance Lab National Chung Cheng University 12 su Command Logs /var/log/auth.log Successful for su Non-successful for su

Information Networking Security and Assurance Lab National Chung Cheng University 13 Logged-on User Logs utmp (who, w), wtmp (last)  Binary file Many common hacker programs, such as zap, can selectively remove entries from these files /var/log/wtmp /var/run/utmp

Information Networking Security and Assurance Lab National Chung Cheng University 14 History file Log all command, along with their command-line options In user’s home directory History file

Information Networking Security and Assurance Lab National Chung Cheng University 15 Some evidence you must care Link your.bash_history to /dev/null Some thing you must care!!

Information Networking Security and Assurance Lab National Chung Cheng University 16 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 17 grep The item you want to search The location Search the binary file Search the binary file with – a option -r option: recursive mode

Information Networking Security and Assurance Lab National Chung Cheng University 18 grep You can search the entire raw device!!

Information Networking Security and Assurance Lab National Chung Cheng University 19 find Search from the root directory! The regular Expression for “…” Obtaining something detail can man find

Information Networking Security and Assurance Lab National Chung Cheng University 20 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 21 atime, mtime, ctime Example for capture the specific atime!!

Information Networking Security and Assurance Lab National Chung Cheng University 22 SUID, SGID Allow programs operate with another (higher) privileges Search the suid file!!

Information Networking Security and Assurance Lab National Chung Cheng University 23 Some important file!! Configuration file  /etc/hosts.allow  /etc/hosts.deny  … Startup file  /var/spool/cron/  /usr/spool/cron/  /etc/rc.d  /etc/rc[0-6].d /tmp/  Something suspicious

Information Networking Security and Assurance Lab National Chung Cheng University 24 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 25 /etc/passwd, /etc/group UID GID The Home directory The login shell /etc/group

Information Networking Security and Assurance Lab National Chung Cheng University 26 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 27 Something example Use the ps and netstat command to detect the rouge process!!

Information Networking Security and Assurance Lab National Chung Cheng University 28 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 29 Your open services! When conduct your investigation of the Unix system, your will need to examine all network services as potential access points

Information Networking Security and Assurance Lab National Chung Cheng University 30 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 31 Something you must care! /etc/hosts.equiv /$HOME/.rhosts Sniffer  dsniff arpredirect Trust Relationship!! HostA HostB

Information Networking Security and Assurance Lab National Chung Cheng University 32 Outline Preface Review all pertinent logs Perform keyword searches Review relevant files Identify unauthorized user accounts or groups Identify rogue processes Check for unauthorized access points Analyze trust relationships Check for kernel module rootkits

Information Networking Security and Assurance Lab National Chung Cheng University 33 rootkits, LKMs What different  Modified or replaced? How to detect  External  Internal

Information Networking Security and Assurance Lab National Chung Cheng University 34 Some tool chkrootkit KSTAT chkrootkit KSTAT