ashraya writes "My father (not too computer literate) has a desktop and a laptop both running Windows in his network back in Hyderabad, India. I set up a Linksys router for him to use with his broadband service. For some reason, he reset the config on the Linksys, and connected it up without wireless security, and also with the default admin password for some time. As you would expect, both of the Windows computers got 'slow,' and the desktop stopped connecting to the internet completely for some reason. As I logged in remotely to 'fix' things, I noticed on the Linksys' log that the laptop was making seemingly random connections to high-numbered ports on various IPs. I did an nslookup on the IPs to see that they were all either in Canada or US, with Comcast and other ISP addresses. Is that a sign that the computers were in a botnet? Are the other hosts part of the botnet too? (I have since rebuilt the Windows hosts, and these connections are not happening now. I have also secured the Linksys.)"
You can also use a host with two interfaces and set up bridging or routing with NAT. If you are running custom firmware you can do this straight on the router itself.
Agreed, I do it from my Linux router which I assume is not owned.
It is nevertheless better to reserve a machine on your network for just this usage. Nothing installed on it but tcpdump and similar tools. You should even disconnect than machine from the network when not in use. Again, that's what security expert firms do.
The important point is to be confident than what you are looking at is not coming from something that is already owned. Many root kits modify netstat, tcpdump and the like...;-)
It is nevertheless better to reserve a machine on your network for just this usage. Nothing installed on it but tcpdump and similar tools.
Or boot from a Linux Live CD.
Also, some switches support spanning ports, which will allow you to sniff the traffic on another port. Your typical home network dumb switch probably doesn't support this, but if you have temporary access to a higher end switch, it makes such tasks much easier. You can pick up older switches that support this fairly cheap on Ebay, although you probably won't want to spend the money for a one-time usage.
Indeed. I don't know why security companies don't aggressively push this kind of product for home use- sounds like a win-win for them: sell the consumer an expensive physical box/and/ charge them for monthly firmware updates. Special bonus: An external box would actually/work/ (and with the aid of a USB connection, it could boot into its own environment to do scans) Just for fun, you could throw in a "real" firewall.
So then you'd provide:
- Network monitoring for statistical "suspicious packet" analysis
- Completely detached scanning which doesn't just nicely ask an infected system whether it's infected or not
- Hardware firewall
- A solution which potentially/works/, rather than one which is guaranteed not to
Yet everything I've ever seen pushed to home users has been a software-only package, or just a firewall. When will I be able to tell my mom to "go buy a Norton ActuallyWorX box and plug it between your computer and router"?
I remember from my Sun Solaris 8 network or sys admin class that they said the system will automatically configure itself as a gateway between two network cards. When my son gets old enough to start surfing on his own, it's what I intend to do. I've got an old Solaris 8 machine on an Ultra 10. I can put it out in the garage (next to the cable modem) and have it be a physical hop between the cable modem and Dual Band WiFi router.
The hard part nowadays (although maybe not a problem in India) is actually finding a HUB. It is very difficult to actually buy a hub anymore, and most "hubs" sold in the US anyway are actually low-end unmanaged switches, so you can't sniff traffic on them.
In answer to the question though (I'm sure redundant at this point) is: YES- they are probably part of at least one bot-net, and are probably infected with all sorts of other nastiness. The best thing to do is re-secure the wireless router, and the all-too-often-recommended reformat and re-install of Windows. I wouldn't even try to salvage the current installs at this point.
You don't need a HUB at all. Linux bridging allows you to use two ports on a system 'as a HUB', while still providing you with the ability to tcpdump a port on the bridge. You just add both interfaces to your bridge and stick the linux bridge in between the real router and the infected machine. Only thing needed is a linux system with 2 physical ethernet ports.
In practice, I'd run the sniffer on the machine if there was already one there. The absence of the sniffer revealing traffic does not mean there is no traffic, but if the sniffer shows traffic it's a safe bet it's real.
Frankly I've yet to hear of any rootkits that would let the sniffer still work and not show the compromised traffic, I think it's more of an in-theory than in-practice. Because I mean, I suspect users who know how to operate sniffers are an edge case for botnet authors. If you've got the sniffer on the machine and can easily run it, why not?
A fine alternative is setting up a span port (monitor port) on the switch. I work with managed switches all day, so I'm spoiled in this regard - I don't really think that's an option for the OP however, linksys switches tend to be pretty dumb.
Please don't make unverified claims. I have seen this happen first-hand on several residential switches (5/8 port Linksys/Acer/whatever). It's how they can get away with crapping 8 ports on an underpowered processor with piddly amounts of memory.
There's basically 3 ways a switch can deal with ARP overload:
1. Ditch the least recently seen address (annoying and laggy but relatively clean) 2. Slow down, panic, and stop forwarding packets altogether (hello Linksys) 3. Ignore ARP entirely and revert to being a dumb hub, at least temporarily until everyone shuts up
You'd be surprised how many A+ asshats have daisy-chained those cheap switches to save a buck. I remember one guy who had a cage full of shitty old gear going into a bunch of $40 Aopen switches, because he figured it was cheaper to cram a few U's with those tiny 8-port toys than to drop real money on a bunch of FSM750s. His latency was pretty bad for 100mbit, but his brain was even slower so he cared not. Then one day he added one device too many and a true packet storm ensued, which caused his entire network to seize within minutes. One switch barfed, then another, and another... he had four or five of them per rack, times maybe ten racks. I tried to explain how retarded he was for trying to save maybe $1000 per rack, when each rack had at least 50k worth of gear, but they say ignorance is bliss.
