LinuxQuestions.org
Visit the LQ Articles and Editorials section
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
Reload this Page How can a hacker get in!? Impossible!
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
LinkBack Search this Thread
Old 03-23-2005, 07:54 PM   #1
AC97Conquerer
Member
 
Registered: Nov 2004
Location: US
Distribution: Debian Sid
Posts: 50

Rep: Reputation: 15
How can a hacker get in!? Impossible!

I have no servers running and this is my "netstat -tap":
Code:
Shiva:~# netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       
PID/Program name   
tcp        0      0 d12-130.rb.vcr.ce:33254 65.75.129.90:www        ESTABLISHED2624/wget           
tcp        0      0 d12-130.rb.vcr.ce:33264 65.75.129.90:www        ESTABLISHED2622/wget           
tcp        0      0 d12-130.rb.vcr.ce:33261 www.google.com:www      ESTABLISHED1300/firefox-bin
So if Goole wanted to it could used my ESTABLISHED connection to execute arbitrary code on my computer? What if I had NO connections, how could they connect anyways if I don't have any server software running?
 
Old 03-23-2005, 08:16 PM   #2
calcon
Member
 
Registered: Mar 2005
Location: somewhere over the rainbow theres a place....
Distribution: Ubuntu Dapper and Arch
Posts: 121

Rep: Reputation: 15
Google isn't connected to you, you are connected to google via www/port 80. Google doesn't have access to your computer. You only are on the website, not logged on to google.
 
Old 03-23-2005, 09:17 PM   #3
AC97Conquerer
Member
 
Registered: Nov 2004
Location: US
Distribution: Debian Sid
Posts: 50

Original Poster
Rep: Reputation: 15
Quote:
Originally posted by calcon
Google isn't connected to you, you are connected to google via www/port 80. Google doesn't have access to your computer. You only are on the website, not logged on to google.
Ohhh I knew that, my bad. I've gotta THINK before I type next time! So...how can a computer have vulnerabilities on the internet if there are no servers running (thus no ports open)?
 
Old 03-23-2005, 09:28 PM   #4
soulstace
Member
 
Registered: Mar 2005
Location: USA
Distribution: Knoppix
Posts: 64

Rep: Reputation: 15
Care to share your netstat -pantu output?

If you have no ports open then you have nothing to worry about (besides attacks done locally that is). However, once you start communicating to anyone or anything on the net, ports get opened. It's inevitable.
Last edited by soulstace; 03-23-2005 at 09:30 PM.
 
Old 03-23-2005, 09:40 PM   #5
AC97Conquerer
Member
 
Registered: Nov 2004
Location: US
Distribution: Debian Sid
Posts: 50

Original Poster
Rep: Reputation: 15
Quote:
However, once you start communicating to anyone or anything on the net, ports get opened. It's inevitable.
Well that's just stupid!! netstat -pantu is the same.

Code:
Shiva:~# netstat -pantu
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name   
tcp        0      0 24.20.23.55:33578     216.239.63.99:80        ESTABLISHED1300/firefox-bin    
tcp        0      0 24.20.23.55:33585     216.239.63.99:80        ESTABLISHED1300/firefox-bin    
tcp        0      0 24.20.23.55:33592     65.75.129.90:80         ESTABLISHED3387/wget
 
Old 03-23-2005, 09:42 PM   #6
inaki
Member
 
Registered: Mar 2005
Posts: 94

Rep: Reputation: 15
FYI, every OS got some port known as ephimeral port. The port will be used when u connecting to other PC / server. Once u're established it wiill appear when u do netstat. U can change u're port at /proc/sys/net/ipv4/ip_local_port_range


#always carefull
 
Old 03-23-2005, 09:46 PM   #7
chbin
Member
 
Registered: Mar 2005
Distribution: slackware-current
Posts: 379

Rep: Reputation: 31
Hmm, well they could always attack you tcp/ip stack! Especiallly if you don't have a firewall.
 
Old 03-23-2005, 09:50 PM   #8
inaki
Member
 
Registered: Mar 2005
Posts: 94

Rep: Reputation: 15
To check whether your server has run services or not just simply type:-

netstat -antp | grep LISTEN

The output is something like this : -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 23849/httpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 209/sshd
tcp 0 0 0.0.0.0:3000 0.0.0.0:* LISTEN 11845/mysqld
 
Old 03-23-2005, 10:00 PM   #9
soulstace
Member
 
Registered: Mar 2005
Location: USA
Distribution: Knoppix
Posts: 64

Rep: Reputation: 15
Quote:
Originally posted by AC97Conquerer
Well that's just stupid!!


It is actually very necessary because in order to get response back from a website or e-mail server or whatever, the data has to come in thru a opened port on your machine. This port is almost always dynamic (meaning it changes) unless configured otherwise by the user. That in turn makes it much harder for an attacker to get in. He (or she) pretty much has to initiate a connection blindly and predict and fake all kinds of numbers. IP addresses, and ISNs just to name a couple.
 
Old 03-24-2005, 05:35 AM   #10
inaki
Member
 
Registered: Mar 2005
Posts: 94

Rep: Reputation: 15
Try check your server with using rootkit check. Maybe your netstat was been rootkit. You can use rkhunter or chkrootkit to check it.
 
Old 03-24-2005, 07:43 AM   #11
Krugger
Member
 
Registered: Oct 2004
Posts: 229

Rep: Reputation: 30
So nobody can connect to your machine. People can still DoS you or try to trick you into running something you shouldn't like a modified rpm or other stuff that works like a trojan. Then there is still the possibility that you get attacked during the connection, by people using sniffers or man in the middle attacks.
 
