From: Eoghan Casey (ecocorpus-delicti.com)
Date: Thu Oct 16 2003 - 10:45:46 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This sounds like SucKIT (http://hysteria.sk/sd/f/suckit/) or a variant.
This has been in general use since last year. It injects itself
directly into kernel memory rather than using kernel loadable modules.

See the README (http://hysteria.sk/sd/f/suckit/readme):

Q: How I can make suckit to run automatically each reboot of machine ?
   A: The generic way (as the install script does) is to
      rename /sbin/init to /sbin/init<hidesuffix>, and place sk binary
      instead of /sbin/init, so suckit will get resident imediatelly
      after boot. However, when it will get resident, all of such changes
      will be stealthed ;) If you can't fiddle with /sbin/init, you
      still can place binary to somewhere into
/etc/rc.d/rc3.d/S##<hidesuffix>
      or such.

Eoghan Casey

On Thursday, October 16, 2003, at 03:38 AM, Jonas Frey (Probe
Networks) wrote:

> Hello,
>
> we've just had a customer machine blasing some 50mbit into our lines
> with pretty high pps counts. After a short analysis we found out the
> init got replaced/backdoored and the original init was moved to
> /sbin/telinit. However the filesize on both files was the same. This is
> probably due to a lkm the rootkit uses to hide its existence.
> Chkrootkit did NOT find this rootkit. However it pointed us the right
> way saying the system had hidden processes running.
> After replacing init with a good version and updating the kernel we
> rebooted the box and found the hacked init as well as other programs of
> the rootkit beeing located in /etc/.MG/ (this directory was hidden
> before). Apparently this is a rootkit with a ddosnet touch.
> I've put up the files for further analysis at:
> http://81.2.144.1/rootkit/
>
>
> --
> Mit freundlichen Grüßen / With kind regards,
> Jonas Frey
>
>
> -----------------------------------------------------------------------
> ----
> FREE Whitepaper: Better Management for Network Security
>
> Looking for a better way to manage your IP security?
> Learn how Solsoft can help you:
> - Ensure robust IP security through policy-based management
> - Make firewall, VPN, and NAT rules interoperable across heterogeneous
> networks
> - Quickly respond to network events from a central console
>
> Download our FREE whitepaper at:
> http://www.securityfocus.com/sponsor/Solsoft_incidents_031015
> -----------------------------------------------------------------------
> -----
>

---------------------------------------------------------------------------
FREE Whitepaper: Better Management for Network Security

Looking for a better way to manage your IP security?
Learn how Solsoft can help you:
- Ensure robust IP security through policy-based management
- Make firewall, VPN, and NAT rules interoperable across heterogeneous
networks
- Quickly respond to network events from a central console

Download our FREE whitepaper at:
http://www.securityfocus.com/sponsor/Solsoft_incidents_031015
----------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]