Subject: [NEXTEL-1] RE: Honeypot article

From: Marcel <[email-masked]>
Date: Wed, 15 Jan 2003 15:15:30 -0500

------- Original Message --------
From: Keith Bruss <[email-masked]>
Subject: RE: Honeypot article

This attacker didn't do much to cover his tracks.  It looks like he just
created an account in the group root.  He never made any attempts to remove
traces that he was there.  Later he connected back to the box via SSH with
the 'local' account he just created, posing a problem to the admin of the
box because all the data was encrypted.  A simple 'unset HISTFILE' would
have cleared his history and the admin would have had less information to
find out what the attacker did.  He should also clean the history file for
the user 'root', as this shows the attacker adding the user local in the
group uid0 (root).  This in itself says a lot about the attacker.  The
attacker did a lot of things that could have been hidden better such as
creating an account on the box, or making your home directory /home/local,
or running a process called inetd, or upgrading openssh.  Any of these would
make most IDS go crazy or most aware admins should have noticed changes like
this.  

Looks like a packet monkey adding boxes to his kaiten (or something similar)
ddosnet if you ask me.  -=P

My $0.02

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

---

From: Rick Parrish <[email-masked]>
Date: Wed, 15 Jan 2003 21:07:21 -0600

Marcel wrote:

>traces that he was there.  
>
The box was aet for logging activity to another uncompromised box. 
Unless the attacker could gain access to this second machine, there 
isn't much to do. Using root access to disable logging could have 
triggered an IDS alarm condition. Also, the time to seriously "erases 
tracks" would be after the attacker had finished the little IRC BOT 
party but the author decided to pull the plug before that happened.

-rick