7074741 2001-09-09 14:40 +0300  /79 rader/ kai takashi <rst@coders.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-09-09  23:04  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern kopiemottagare: incidents@securityfocus.com
Extern kopiemottagare: focus-virus@securityfocus.com
Extern kopiemottagare: vulnwatch@vulnwatch.org
Extern kopiemottagare: contribute@linuxsecurity.org
Externa svar till: rst@coders.com
Mottagare: Bugtraq (import) <19130>
Ärende: Remote Shell Trojan: Threat, Origin and the Solution
------------------------------------------------------------
Overview:

At the 5th of September Qualys released a Security Warning regarding
a Linux based virus. This virus was called  the "Remote Shell Trojan"
(RST) and it attacks Linux ELF binaries. It has replicating
abilities: when run it will infect all binaries in /bin and the
current working directory. Besides that it also spawns a process
listening on UDP port 5503. When a properly crafted packet is
received by this process it will connect back with a system shell.

Danger:

Very often viri are not seen as a real security threat for UNIX. A
virus can not infect binaries where the userID it is running under
has no write access to. Even under this situation viri can be a
threat for UNIX based operating- systems: Everytime a infected binary
is run it will infect all binaries in the current working
directory. It is not unthinkeble that a user with increased
privileges will later run a binary infected by the RST. In this way
the virus can transparently spread itself over the system. This is
especially the case in production environments of in an environment
where many users share files.  This process will get into a rapid
once the /bin binaries are infected. Every execution of normal system
commands like 'ls' will infect all binaries in the current working
directory. In spite of the theoretical immunity UNIX has is the
situation described here not unlikely to happen in many human
situations.  The backdoor process can give unpriviledged people
access to your system under the UserID the backdoor process is
running. Attackers can attempt to get higher privileges on the system
from there.

Origin:

RST was developed by us as a research project and intended only for
internal  use on our systems. Our goal was to analyse how a
non-priviledged virus could affect a system running Linux in a normal
work-environment. Things however didnt go as they were intended to
go. An infected binary accidentely leaked out our research lab and
came into the hands of so called "scriptkiddies". They infected their
own systems and other systems where they had access to. From this
point the virus seemed to spread in the wild. This should never have
happened and we truely apologize that it did.

Our main concern now is that the spread of this virus gets stopped
and that al the infected hosts get cleaned as soon as possible. As of
now the format of the specially crafted packet send to the listening
backdoor process is unknown to the public. But this might eventually
get reverse engineered in the future and RST can then be actively
abused by other people.

Solution:

We have created a set of utilities which can recursively detect and
remove the virus from the system. It also has the option to make
binaries IMMUNE for future infection by the RST. We put our best
effort in making these utilities as easy to use as possible. And we
STRONGLY RECOMMEND that you run these to see if you are infected and
to remove the RST from all the infected binaries. We especially
recommend that multiuser systems make their system immune for the RST
as the risks for these systems are much higher. Immunisation works by
increasing the size of  the text segment by 4096 bytes so that the
"hole" between the text and data segments is gone. After this there's
no space for the RST to add it self to the binary anymore.

The interface to these programs is simple and self-explanating. The
user can  decide wether he wants to automatically detect and remove
the RST on the system recursively or if he wants to apply the remover
on a per binary base. In this mode he can also get a individual
status report on wheter this binary is infected, immune or
innocent. Sample usage would be:

% perl Recurse.pl remove

For more information regarding this read the included documentation.

Conclusion:

Again we strongly recommand that anybody running Linux runs the
detector to see if their system is infected. Even if they do not
expect anything, they can always optionally immunise their
system. This is the only way we can fight the further spread of this
virus. Again we apologise for all the inconvenience this may have
caused. But maybe we can see it as a lesson that Linux and UNIX are
not immune for viri.

