Strangers In the Night
By Wietse Venema, November 01, 2000
There's no telling what intruders might leave behind when they break into your system overnight. Wietse describes how he analyzed an unknown program left behind by one intruder.
Nov00: Strangers In the Night
<b>(a)</b>
wsbs03# ps axu
USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND
...other processes...
root 12823 0.0 0.0 48 0 ? IW 23:02 0:00 <defunct>
<b>(b)</b>
COMMAND PID USER FD TYPE DEVICE SIZE/OFF INODE NAME
<defunct> 12823 root cwd VDIR 130,0 512 90633 /
<defunct> 12823 root T00 VREG 130,0 32768 93828 /
<defunct> 12823 root T01 VREG 130,2 24576 86893 /usr
<defunct> 12823 root T02 VREG 130,2 516096 86862 /usr
<defunct> 12823 root T03 VREG 130,0 4096 95539 /
<defunct> 12823 root T04 VREG 130,2 40960 86955 /usr
<defunct> 12823 root 3u inet 0xff64e08c 0x0 TCP *:5120
<defunct> 12823 root 4r VREG 130,4 623 64258 /usr/share
Figure 2: (a) An intruder process that was running with super-user privileges; (b) using the lsof command.