Ethernet using cat5 cabling was specifically designed such that the cheapest hubs would just be RJ45 jacks wired together passively. So one could make a "hub cable" in theory.
Interestingly another instructable linked to the one he showed, was about how to use 1 cat5 cable to every jack in the house to support both phone and Ethernet data.
This person was apparently unaware of the fact that a phone cords 6P4C or 6P2C cable will happily fit into the wider 8P jack. (That is to say that phone cable will plug into Ethernet jacks by design).
Further the Ethernet wiring standard deliberately has pins 3-6 (which correspond to pins 2-5 in a phone style jack, which are the 4 that are normally connected in a phone jack) connected identically to standard phone cord. Further Pins 4 and 5 are deliberately unused in 100Mbs Ethernet, which is the one pair necessary for a single phone line.
Thus if you have a house wired for Ethernet but not phone, adding support for phones to all the jacks is as simple as using Ethernet switches that connect pin 4 of all jacks together and pin 5 of all jacks together, and then plug a pone line into one of the jacks in the switch. (I would actually be surprised if there were not Ethernet switches specially designed for that).
Yes it does seem possible and you might even get away with it in real life, but the idea of running a 48VDC pair that also uses a 100VAC ring signal right beside your ethernet pairs is scary. Also every time the telephone rings it would induce a hellacious amount of electrical noise into the data pairs; it would probably shut down any data packets on the network and possibly blow out your ethernet cards. If another technician was faninng the wires and happened puncture his skin with them the jolt from the 48VDC would probably make you number ten thousand dirty rotten SOB, a 100VAC ring signal would definitely make you number ten thousand dirty rotten SOB. Telephone and ethernet really don't play well together.
by Anonymous Coward
on Thursday August 06, @04:36PM (#28979249)
I agree with your theory, however in practice, a hacker clearly has several million low hanging fruits running unpatched xp with antivirus which expired 60 days after the computer was purchased in 2006.
The idea that a botnet is really going to worry about the fraction of the fraction of a percent that knows about netstat seems improbable, though obviously not impossible, which is why I agree with you in theory, but in practice netstat would probably answer his question when a hub and a linux box is inconvenient. If someone has an example of a virus masking its connections through netstat I would both eat crow and be interested to hear it.
I don't have any links, but I personally cleaned a PC that had a trojan on it that used netstat hiding tricks. I found it accidentally by looking at files I couldn't delete in the temp folder (trojans often mess with the permissions to make clean-up less likely).
The contents of the file was a text printout of the netstat command, re created every fifteen or so seconds, MINUS the offending connections. Just by waiting and opening the file again I got new netstat info.
Running the command, showed the contents of the text file, not the actual output of netstat. I could see traffic going on using a packet sniffer elsewhere on the network, so knew something was up.
Eventually just wiped and reinstalled anyway because it was faster than fighting it bit by bit.
So, there are such things out there, yeah, it doesn't make a whole lot of sense for them to spend much time on it, but a lot of that stuff is made from "kits" now days anyway so it's not a big deal to enable the feature.
As you would expect, both of the Windows computers got 'slow', and the desktop stopped connecting to the internet completely for some reason. As I logged in remotely to 'fix' things...
Quick question, how did you log into his desktop remotely if it "stopped connecting to the internet completely for some reason?"
If all you did was reset the hosts file, it will be back sometime. Somewhere, probably in multiple places on that hard drive, is an executable waiting to be run. It's probably infected some inane looking routine Windows system file that occasionally runs and when that happens your host file will magically change again.
I could recommend you do a netstat but what's the point? Any botnet today would know how to elude that or run as part of a system routine. If the bot is serious enough, your best bet might be to save the data and just do a routine re-install. You know on my parent's WinXP machine, I do that everytime I'm home for christmas. Then I patch it as far as I can over their 56k modem.
Odds are high your dad's machine is still infected and I would also suspect your machine as being potentially compromised if you connected using Windows remote desktop. Call me overly cautious but I don't take chances with Windows.
You can run all the programs you want (Bothunter [bothunter.net], Symantic, AVG, AdAware, etc.) but in the end there's no guarantee although BotHunter's probably your best bet.
The best thing to do is educate your dad. If he has a valid copy of Windows, spend time with him to show him how to go to IE and click Tools -> Update Windows then select all updates. Remind him periodically when you talk to him--especially if he does any banking or commerce online!
Overseeing a small office lan, I've come to the conclusion that you will be infected whether you like to or not. Regardless of how much you threaten users. I've resorted to using an drive image (paragon) saved on a drive partition which saves the system in a uninfected state. As soon as a user goes 'uh ooh' or complains of slowness I restore the image (keep in mind data is stored on a server which is backed up and scanned on which no apps are allowed to run). I also run a combination of ccleaner, spybot s&d and windows defender.
In addition I check the network once a week for mail or ftp sockets ( evidence there is a bot net at work). So far this has been the easiest way to stay on top.
You need an IDS/IPS system like a Fortigate or ASA that scans all incoming/outgoing packets for viruses/spyware/whatever, and blocks them before they get to the computer (as well as performing standard firewall duties like NAT and traffic filtering). You need Websense Express (or something similar) to block access to malicious websites (and inappropriate websites, which are often malicious anyway). You need to take away the Local Administrator rights from every user on the network, and use Group Policy to a) lock down Internet Explorer, and b) prevent them from installing any software and c)making any system changes.
This is all easy to do. Why aren't you doing it? For a small office, it wouldn't even be expensive.
1.) We are an architecture office which runs AutoCAD problem is this requires Power User group membership in order to run. (also on windows even without admin privs malicious software can infect.
2.) Unfortunately any expense is an expense, (economy doesn't help.) This is why you will note all my network software is freeware.
3.) My most malicious user is the owner of the company, who insist on having admin privies ( he equates user authority to company hierarchy) So he constantly does stuff like installs go to my pc, and leaves his system up and logged in.
unfortunately I don't live in your well funded and taken seriously IT world.
Just a quick question: how hard would it be to give your most malicious user an account named Administrator that was actually not an administrator? <bg>
1.) We are an architecture office which runs AutoCAD problem is this requires Power User group membership in order to run. (also on windows even without admin privs malicious software can infect.
No, AutoCAD doesn't require Power User membership. What it requires is someone to spend a few minutes to adjust the system to allow it (and pretty much anything else) to run with User perms only. Do a Google search for Filemon and Regmon formerly from SysInternals and now Microsoft free software. Run them (using RunAs since these DO require admin rights) while your users have normal perms. Set them to only show you what ACAD.EXE does. When it craps out (and it will), search the logs for Access Denied. Manually add perms for Users Full Control to the folders and registry keys that it requires. This will take several passes as the program will run better and better each time. Write down what you have to permit, so next time you install on a new machine you'll know what you need.
Almost none of my hundreds of supported desktops allow users to have admin rights. The ones I'm not PERMITTED to spend the labour tend to get owned periodically. The non-admin systems don't. Really. Since Win2k's release I have yet to have even one system actually get infected. Light damage, yes. Infected, no.
What... you think admins running Citrix or Terminal Servers just throw their hands up in the air and accept some lazy-ass vendor's word that their software NEEDS admin rights?
This is all easy to do. Why aren't you doing it? For a small office, it wouldn't even be expensive.
Especially in a small business, your users will rebel if they can't install (or use) their software... which is quite reasonable given most people are still running Windows XP, and most XP software is not capable of being installed or sometimes even used without admin access... this is especially troublesome if that user happens to be the CEO/Owner.
You hardly ever have time/resources to "do it properly" in
You hardly ever have time/resources to "do it properly" in a small business, unless what you're "doing right" is a core competency of the business. The trick is to convince the guy who signs the checks that it is business/mission critical (often non-trivial).
Sure you do! It's called OSX. Now, before you flame me into submission, understand that I'm writing this on my Fedora Core Linux laptop. I'm a command-line junkie extraordinaire, and don't feel comfortable until I have an xterm or three up on one or two virtual desktops while running dual-head.
But there's a very real, very useful, and very definite benefit to running on OSX - there really is not just nearly as much of a problem with viruses, worms, trojans, and other crapware. Really really for real and yes, it's for real.
Really.
You can argue about marketshare or Unix core or whatever, but it's true - Macs *are* more reliable and *do* have much less of a problem with viruses and such. Who cares why? And if you really must run something windows like, you can get Parallels/VMWare or boot camp. (I recommend the former unless you are a gamer) Even better, if you go the VM route, you can easily save your Windows VM image to an external disk every week or so, and if/when it gets infected, just recover from a backup and be up and running again in minutes instead of days!
I didn't appreciate OSX until I had to port our software over to it. It was painful at first, but in the process, I fell hard-core in love with OSX. Except for the dated Unix command line, it's everything that Fedora Core ever dreamed of.
for a small office running windows the end users HAVE to run as admin, as Most windows apps require it. My HP printer drivers, and a couple of other apps require my to be fully logged in as an admin or they don't work basically preventing me from doing most of my work.
I know this as I tried it as I don't believe I should run as admin. Since Windows and MSFT doesn't force developers to code to security standards, including their own. Running as a non admin in a real world environment is impossible. Oh and just to really make you scratch One of those mission critical apps crashes on install because it loads the win16 subsystem for running.
It gets updated 3-4 times a year but it still requires win16 components. MSFT has enabled that in 2009 that win16 parts are required still. If MSFT would let go of old and outdated parts like the rest of the OS world shit like that wouldn't happen.
No! You do not put all your effort at one entry point.. I have seen a company that was totally secure from the old "code red" virus because all the firewalls were updated, and public facing servers were patched. The network guys blocked all the appropriate ports at the firewalls. Then, a Salesman came into the office from out at a client site, and hopped on the network to check his email, and his laptop took out everyone.
You need layers of defense. preferably from different vendors or makers.
And really, this is Slashdot, why are you recommending Fortigate or ASA? you should be talking up Snort, or its commercial appliance version, Sourcefire.
In addition I check the network once a week for mail or ftp sockets ( evidence there is a bot net at work). So far this has been the easiest way to stay on top.
I would also block outgoing port 25 and then ask the users what smtp servers they use and whitelist those.
Getting the users to run as a non-privileged user will make clean-up much easier. Set their normal login to be a low-privilege user (and add network configuration so they can configure wireless networks), then give them their own administrat
Youre doing it wrong. Set your users to be users, not administrators. Give them permissions to exactly what they need and whatever special permission the applications they run need. Sure, it takes time at first, but once you figure it out then you're good for the rest.
Or you can take the lazy man's approach and set them as power users, which is almost like an administrator, but selectively remove modify/write permission from c:\windows, c:\program files, and other critical areas. Less secure but a bazill
to find out what ports your system is listening to. Running the netstat command will give you all the traffic. Should give you a good idea as to what is happening. (Helps to close all of your 'normal' apps)
If I had that kind of suspicion and if it was router itself I was suspicious about, I would simply get the latest stable firmware for that particular model (be careful) and simply reinstall it over the router itself. It would be something like "format and install windows" I wouldn't really backup any settings on that case. Just make sure you know ISP login and pwd. Make sure they work, they haven't been changed at any point or you will end up speaking with Bangalore at 4 AM:)
A simple,fast port scanner exists at http://www.grc.com/ [grc.com] (shields up!) which really works, ignore Mr. Gibson's weird named inventions like "nano scan" etc. What I know is, it works. Oh also ignore its port 139 or "you aren't stealth" paranoia. 139 is client port and stealth would be good but you won't really die if you have nothing served.
For clients, don't re invent the wheel. NMAP is there, free and can run under win32 if you need. http://nmap.org/download.html [nmap.org] , some instructions exist for detecting current security threats but I didn't really check since it is all OS X here, we have different issues than win32.
What it really means is that your dad is a part of an international crime ring and he really is a cracker, without your knowledge. He just felt that you did not have a clue so allowed you to play with his computer.
It makes remarks about wanting to try other operating software.
It's unusually concerned about antivirus protection.
Plug and Play only works with force-feedback devices.
It makes unusually long "hand-shakes" with the email server.
It accuses you of installing spyware.
It asks you to run your network scans in promiscuous mode.
It tells you that it's mainframe never liked you.
A good many replies here - so I will answer a few questions that have been asked.
1. For this time, I assumed the systems were owned, and they have now been rebuild (Windows Reinstalled).
2. The Linksys is re-secured - but I hadnt thought of that being owned - so I have to now do a firmware upgrade on that - Thanks for the suggestion.
3. Other suggestions are to confirm botnet or sniff traffic - I am in the UK, and I can only do so much remotely.
4. One of the quesions was how I managed to remote into the windows hosts - No, I managed to remote into the Linksys, not the windows hosts.
5. The bizzarre situation in the Windows host before it was rebuilt was that if we did (I told the commands over the phone for my dad to execute) ping or traceroute to a destination like www.google.co.in, it would work. It would resolve the right IP. However, with any of the browsers, as soon as access to a site was attempted - We would get a message "Connection Reset" or the browsers equivalent. (Firefox, Chrome and IE tried). Has anyone seen that one before?
6. Another question asked was if the Windows in question was legit - Yes, I bought him a OEM XP the last time I was there and installed it.
If you are seeing netbios over tcp (port 445) traffic and he is not uploading/downloading files via the "My Network Places" interface he is most likely infected with a trojan.
If your seeing random high port to random high port traffic (ports 1024 - 65535 connecting to another ports 1024-65535) and he isn't doing P2P then he most likely is infected and the infection is trying to set up the machine as part of a bot net and trying to infect others.
If you are seeing UDP traffic on a consistent port on his machine to random high ports (1024-65535) on the outside, his machine is an active server in a bot net.
You've rebuilt the windows machines? So, now you can not at all be sure if they were part of a botnet or not. Chances are they were, and you've done the right thing by rebuilding them.
I think the details about the router with it's default password an no wireless security is a red herring - I've not heard of a botnet that tries to get in to your network by guessing standard admin passwords for common wireless routers. More likely it was a drive-by download from a dodgy web page, or a trojan in some downloaded software that put the malware on the machines.
Several months ago I started using Debian as my primary OS at home. I am very happy with it, but don't know much about how to keep it secure or how to tell if I had been compromised. Of course very basics are clear: I do not use root except in those instances of updates, etc. The consensus on this site is that if you run Linux then you are invincible, but I respectfully disagree. The system is only as secure as the competence of the user.
To cut the long story short:
- What do you normally do to make sure that your Linux system is clean? Is running apt-get upgrade regularly enough or is there more to it?
- What articles or books would you recommend to a newbie in this area? I am fully willing to RTFM as such, but please at least give me at least some direction on what to search for.
- Any other general tips, advice or wisdom would you be willing to share?
Well the only fool proof way... (Score:5, Informative)
Well the only fool proof way that I can envision is the following
1) Plug you father computer into a HUB ( not a switch, unless it has a special port for this usage)
2) Plug the router into this HUB
3) Plug a Linux machine into the HUB and use tcpdump to examine traffic.
This is what security experts do.
Re:Well the only fool proof way... (Score:5, Informative)
Parent
Re:Well the only fool proof way... (Score:5, Interesting)
Agreed, I do it from my Linux router which I assume is not owned.
It is nevertheless better to reserve a machine on your network for just this usage. Nothing installed on it but tcpdump and similar tools. You should even disconnect than machine from the network when not in use. Again, that's what security expert firms do.
The important point is to be confident than what you are looking at is not coming from something that is already owned. Many root kits modify netstat, tcpdump and the like... ;-)
Parent
Re:Well the only fool proof way... (Score:5, Informative)
It is nevertheless better to reserve a machine on your network for just this usage. Nothing installed on it but tcpdump and similar tools.
Or boot from a Linux Live CD.
Also, some switches support spanning ports, which will allow you to sniff the traffic on another port. Your typical home network dumb switch probably doesn't support this, but if you have temporary access to a higher end switch, it makes such tasks much easier. You can pick up older switches that support this fairly cheap on Ebay, although you probably won't want to spend the money for a one-time usage.
Parent
Re:Well the only fool proof way... (Score:4, Funny)
Because, I mean, he only gets paid when he's SUBTLE.
Parent
Re:Well the only fool proof way... (Score:4, Interesting)
Indeed. I don't know why security companies don't aggressively push this kind of product for home use- sounds like a win-win for them: sell the consumer an expensive physical box /and/ charge them for monthly firmware updates. Special bonus: An external box would actually /work/ (and with the aid of a USB connection, it could boot into its own environment to do scans) Just for fun, you could throw in a "real" firewall.
So then you'd provide: /works/, rather than one which is guaranteed not to
- Network monitoring for statistical "suspicious packet" analysis
- Completely detached scanning which doesn't just nicely ask an infected system whether it's infected or not
- Hardware firewall
- A solution which potentially
Yet everything I've ever seen pushed to home users has been a software-only package, or just a firewall. When will I be able to tell my mom to "go buy a Norton ActuallyWorX box and plug it between your computer and router"?
Parent
Solaris does this automatically (Score:5, Interesting)
Parent
Re:Well the only fool proof way... (Score:5, Informative)
The hard part nowadays (although maybe not a problem in India) is actually finding a HUB. It is very difficult to actually buy a hub anymore, and most "hubs" sold in the US anyway are actually low-end unmanaged switches, so you can't sniff traffic on them.
In answer to the question though (I'm sure redundant at this point) is: YES- they are probably part of at least one bot-net, and are probably infected with all sorts of other nastiness. The best thing to do is re-secure the wireless router, and the all-too-often-recommended reformat and re-install of Windows. I wouldn't even try to salvage the current installs at this point.
Parent
Re:Well the only fool proof way... (Score:5, Informative)
You don't need a HUB at all. Linux bridging allows you to use two ports on a system 'as a HUB', while still providing you with the ability to tcpdump a port on the bridge. You just add both interfaces to your bridge and stick the linux bridge in between the real router and the infected machine. Only thing needed is a linux system with 2 physical ethernet ports.
Parent
Re:Well the only fool proof way... (Score:5, Insightful)
Parent
Re:Force a failover (Score:5, Interesting)
Please don't make unverified claims. I have seen this happen first-hand on several residential switches (5/8 port Linksys/Acer/whatever). It's how they can get away with crapping 8 ports on an underpowered processor with piddly amounts of memory.
There's basically 3 ways a switch can deal with ARP overload:
1. Ditch the least recently seen address (annoying and laggy but relatively clean)
2. Slow down, panic, and stop forwarding packets altogether (hello Linksys)
3. Ignore ARP entirely and revert to being a dumb hub, at least temporarily until everyone shuts up
You'd be surprised how many A+ asshats have daisy-chained those cheap switches to save a buck. I remember one guy who had a cage full of shitty old gear going into a bunch of $40 Aopen switches, because he figured it was cheaper to cram a few U's with those tiny 8-port toys than to drop real money on a bunch of FSM750s. His latency was pretty bad for 100mbit, but his brain was even slower so he cared not. Then one day he added one device too many and a true packet storm ensued, which caused his entire network to seize within minutes. One switch barfed, then another, and another... he had four or five of them per rack, times maybe ten racks. I tried to explain how retarded he was for trying to save maybe $1000 per rack, when each rack had at least 50k worth of gear, but they say ignorance is bliss.
Parent
Re:Well the only fool proof way... (Score:4, Insightful)
Ethernet using cat5 cabling was specifically designed such that the cheapest hubs would just be RJ45 jacks wired together passively. So one could make a "hub cable" in theory.
Interestingly another instructable linked to the one he showed, was about how to use 1 cat5 cable to every jack in the house to support both phone and Ethernet data.
This person was apparently unaware of the fact that a phone cords 6P4C or 6P2C cable will happily fit into the wider 8P jack. (That is to say that phone cable will plug into Ethernet jacks by design).
Further the Ethernet wiring standard deliberately has pins 3-6 (which correspond to pins 2-5 in a phone style jack, which are the 4 that are normally connected in a phone jack) connected identically to standard phone cord. Further Pins 4 and 5 are deliberately unused in 100Mbs Ethernet, which is the one pair necessary for a single phone line.
Thus if you have a house wired for Ethernet but not phone, adding support for phones to all the jacks is as simple as using Ethernet switches that connect pin 4 of all jacks together and pin 5 of all jacks together, and then plug a pone line into one of the jacks in the switch. (I would actually be surprised if there were not Ethernet switches specially designed for that).
