Event Analysis: Detecting Compromises, Javascript, Backdoors, and more!

There are a variety of indicators that a system has been compromised, ranging from the obvious to the very subtle.

Less obvious indications of a compromise include increased bandwidth, subtle IDS alerts (such as those indicating anomalous behavior) and mysterious configuration changes on systems. The questions that are typically asked include "How did they get in?" and "What did they do?" Tenable's Passive Vulnerability Scanner (PVS) provides useful information for answering these questions. Following are some of the alerts PVS may generate during an intrusion:

The alert shown above was generated because a host on the compromised network was found to be an active proxy server. This means it was accepting connections from external hosts and proxying them out to the Internet. Proxy servers are used by attackers for several different reasons, including sending spam to forums, brute forcing public web applications and cheating "Pay-To-Click" advertising (more information on this topic can be found in the post from Zscaler Research titled Top Abuses of Open Web Proxies. Further investigation revealed that a web server made an outbound FTP connection request:

It’s interesting to see that attackers are still using FTP to transfer files. One of the cases I worked on early in my career analyzed a compromise where the attackers were using FTP to upload files and download rootkits to systems. In that particular case, they left the credentials to the FTP server in a plaintext file, which greatly aided in the investigation. Once attackers have installed their tools, it is possible to use PVS to detect so-called "backdoor" communications:

Backdoors come in many different flavors, including some that implement encryption or even protocol manipulation (such as the famed ICMP backdoor named "loki"). PVS was able to detect the backdoor in use by analyzing the traffic patterns described above. By analyzing the behavior rather than trying to fingerprint the protocol or simply identify the port being used, PVS increases the chances of detection regardless of the methods implemented by the backdoor. PVS also categorized several open source programs which had embedded software packages that were suspect:

The PVS alert shown above found that not only was JavaScript being served from the web site, but that a third-party web server's JavaScript pages were included in the web site. This means that, in this case, users going to the web site were also running malicious JavaScript. This is a common practice and can be used by attackers for all types of malicious behavior, such as stealing users’ authentication cookies. PVS also noted a new service port that the site administrators had no knowledge of:

We are often concerned when attackers decide to use encryption. However, by observing behavioral changes, we can some times easily point out an attacker's backdoor channel. If you have an alert similar to the one above and you are not running a service on port 51323, further investigation into this encrypted channel is warranted.

For More Information

Tenable has written several dozen other articles on Event Analysis Training that include analysis of IP reputation, botnet activity, network anomaly detection and much more. These articles are all listed in the Event Analysis Training section of our blog. If you would like more information about Tenable’s set of Unified Security Monitoring products, please feel free to watch any of our video demos or contact our sales team.