home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Internet Info 1994 March
/
Internet Info CD-ROM (Walnut Creek) (March 1994).iso
/
inet
/
scc
/
ddn-security-9013
< prev
next >
Wrap
Text File
|
1991-07-10
|
6KB
|
130 lines
***********************************************************************
DDN Security Bulletin 9013 DCA DDN Defense Communications System
13 NOV 90 Published by: DDN Security Coordination Center
(SCC@NIC.DDN.MIL) (800) 235-3155
DEFENSE DATA NETWORK
SECURITY BULLETIN
The DDN SECURITY BULLETIN is distributed by the DDN SCC (Security
Coordination Center) under DCA contract as a means of communicating
information on network and host security exposures, fixes, & concerns
to security & management personnel at DDN facilities. Back issues may
be obtained via FTP (or Kermit) from NIC.DDN.MIL [192.67.67.20]
using login="anonymous" and password="guest". The bulletin pathname is
SCC:DDN-SECURITY-yynn (where "yy" is the year the bulletin is issued
and "nn" is a bulletin number, e.g. SCC:DDN-SECURITY-9001).
**********************************************************************
VAX/VMS Break-Ins
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
! !
! The following important advisory was issued by the Computer !
! Emergency Response Team (CERT) and is being relayed unedited !
! via the Defense Communications Agency's Security Coordination !
! Center distribution system as a means of providing DDN !
! subscribers with useful security information. !
! !
+ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +
CA-90:09 CERT Advisory
November 8, 1990
VAX/VMS Break-ins
DESCRIPTION:
Several VAX/VMS systems are presently being subjected to
intrusions by a persistent intruder(s). The intruder utilizes DECnet,
TCP/IP, and/or X25 access paths to gain unauthorized entry into
accounts (privileged and non-privileged). Once a privileged account
is breached, the intruder disables auditing & accounting and installs
a trojan horse image on the system. In the most recent attacks, the
intruder has installed the image VMSCRTL.EXE in SYS$LIBRARY. (Note
that VMSCRTL.EXE is not a vendor-supplied filename.) The command
procedure DECW$INSTALL_LAT.COM is placed in SYS$STARTUP and installs
the image. Note that these images and command files are sufficiently
camouflaged so as to appear to be valid VMS system files, even upon
close inspection.
There is no evidence that the intruder is exploiting any system
vulnerability to gain access to the affected systems. The intruder
uses valid username/password combinations to gain access to accounts.
The intruder most likely obtains these username/password combinations
by systematically searching through text files on the user disks of
penetrated systems for clear-text username/password pairs. These
username/password combinations are often valid on remote systems,
which allows the intruder to access them as well. Once a privileged
account is accessed, the intruder will use the AUTHORIZE utility to
detect and exploit dormant accounts (especially dormant privileged
accounts). The intruder has also assigned privileges to dormant
non-privileged accounts.
IMPACT:
Unauthorized users who gain privileged and/or non-privileged system
access might deliberately or inadvertently affect the integrity of
system information and/or affect the integrity of the computing
resource.
SOLUTION:
The following steps are recommended for detecting whether systems at
your site have been compromised:
1. Search for SYS$LIBRARY:VMSCRTL.EXE and
SYS$STARTUP:DECW$INSTALL.COM. (This can be done with the following
DCL command: $ DIR device:[*...]/SINCE=date /MODIFIED). Note that to
call the command procedure which installs the image, the intruder will
utilize SYSMAN to modify SYS$STARTUP:VMS$LAYERED.DAT. Thus, there
will be an unexplained modification to SYS$STARTUP:VMS$LAYERED.DAT.
This may be the surest indication of an intrusion, since the intruder
could easily change the names and locations of the trojan horse image
and its accompanying command procedure.
2. If you discover that auditing or accounting has been disabled
for a period of time, go into AUTHORIZE and ensure that no password or
other changes were made during that time. Password changes while
auditing and accounting have been disabled may indicate unauthorized
access into your system.
The following pre-emptive actions are suggested:
1. DISUSER all dormant accounts, especially dormant privileged
accounts.
2. Advise all users of the security problems inherent in placing
username/password combinations in text files. Consider searching your
user disks for such occurrences.
3. Change all vendor-supplied default passwords (e.g., MAILER,
DECNET, SYSTEM) and make sure all passwords are difficult to guess.
4. Make sure that all privileged users have only the minimum
privileges that are REQUIRED to perform their current tasks.
5. Closely monitor all relevant audit trails.
-------------------------------------------------------------------------
Kenneth R. van Wyk
Computer Emergency Response Team/Coordination Center (CERT/CC)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
Internet E-mail: cert@cert.sei.cmu.edu
Telephone: 412-268-7090 24-hour hotline: CERT personnel answer
7:30a.m.-6:00p.m. EST, on call for
emergencies other hours.
Past advisories and other information are available for anonymous ftp
from cert.sei.cmu.edu (128.237.253.5).