Re: "closed-port" backdoors

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Wed, 21 Mar 2001 17:03:49 -0300, Andreas Hasenack <andreas () CONECTIVA COM BR>  said:
> Has somebody seen in the wild a type of backdoor where
> no ports are open until a specifig set of packets are sent
> to the machine?
> For example, the backdoor would only bind to port X if
> the machine receives SYN packets to three other ports in
> sequence. I've seen code to do this (and sorry if it's not
> new), but I haven't seen rootkits using it.

Note that the backdoor would need to have at least one of the following:

1) A pending listen() on the 3 other ports involved.

2) A wildcard listen() unbound to a port.

3) A packet filter/sniffer active on an interface.

Otherwise, it won't see the 3 SYN packets.

If I've overlooked a means to see a packet, feel free to add - I'm not
fully caffienated yet. ;)

--
                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech

Attachment: _bin
Description: