Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

sniffers, log-cleaning scripts, and back door remote-access daemon replacements such as a
modified telnetd or sshd.
“The fundamental problem in detecting rootkits is that you can’t trust your
operating system. You can’t believe what the system tells you when you request
a list of running processes or files in a directory. One way to get around this is to
shut down the suspect computer and check its storage after booting from
alternative media that you know are clean, such as a rescue CD-ROM or a
dedicated USB flash drive. A rootkit that isn’t running can’t hide its presence,
and most antivirus programs will find rootkits by comparing standard operating
system calls (which are likely to be altered by the rootkit) against lower-level
queries, which ought to remain reliable. If the system finds a difference, you have
a rootkit infection” [A-14].
A logic bomb (also known as a time bomb) is a program that lies dormant until a specified event
happens or until a condition is true, when the malicious code is activated. They are especially
effective when coupled with a virus.
Worms and viruses are transport mechanisms for malicious code. A virus is a program that
when run, inspects its environment and copies itself into other programs if they are not already
infected, often without their users (or system administrators) knowing about the infection. A
worm is a program that copies itself over computer networks, infecting programs and machines
in remote locations. It primarily differs from a virus in that at does not require a human agency
to activate it (e.g., a human (or a process) executes the affected program to propagate a virus, but
a worm self-propagates itself).
A backdoor is a mechanism for an attacker to return to the device to continue to control (or
attack) it once he has compromised it. One of the easiest backdoors for the attacker to add for
ready future access into a cracked Unix system leverages adding the netcat (or nc) utility to the
cracked system. Netcat is a common tool used for controlling TCP/IP systems if it is compiled
with the #define GAPING_SECURITY_HOLE option that is associated with its –e invocation
option. Netcat can be configured to listen on a certain port and launch an executable when a
remote system connects to that port. By configuring a netcat listener to launch a shell for the
remote attacker to use, normal security surrounding secure shell (SSH)-only remote access can
be bypassed, permitting the attacker to have direct shell access without undergoing SSH’s
authentication mechanisms. Of course, other backdoor possibilities also exist, but this one is
particularly well known. Other common backdoors include attacker-modified startup files
(particularly rc.d), BOOTP startup files that are provided to computers via DHCP servers,
regularly scheduled jobs (e.g., crontabs), and others. In fact, so many backdoors are possible
that the most viable mechanism today for recovering from being cracked is to restore and
reinstall the OS from the original media.
In addition, cracked systems are vulnerable to port redirection that permits an attacker, located
outside of a firewall, to access and control computers within the firewall. Redirection works by
having a cracked system listen on certain ports and forward the raw packets to a specified
secondary target. In this manner, an attacker can know what is occurring behind the firewall—
A-12