Parent
Re:Well the only fool proof way... (Score:5, Interesting)
Yes it does seem possible and you might even get away with it in real life, but the idea of running a 48VDC pair that also uses a 100VAC ring signal right beside your ethernet pairs is scary. Also every time the telephone rings it would induce a hellacious amount of electrical noise into the data pairs; it would probably shut down any data packets on the network and possibly blow out your ethernet cards. If another technician was faninng the wires and happened puncture his skin with them the jolt from the 48VDC would probably make you number ten thousand dirty rotten SOB, a 100VAC ring signal would definitely make you number ten thousand dirty rotten SOB. Telephone and ethernet really don't play well together.
Parent
Re:Well the only fool proof way... (Score:5, Informative)
Or they use a "real" switch that has port mirroring, or a passive ethernet tap [sun.com].
Parent
Re:Well the only fool proof way... (Score:5, Funny)
Well the only fool proof way
If that sentence doesn't end with "from orbit" and have "nuke it" in there somewhere it just isn't true!
Parent
Re:Well the only fool proof way... (Score:5, Funny)
Is a father computer anything like a mother board?
Parent
Re:Well the only fool proof way... (Score:4, Funny)
Parent
Re:Well the only fool proof way... (Score:5, Funny)
If the answer to both your questions is "Yes", then you are most likely part of a botnet. This advice is free of charge.
Parent
Re:Well the only fool proof way... (Score:5, Informative)
netstat could be modified not to report the botnet connections if you are owned, hence the fool proof solution.
Parent
Re:Well the only fool proof way... (Score:5, Interesting)
I agree with your theory, however in practice, a hacker clearly has several million low hanging fruits running unpatched xp with antivirus which expired 60 days after the computer was purchased in 2006.
The idea that a botnet is really going to worry about the fraction of the fraction of a percent that knows about netstat seems improbable, though obviously not impossible, which is why I agree with you in theory, but in practice netstat would probably answer his question when a hub and a linux box is inconvenient. If someone has an example of a virus masking its connections through netstat I would both eat crow and be interested to hear it.
Parent
Re:Well the only fool proof way... (Score:5, Interesting)
The contents of the file was a text printout of the netstat command, re created every fifteen or so seconds, MINUS the offending connections. Just by waiting and opening the file again I got new netstat info.
Running the command, showed the contents of the text file, not the actual output of netstat. I could see traffic going on using a packet sniffer elsewhere on the network, so knew something was up.
Eventually just wiped and reinstalled anyway because it was faster than fighting it bit by bit.
So, there are such things out there, yeah, it doesn't make a whole lot of sense for them to spend much time on it, but a lot of that stuff is made from "kits" now days anyway so it's not a big deal to enable the feature.
Parent
Re:Well the only fool proof way... (Score:5, Funny)
Did you know that both wireshark and tcpdump use libpcap? Wireshark has a pretty GUI, tcpdump is the command line version.
Perhaps it would help if I explained that in video format.
Captcha was "obvious", this is unnerving.
Parent
Proof of Infection? Clean Reinstall (Score:5, Informative)
As you would expect, both of the Windows computers got 'slow', and the desktop stopped connecting to the internet completely for some reason. As I logged in remotely to 'fix' things ...
Quick question, how did you log into his desktop remotely if it "stopped connecting to the internet completely for some reason?"
If all you did was reset the hosts file, it will be back sometime. Somewhere, probably in multiple places on that hard drive, is an executable waiting to be run. It's probably infected some inane looking routine Windows system file that occasionally runs and when that happens your host file will magically change again.
I could recommend you do a netstat but what's the point? Any botnet today would know how to elude that or run as part of a system routine. If the bot is serious enough, your best bet might be to save the data and just do a routine re-install. You know on my parent's WinXP machine, I do that everytime I'm home for christmas. Then I patch it as far as I can over their 56k modem.
Odds are high your dad's machine is still infected and I would also suspect your machine as being potentially compromised if you connected using Windows remote desktop. Call me overly cautious but I don't take chances with Windows.
You can run all the programs you want (Bothunter [bothunter.net], Symantic, AVG, AdAware, etc.) but in the end there's no guarantee although BotHunter's probably your best bet.
The best thing to do is educate your dad. If he has a valid copy of Windows, spend time with him to show him how to go to IE and click Tools -> Update Windows then select all updates. Remind him periodically when you talk to him--especially if he does any banking or commerce online!
Re:Proof of Infection? Clean Reinstall (Score:5, Informative)
Get Autopatcher [autopatcher.com] and update it from a CD BEFORE you connect it to anything.
Parent
Assume it is .. (Score:5, Interesting)
Overseeing a small office lan, I've come to the conclusion that you will be infected whether you like to or not. Regardless of how much you threaten users. I've resorted to using an drive image (paragon) saved on a drive partition which saves the system in a uninfected state. As soon as a user goes 'uh ooh' or complains of slowness I restore the image (keep in mind data is stored on a server which is backed up and scanned on which no apps are allowed to run). I also run a combination of ccleaner, spybot s&d and windows defender.
In addition I check the network once a week for mail or ftp sockets ( evidence there is a bot net at work). So far this has been the easiest way to stay on top.
Re:Assume it is .. (Score:5, Interesting)
You're doing it wrong.
You need an IDS/IPS system like a Fortigate or ASA that scans all incoming/outgoing packets for viruses/spyware/whatever, and blocks them before they get to the computer (as well as performing standard firewall duties like NAT and traffic filtering). You need Websense Express (or something similar) to block access to malicious websites (and inappropriate websites, which are often malicious anyway). You need to take away the Local Administrator rights from every user on the network, and use Group Policy to a) lock down Internet Explorer, and b) prevent them from installing any software and c)making any system changes.
This is all easy to do. Why aren't you doing it? For a small office, it wouldn't even be expensive.
Parent
Re:Assume it is .. (Score:5, Interesting)
All great points, here are mine.
1.) We are an architecture office which runs AutoCAD problem is this requires Power User group membership in order to run. (also on windows even without admin privs malicious software can infect.
2.) Unfortunately any expense is an expense, (economy doesn't help.) This is why you will note all my network software is freeware.
3.) My most malicious user is the owner of the company, who insist on having admin privies ( he equates user authority to company hierarchy) So he constantly does stuff like installs go to my pc, and leaves his system up and logged in.
unfortunately I don't live in your well funded and taken seriously IT world.
Parent
Re:Assume it is .. (Score:5, Insightful)
Parent
Re:Assume it is .. (Score:5, Informative)
All great points, here are mine.
1.) We are an architecture office which runs AutoCAD problem is this requires Power User group membership in order to run. (also on windows even without admin privs malicious software can infect.
No, AutoCAD doesn't require Power User membership. What it requires is someone to spend a few minutes to adjust the system to allow it (and pretty much anything else) to run with User perms only. Do a Google search for Filemon and Regmon formerly from SysInternals and now Microsoft free software. Run them (using RunAs since these DO require admin rights) while your users have normal perms. Set them to only show you what ACAD.EXE does. When it craps out (and it will), search the logs for Access Denied. Manually add perms for Users Full Control to the folders and registry keys that it requires. This will take several passes as the program will run better and better each time. Write down what you have to permit, so next time you install on a new machine you'll know what you need.
Almost none of my hundreds of supported desktops allow users to have admin rights. The ones I'm not PERMITTED to spend the labour tend to get owned periodically. The non-admin systems don't. Really. Since Win2k's release I have yet to have even one system actually get infected. Light damage, yes. Infected, no.
What... you think admins running Citrix or Terminal Servers just throw their hands up in the air and accept some lazy-ass vendor's word that their software NEEDS admin rights?
Parent
Re: (Score:3, Insightful)
Especially in a small business, your users will rebel if they can't install (or use) their software... which is quite reasonable given most people are still running Windows XP, and most XP software is not capable of being installed or sometimes even used without admin access... this is especially troublesome if that user happens to be the CEO/Owner.
You hardly ever have time/resources to "do it properly" in
Re:Assume it is .. (Score:4, Insightful)
You hardly ever have time/resources to "do it properly" in a small business, unless what you're "doing right" is a core competency of the business. The trick is to convince the guy who signs the checks that it is business/mission critical (often non-trivial).
Sure you do! It's called OSX. Now, before you flame me into submission, understand that I'm writing this on my Fedora Core Linux laptop. I'm a command-line junkie extraordinaire, and don't feel comfortable until I have an xterm or three up on one or two virtual desktops while running dual-head.
But there's a very real, very useful, and very definite benefit to running on OSX - there really is not just nearly as much of a problem with viruses, worms, trojans, and other crapware. Really really for real and yes, it's for real.
Really.
You can argue about marketshare or Unix core or whatever, but it's true - Macs *are* more reliable and *do* have much less of a problem with viruses and such. Who cares why? And if you really must run something windows like, you can get Parallels/VMWare or boot camp. (I recommend the former unless you are a gamer) Even better, if you go the VM route, you can easily save your Windows VM image to an external disk every week or so, and if/when it gets infected, just recover from a backup and be up and running again in minutes instead of days!
I didn't appreciate OSX until I had to port our software over to it. It was painful at first, but in the process, I fell hard-core in love with OSX. Except for the dated Unix command line, it's everything that Fedora Core ever dreamed of.
Parent
Re:Assume it is .. (Score:5, Interesting)
for a small office running windows the end users HAVE to run as admin, as Most windows apps require it. My HP printer drivers, and a couple of other apps require my to be fully logged in as an admin or they don't work basically preventing me from doing most of my work.
I know this as I tried it as I don't believe I should run as admin. Since Windows and MSFT doesn't force developers to code to security standards, including their own. Running as a non admin in a real world environment is impossible. Oh and just to really make you scratch One of those mission critical apps crashes on install because it loads the win16 subsystem for running.
It gets updated 3-4 times a year but it still requires win16 components. MSFT has enabled that in 2009 that win16 parts are required still. If MSFT would let go of old and outdated parts like the rest of the OS world shit like that wouldn't happen.
Parent
Re:Assume it is .. (Score:5, Interesting)
You need layers of defense. preferably from different vendors or makers.
And really, this is Slashdot, why are you recommending Fortigate or ASA? you should be talking up Snort, or its commercial appliance version, Sourcefire.
Parent
Re: (Score:3, Interesting)
I would also block outgoing port 25 and then ask the users what smtp servers they use and whitelist those.
Getting the users to run as a non-privileged user will make clean-up much easier. Set their normal login to be a low-privilege user (and add network configuration so they can configure wireless networks), then give them their own administrat
Re: (Score:3, Insightful)
Youre doing it wrong. Set your users to be users, not administrators. Give them permissions to exactly what they need and whatever special permission the applications they run need. Sure, it takes time at first, but once you figure it out then you're good for the rest.
Or you can take the lazy man's approach and set them as power users, which is almost like an administrator, but selectively remove modify/write permission from c:\windows, c:\program files, and other critical areas. Less secure but a bazill
See what is going on with NETSTAT (Score:5, Informative)
Fire up a command prompt and type
netstat -a | find "LISTENING"
to find out what ports your system is listening to. Running the netstat command will give you all the traffic. Should give you a good idea as to what is happening. (Helps to close all of your 'normal' apps)
Re: (Score:3, Informative)
Considering GREP doesn't even exist in CMD and FIND does, I think the grandparent has it right and you're the one who is confused.
The command works fine, in Vista at least. Probably requires Admin privileges for full results.
Re:See what is going on with NETSTAT (Score:5, Funny)
This is windows. find == grep. Well, find < grep.
Parent
Re:See what is going on with NETSTAT (Score:5, Insightful)
You have Windows and Linux confused, as far as I can tell.
Parent
If you suspect the router itself (Score:5, Informative)
If I had that kind of suspicion and if it was router itself I was suspicious about, I would simply get the latest stable firmware for that particular model (be careful) and simply reinstall it over the router itself. It would be something like "format and install windows" I wouldn't really backup any settings on that case. Just make sure you know ISP login and pwd. Make sure they work, they haven't been changed at any point or you will end up speaking with Bangalore at 4 AM :)
A simple,fast port scanner exists at http://www.grc.com/ [grc.com] (shields up!) which really works, ignore Mr. Gibson's weird named inventions like "nano scan" etc. What I know is, it works. Oh also ignore its port 139 or "you aren't stealth" paranoia. 139 is client port and stealth would be good but you won't really die if you have nothing served.
For clients, don't re invent the wheel. NMAP is there, free and can run under win32 if you need. http://nmap.org/download.html [nmap.org] , some instructions exist for detecting current security threats but I didn't really check since it is all OS X here, we have different issues than win32.
No (Score:5, Funny)
You can tell if.. (Score:4, Funny)
Some Answers to the questions asked here... (Score:5, Interesting)
1. For this time, I assumed the systems were owned, and they have now been rebuild (Windows Reinstalled).
2. The Linksys is re-secured - but I hadnt thought of that being owned - so I have to now do a firmware upgrade on that - Thanks for the suggestion.
3. Other suggestions are to confirm botnet or sniff traffic - I am in the UK, and I can only do so much remotely.
4. One of the quesions was how I managed to remote into the windows hosts - No, I managed to remote into the Linksys, not the windows hosts.
5. The bizzarre situation in the Windows host before it was rebuilt was that if we did (I told the commands over the phone for my dad to execute) ping or traceroute to a destination like www.google.co.in, it would work. It would resolve the right IP. However, with any of the browsers, as soon as access to a site was attempted - We would get a message "Connection Reset" or the browsers equivalent. (Firefox, Chrome and IE tried). Has anyone seen that one before?
6. Another question asked was if the Windows in question was legit - Yes, I bought him a OEM XP the last time I was there and installed it.
Regards,
Ashraya
Oh, the irony... (Score:5, Funny)
Some chick named Alanis is calling you subby.
OS Check! (Score:5, Funny)
A: If it's got Windows on it, it is.
Three things to look for. (Score:5, Informative)
If you are seeing netbios over tcp (port 445) traffic and he is not uploading/downloading files via the "My Network Places" interface he is most likely infected with a trojan.
If your seeing random high port to random high port traffic (ports 1024 - 65535 connecting to another ports 1024-65535) and he isn't doing P2P then he most likely is infected and the infection is trying to set up the machine as part of a bot net and trying to infect others.
If you are seeing UDP traffic on a consistent port on his machine to random high ports (1024-65535) on the outside, his machine is an active server in a bot net.
You've rebuilt the windows machines? (Score:3, Interesting)
You've rebuilt the windows machines? So, now you can not at all be sure if they were part of a botnet or not.
Chances are they were, and you've done the right thing by rebuilding them.
I think the details about the router with it's default password an no wireless security is a red herring - I've not heard of a botnet that tries to get in to your network by guessing standard admin passwords for common wireless routers. More likely it was a drive-by download from a dodgy web page, or a trojan in some downloaded software that put the malware on the machines.
Securing Linux Box? (Score:4, Interesting)
While we are on a topic of security:
Several months ago I started using Debian as my primary OS at home. I am very happy with it, but don't know much about how to keep it secure or how to tell if I had been compromised. Of course very basics are clear: I do not use root except in those instances of updates, etc. The consensus on this site is that if you run Linux then you are invincible, but I respectfully disagree. The system is only as secure as the competence of the user.
To cut the long story short:
- What do you normally do to make sure that your Linux system is clean? Is running apt-get upgrade regularly enough or is there more to it?
- What articles or books would you recommend to a newbie in this area? I am fully willing to RTFM as such, but please at least give me at least some direction on what to search for.
- Any other general tips, advice or wisdom would you be willing to share?
Thank you
The takeaway... (Score:5, Interesting)
The Shark (Score:4, Informative)
Download and install Wireshark from http://www.wireshark.org/ [wireshark.org]
Fire it up and watch everything on the NIC