Regards,
        - anonymous
(7074741) /kai takashi <rst@coders.com>/--(Ombruten)
Bilaga (application/x-gzip) i text 7074742
7074742 2001-09-09 14:40 +0300  /24 rader/ kai takashi <rst@coders.com>
Bilagans filnamn: "kill_rst.tgz"
Importerad: 2001-09-09  23:04  av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern kopiemottagare: incidents@securityfocus.com
Extern kopiemottagare: focus-virus@securityfocus.com
Extern kopiemottagare: vulnwatch@vulnwatch.org
Extern kopiemottagare: contribute@linuxsecurity.org
Externa svar till: rst@coders.com
Mottagare: Bugtraq (import) <19131>
Bilaga (text/plain) till text 7074741
Ärende: Bilaga (kill_rst.tgz) till: Remote Shell Trojan: Threat, Origin and the Solution
------------------------------------------------------------
‹@X›;í<kwÛƱù*üŠc[dÌ·¾‘l稶Üë;nm¹î=‰,HD Á.D³­ïoïÌì’?rÒbÛX$°;3;ïݝeó‹\ªÁWŸ±
‡Ã{‡‡ð—Úê_ýùÞþÁÑÑáÁðhÿ«áh4}Å?'Q¶Rù9c_åB¨ëúÝôþÚB#ÿ—<(rÉûYòéqGÃáѺÜíßýÃѾ–ÿþáþ½C”ÿþèèà+6üô¤¬·ÿrù½;(d>˜Äé ãyây…äLª<ԉçÉb´fÄWü1Óˆª}«sâ͗ìVæ«Ù…AÂý”çì
kõ—q’´ô{‘©X¤r¥‹yyÅ󉐐ÄQûÖéË?ÿíÇá[Æa­ÞU«ÃþézÀ9‹#uÂÞ{Þ­øj{ŸàÐAÈ5€!cېŽ+¼Íò8U¬å¦”,™§S¦rñ³Ÿ2Ôú§Ç¬Õ5ØFoÙ¿þÅZxÐú)hïO$âÏù\\ñð·â§á>žÏ‹ô&ô[ÑÏýKDæ'	ðó˜Ë A#-	ề_Hʏ٭!û±wõ–ÍEÈُ4Œó·0ªïí°ÖbÆs®_ƒ‰”315ã,I"€ÿØvýIi)ý¤ŽÙºìçÊÎZ"«õSËæ8rŸ$ÐÍ%OU¿a&ø1 5üûÜ¿äÄá8ME½JVk<0åœE…*€!ÚÆ@†Ò9°$ä‘_$ŠY&"Æ
±Pðw±jÁ&Á>¼
ÖZ—^ç³ÖRDëtˆ¬ñÙQœðԟs÷ çø¿Á§"OY‘&\ʶÈx
ÚØçñÿvK¤ T–G3
–8‘š&:Võ‘µ}…ñƒv1’ÚŽ0 8ç~ˆ¨
oÇÌ
ZÊß)ïz¢³é·`[yÖG.ÕGõÖr\ÿ²#¼Sí뻬³|svçN‰7dub{»ÀŽ½w•(
`À/ïÚkÎy“gØۀ~‚O½¤E’8ÀÈ·
[£’¡1ÿ?̋`ʳÌK棜|PŽM>fçڌ“9ó°o5šõsÛ°ë؍A†±ô'
3	ÌOCš{X¥ÆÓÿàŸ

%´j†Æ÷{‡òßÔlþ‡a»|”ÿlÉÿÆã{ì™üþAÿñþþQ“ÿ}‰6ø†½|unÙÜOã¬H|>1ËÅ4÷çû†áj1þ½`@O‡Âœ¿»,VlæËzôf÷1¢Éc>êÛª Ã¨Ocdƃ8ŠÁìø;ð‘
ma¶dµÖ›bÒl5,rJ¢f¾BÊp‘˜Ûh8Îô6!W
ˆ¸9<ÏːË|¥ø<SGí÷MàN]Üî²T¨^=4U
n4ð¾ŽÓ )
Ϲ/ÁíˆþìaýQOêϊ4†ÇõgQª¤þˆ'Ñʃ<OWÁ/åC>õ@؆ŸZíÎÔxK­KhR=íÚD»6YÜÄL„ã§ËkxŠœÀˆ¿BÁ“§ÏÎØ7QÖñÈQ©Œ§)àÄ®q—eÊÓ)|Q$9ˆ
“ñ?@åD‚Dò%¹æ³$Ú_üeæLAŒ”„¾òáCåý¾çð=Ãÿ¦3:¡'ŧ
jœ¢MEcTD¬
Øùe;ʺlØe¯Îξ¿xuvÞa»ذæ@û«1
agϞX^Íà;Ï8|ݾƒätNIDmüÒé²Q—
?òh2ÄN}`ß2ãØåìüâìïg6“Å`Èœ˜cæI¶œq4Ur}–O6Æß0aLØÚñƒáI|ߍJ‹ùI|÷nGGÎz;•I;™y›ïÛ§NƒM¯~v¡U=
J&óÒè÷+Ü5:à™ï7òx
MÚMìh¡¢ïvÁÔ¹ûÝwß¡šïÔ²ŒHBÁ?
ÐÉb>C™°ÖqHÜ}€÷
žå¬W%E?ºËÊ'¨žòG¶ôð
;~{d6yùð„
ݯf|±è:ó•èÑJCڑäPó!¸D#òÒ3+Ÿ
ŒÜ‚0–Ó ü»Û'ñ'ã÷”ò’é|ÐR_µ>‘Ç`Ñ~ˆ8 ,F'NA‘·@Ts\ÛA8ƒ…,OaçM¤WÄ"&e~îËXAhPÌLk´n?†wGãÙ}°j:eµ­Ë®ÓO7?"ªâŒ÷duš8-÷
;
’ÄuæOý8íPþ•ˆCëØuFÇm| ›-†ú¾BÙ@ÆsLž!.-˲6„\†b¹8,´ëb1¡¬êèUÍùÿ:çL½9P÷koe;"5Ä%}ˆ¥âAßcvRéÙѺ\GÞ,ñ—¯ Ò^|D|)'.©‡eÿZ¶S†Ñ
¸ÿ¬(:ú|atôÁqtôeéèKDÒÑ¥£OKG_0˜þžÐíEí֙TñÜÇÈì\ªrÌnãÆD×`êœT‡™ø¸æRkݔ.X ?Tƒ¾NÈgãA¿Û¶s^ߑén„²qDÉKVî(íºAQ”rֆU’(Ìä+Nwxb|ñh£3F§H;;  ÎsvÉWÊ<¸°.¿‡R¹ï
h˜Ò½`ºÆÓ3?'Mû¾Õ¼Å.‰ªDúà ƒ"ÏQµá),¾ÃŽ '‘âIîBÏ¥âQ¥(òÀ‰½9DD¹îjªä¯:š
¥Uw)Œºäµ{BH5@£LR€Ð×1Wuf|· 6
­KÞ2
šoØå0"ߺ“Ý «+
nˆƒÁäãB«Ž»ø^Vö.+I
¯{ØZóië¡w«À¾Hԕ*/Úú×ÿÜŠ§ &èWŒÑ—¢Â
jÚð¨g]vŸtî¯	蓆ô ?MH¯ƒ¾.¤o$âó…ô}ÿ<!½‚ä3‡ôu>lH¯Cü£…ôˆèNϪaöþÖõì©YȺu8¨Œ]ܚ¶ÚÚöuŒà+jÊ̶ég×ՊÃÊÈ÷ìÔô7«Úmv½ÝÒ8ìS2’›Óx;„OçµNwuªqb^RŠHa%‹”ž¾ß›LbT-´U¨æåœÏá݇¡ôv I€XY@*·ãÞb²SJoa¨Î#’Ì£×/7Hf§ºhý5ü]³®ÂjŽÎ?HsäoÓ¹Ms^¡æ
V•Ç<vó3ßoR!Ó­/gN6jÑz¿±n—RIÉu‚*iÙ	­B¡œgÃlŒ¸êRËfKƒWÄz
ŒÊ¤¢\ÌAÁõ<z
:Іsa“¥â%²ðóЊÕ%¼•½©r“
Çu)cèC"G®²ç8Xuï%­è¸žÁånÝ7ÙM‘ݵ-—zûqÚÆ~>
º:ƒþ>_ýøÖ$R6¯rÙ´Èj‚;Ý/5Ë.LéÉmÉçC²ûxþ—K„føB‚rzåÇ	%zn„<Ö
×gÄʽW¦C›4›¤V†™+™¹ò’ŸÓÐ}FçÆdÕáTû”¨Íøµ:ˆH5ԍ qUÃËz‹Y»`LaRA3÷¥T|¾Ã|ÝêŠDÔW"n“DFoË5žHŽÁŽ'vȾSNª{Ö¨ô
;,µÂ¤Î,.qÑu‰îø…äwpçÙ!xZ‘Íž¤Þ”ä’iG!î:B¯vk æÙàÛÿ÷‡££ÞT]æAï`üíøàÛñ½{­.{qñòñ›—hèJ´©¯o-
0®÷áù»X*³2®„…[½—Ú9èÇUÚir[hÇØÅUû>¡ôܸ!üŽu8;ø¡ŸèŒù
{rñæå³Gßۀƒ'Ž0ó.<¿ÿì{X2ÐÀõ‰ÁR[äí(‰wöììåù.;µE¨ ¸{Ð)­=­Ý¤c»»Uf”;âD©mnrs]cgb»üV«UîC¶À:40ï´uõIEw›…ñõ=ŠÍ¨È8ð䀬c抏ÿ†½ÀíïE,qyHÚ†ÁÉ’ž”š¾^7
H#ɂÆo»¬•ß´:Rÿ#C­Tå!ih½NÉÑY¿MQ‚–c@óCÒÞ¾-;ÎY`0#-`:_î\kØ0“§ó,ᔘêc©ìª±t°f.r«`†ëh¦?°œÉÔjîpõP	çzøʉ2֎é@]wZot!QYåÉiÊhvTÁ %8˂
Sß©m'áW³Æ2ˆ†U”Ûò؏šbê+ìíl2Ú
Än¤m‡`fþÞä¤Õ 3ÀYy±¾Kˆ<®Ÿ.ÐöÌ@ûhµJb¥6ÁiAARÙ<±bÒÂ,eDà?ZJ+ɊyPa‘“UÍU!£ë+¯þ
£×=Ѹ£Mp«g®‹ë —Ð6Šï`ƒ]Ø3¶í%¦Ë¡lµ®(×Gz{“eõ×ÓÀˆ›r¾c6 ×A¾i †}ƒ5•¿Çeäyá¡Û¡Ù–7þVãيƒÞ©ï
ÕÝý³ÓÇÏÏ>OÙõõC|íêÿïaýßh8nêÿ¾DóÎ1õÛC{Ûü ór.[Šb/p6¯ W(èuVQ¼ïý1‹^›æšµâ˜d~7ØÿhŒ5¿Öþ÷‡hÿGð¨±ÿ/Ðü$9¦È°óµ·ƒ…T¹·óõ‡4èÆ‘³ ûC©Š¯â¼®Âˆuû0hÓ `ºõpÉ;Ïp‰þAƒ·Ñ÷5¦¦¶®©¤p­lk‹],?œè-xƒŒÈ§Ù°Öзû=Ÿ³^ô©&xjvÛº¸ðd{x…•W9÷hy‡Ó3·ÜpgÕJŜ%Cé'Ìܮ賛š»­õzV¤Ë¹FcBæç÷+N
ñ±Œ¥ÿýÞóÖ¬ÿŸS•û¿ôç~üÉo_ÿR½{£òþ÷!úÿýÃqãÿ¿H“ÅägðÇ´žTëƒÁ¥èÝ­cv>ƒ¥ƒê²TŠA}é+‘P‰¨ç½¸âùUÌǞwª÷{Õ·{^ñ\ÜÆ¿~²DgÁEâÍ*x*VKöÆÏi³,çS_×âúìYœï¼	u%Ý*°ˆ|7îüâA¼$l­
d·X\^‡¨•ç+å—R.«ðJ!{ªï­ä<Kb,ÉA
&Ѽ=fÜ'G¿+¶çíé Q¿,lÁÛӎ7¶Æg!rŠ=aœÃ
KHö'.ãÊ`}åÅG
&3Å(n÷2‰¥âvñõã¿°LäŠ÷ûì
RD]ÑÓ/Yû,û¼fÈn-2ùzÈ&KS¤k7Eõ°Š)ÅIL`<
iùf“’Id"äôýtÊséß°üJ†Ù3?ç´â”É@¢©¨XZy*R
:¯xú÷>;5büÔ+ÍKæé;ÀȶBòüéc¤'a6Q‹O'QB©9l5›Æž}v†ËÝEoµÆªÐc"pâêÅ_¥ŠiÝ2{‘é´çééƒÀÏ°ÞLÅsµvËGVUmQ˜Šw<UvǸHæô’Óv,Õ£´Dâ4ÈÉX<Xô_AV>E^!ÚÄWÐ		ñ˚%K¨.$ÝDfûyaª‹I^ 7½SÐ9³]-3ªÅ‰•äIÄèFWy¦c,þÏ锊 Iǁ60Ô­P/O
…Hq‚J—õ
¢ÊS#ë9^™‚¼f¨OtöÞ÷ΫºJSÅÝo]År?‹±ú>кBöæ¸î»KÓX§H"ôjEì©È稥ZÉa4„hg—°ðMäÞG	4ê²L}3ã"ç
ku‚‰fAZ‡Zƒâ"w¢‚7òxÂ#æhÅ@Â:ڙùnÓÇ©fÛ¬˜ãÉ£M\ãdÈ¡Ðöˆ{(e\³(£>á+H¹ÈwêÐa…Ÿ[®q¯µ!ªMKÓÓ&·ŠrD|¦XÁ¢Üfñ&TÕÞÚa¡>ûÄíîFp7˜¨¢ƒùOÀ>I¥Á{Oc’I
æg’TJ…v(Gݎé{ã
o%$Œ~ÈÀMüýø2ðÑP©Æ&ŽC€×^•cÆw‰"
=?Òêag`]”Ž*¨íVÏPKzÅ'+J§Ò>…q˜*o*˜¾1¹ÔPn*ÈBðn§k÷ïPt1¢v@0½Äy
gè9î$þ„8àev2dûŒ4tT
>[¨y™ºŒCH
e©ä¥3AUˆs&©eA´dŸ8ï
ª	NÄiVŸ=ÑòE“Æ+(žsA:æz’ÖõhÅ¿‘3ä8K‰Y3¬›Õv`ne/¸§òyàg"S¬U 
®X‹
RÆ"Œu
hƒÞo×q××ëÛA‘¦QSzK}²Ì
Òn9ñÊÛh§B*êënáY´3!e¤'µçY˜;± öÌ+}©
ß̄oÉÓÐV\–YÀ&+,ÒËe£Q—È_ Á(”žÑìO1``
¾1!Á«7œ¸c¾ùé	˜4Ù
…
Ì40|‚{§ß¾ð'…Ô©•@»“>ó<›
‚¿áZ`¾è=Ø7tÐYþ\¨i@ÇÀk¿äᖤ¤VžŒu.*=5©“½r¬¯t@œû~úüùëÎ*?®á•g]Õ`ù9Hv3–À·(”‹Ü®Ý?¾•s¼ž—…`([‘<©({uþòÅ~öìåÙ£ϟŸýðXë8]
ß$š
§zxîU#™Ö@Q­AÑ袈Q5¥,Z˜J«Á+`´ãV—çE¢bÊ2¬¿´©¿VùA‹Óp9å¥ôÌÉK¿€QKôµÓñPܓ:¡7”Èm“ÓØí*1Å
ý­‰BßJ“¥Ù¶f"á-‘Zp[¯#Wëv¥&0)J#R6=¤p³G©$ä?A}ŽB̃%B¶ìÙÞ/_Î…ªó™vÔy„t/`…Ùó"ӔtC4!¨—%~J™&ùXæ¡þ{!GÚB…NÐÇì
i)”aj¾6GíF<‰Â«†Â¨3ËLúfïîZKÀ3OLŒ]êèÑ/óP²—jsC‚yq2,0£ÒçÅ°zBsAaϸcw™6[5ízF¹(Lë3º>{忨p´=ÿ„ƒ+¹ÍV6³ٞ÷Æ£<09VÔ³r
IØÉ¿k¡‹ð 
"(P9¨;ˆò‘À7Rû­S¼‰f+Dí)ýԏIMH—.WÂ>|Ó¶¡%„úDíÅъUÉzŠª<g(LåO¦E¼ÄeÁ´«_jÖC/=íãHt^)ë†[æêä1ÂÜ¡åQ<ЮžŽq¼M!ÌÅòÁ„V©­¤t8Qú˜ëT#¿$—kŒ:ÁÃ
·¸ÉÁ)Äá/אÎK5‘ÔÛµ¥¹Šhq×ǟ4BÑÊ®·SÙ\lö
›Ö´¦5­iMkZӚִ¦5­iMkZӚִ¦5­iMkZӚִ¦5­iMkZӚִ¦5­iÿÍíßF*
ýx
(7074742) /kai takashi <rst@coders.com>/--(Ombruten)