Old 03-24-2005, 12:40 PM   #12
AC97Conquerer
Member
 
Registered: Nov 2004
Location: US
Distribution: Debian Sid
Posts: 50

Original Poster
Rep: Reputation: 15
Thanks inaki, I tried it out! By the way I'm going to switching to a regular user on next boot named 'psycho'

Code:
|root:~|: chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
Checking `basename'... not infected
Checking `biff'... not found
Checking `chfn'... not infected
Checking `chsh'... not infected
Checking `cron'... not infected
Checking `date'... not infected
Checking `du'... not infected
Checking `dirname'... not infected
Checking `echo'... not infected
Checking `egrep'... not infected
Checking `env'... not infected
Checking `find'... not infected
Checking `fingerd'... not found
Checking `gpm'... not found
Checking `grep'... not infected
Checking `hdparm'... not found
Checking `su'... not infected
Checking `ifconfig'... not infected
Checking `inetd'... not infected
Checking `inetdconf'... not infected
Checking `identd'... not found
Checking `init'... not infected
Checking `killall'... not infected
Checking `ldsopreload'... not infected
Checking `login'... not infected
Checking `ls'... not infected
Checking `lsof'... not infected
Checking `mail'... not infected
Checking `mingetty'... not found
Checking `netstat'... not infected
Checking `named'... not found
Checking `passwd'... not infected
Checking `pidof'... not infected
Checking `pop2'... not found
Checking `pop3'... not found
Checking `ps'... not infected
Checking `pstree'... not infected
Checking `rpcinfo'... not infected
Checking `rlogind'... not found
Checking `rshd'... not found
Checking `slogin'... not infected
Checking `sendmail'... not infected
Checking `sshd'... /usr/bin/strings: Warning: '/' is not an ordinary file
not infected
Checking `syslogd'... not infected
Checking `tar'... not infected
Checking `tcpd'... not infected
Checking `tcpdump'... not infected
Checking `top'... not infected
Checking `telnetd'... not found
Checking `timed'... not found
Checking `traceroute'... not found
Checking `vdir'... not infected
Checking `w'... not infected
Checking `write'... not infected
Checking `aliens'... no suspect files
Searching for sniffer's logs, it may take a while... nothing found
Searching for HiDrootkit's default dir... nothing found
Searching for t0rn's default files and dirs... nothing found
Searching for t0rn's v8 defaults... nothing found
Searching for Lion Worm default files and dirs... nothing found
Searching for RSHA's default files and dir... nothing found
Searching for RH-Sharpe's default files... nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... 
/usr/lib/blender/.Blanguages /usr/lib/blender/.bfont.ttf

Searching for LPD Worm files and dirs... nothing found
Searching for Ramen Worm files and dirs... nothing found
Searching for Maniac files and dirs... nothing found
Searching for RK17 files and dirs... nothing found
Searching for Ducoci rootkit... nothing found
Searching for Adore Worm... nothing found
Searching for ShitC Worm... nothing found
Searching for Omega Worm... nothing found
Searching for Sadmind/IIS Worm... nothing found
Searching for MonKit... nothing found
Searching for Showtee... nothing found
Searching for OpticKit... nothing found
Searching for T.R.K... nothing found
Searching for Mithra... nothing found
Searching for LOC rootkit... nothing found
Searching for Romanian rootkit... nothing found
Searching for Suckit rootkit... nothing found
Searching for Volc rootkit... nothing found
Searching for Gold2 rootkit... nothing found
Searching for TC2 Worm default files and dirs... nothing found
Searching for Anonoying rootkit default files and dirs... nothing found
Searching for ZK rootkit default files and dirs... nothing found
Searching for ShKit rootkit default files and dirs... nothing found
Searching for AjaKit rootkit default files and dirs... nothing found
Searching for zaRwT rootkit default files and dirs... nothing found
Searching for Madalin rootkit default files... nothing found
Searching for anomalies in shell history files... nothing found
Checking `asp'... not infected
Checking `bindshell'... not infected
Checking `lkm'... nothing detected
Checking `rexedcs'... not found
Checking `sniffer'... lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/usr/sbin/pppoe[4880], /usr/sbin/pppoe[4880])
ppp0: not promisc and no packet sniffer sockets
Checking `w55808'... not infected
Checking `wted'... nothing deleted
Checking `scalper'... not infected
Checking `slapper'... not infected
Checking `z2'... nothing deleted
 
Old 03-24-2005, 03:36 PM   #13
calcon
Member
 
Registered: Mar 2005
Location: somewhere over the rainbow theres a place....
Distribution: Ubuntu Dapper and Arch
Posts: 121

Rep: Reputation: 15
I don't know whether you've done this or not, but you can change your ssh port to something else so people will have a harder time getting in. There was a post about it somewhere....

calcon
 
Old 03-24-2005, 06:52 PM   #14
AC97Conquerer
Member
 
Registered: Nov 2004
Location: US
Distribution: Debian Sid
Posts: 50

Original Poster
Rep: Reputation: 15
Well I have no use for remote logins yet, I doubt if most people use remote logins, they should probably disable it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
hacker at work? buehler Linux - Security 2 04-21-2005 04:23 AM
becoming a kernel hacker skywalker27182 Programming 4 08-02-2004 11:01 PM
help much required against hacker TagnikZur Linux - General 7 03-08-2004 05:26 AM
Hacker Forums Volcom Slackware 1 05-26-2003 05:18 PM
Trace hacker? mikeshn Linux - Security 8 04-17-2003 01:30 PM


All times are GMT -5. The time now is 09:44 AM.

Contact Us - Advertising Info - Rules - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration