Strangers In the Night
By Wietse Venema, November 01, 2000
There's no telling what intruders might leave behind when they break into your system overnight. Wietse describes how he analyzed an unknown program left behind by one intruder.
Nov00: Strangers In the Night
<b>(a)</b>
% truss -t open,read,write,close date >/dev/null
...startup system calls skipped...
open("/usr/share/lib/zoneinfo/US/Eastern", O_RDONLY) = 3
read(3, "\0\0\0\0\0\0\0\0\0\0\0\0".., 8192) = 1250
close(3) = 0
write(1, " M o n A p r 2 4 1".., 29) = 29
<b>(b)</b>
strace -p pid -f -e trace=read,write -e read=6 -e write=4
Example 1: (a) Displaying all I/O-related system calls that are made by the Solaris date command after process initialization; (b) putting software crocodile clamps on an ssh server process.
