Security

Ask something
Discussion Locked

Tracking Telnet

0 helpful
5 replies

by talston 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I experienced an insider hack using the protocol Telnet. The user executed using either the Start>Run command line or the Start>cmd - to get to the DOS prompt.

The hack used our client workstations which could have been any number of Win95, 98, NT, or 2000 workstations.

How do you check out who or what workstation contributed to this hack? I'm trying to work backwards.

Thanks.

5 replies

by nsa13

The client workstation is not where you should focus in on. Your best course of action is to look at the target. Im assuming because you know that there was an intrustion, you also know what the target was. If you have auditing on - on your server boxes you'll see that they attacked telnet or another service from a certain IP/MAC (MAC only if he's on the same segment otherwise he masks with the router MAC).

Always backtrace. Look at the target and how he got in and trace back the IPs.. If he was good he masked himself and you'll need to depend on your IDS (unless he bypassed that too). The key here (I can't stress this enough) is your logs. Once you match up the IP with a workstation name you can find that workstation. You find the workstation you can find the user that used it at the time or atleast the logged on user.

172.16.22.6 => 172.16.22.5 (telnet)

tracert 172.16.22.6
...
172.16.22.6 (2 hops) workstation1.usmint.treas.gov

Chase down the person at workstation 1.

Advise you get a cyberforencics team in so that evidence isn't destroyed.

Marvin
EDS Information Assurance

by mckaytech

Usually the best source of information is going to be the logs on the target of the attack. A device like a router or a Linux/Unix server is going to show who last logged on and from what IP. Unfortunately, if the target was itself Windows-based, the quality of the logged information deteriorates markedly.

Since you believe it was a Windows-based workstation, it is likely that the IP address would not be spoofed and could lead you back to the workstation from which the hack was launched.You might also be able to infer something from the NT Security logs (unusual logon time, perhaps) and go from there.

But as far as I know, use of telnet is not an auditable event and using telnet from the command prompt does not leave much of a footprint on the machine.

Without that information, you're looking for the proverbial needle in the haystack and unless you are logging all telnet traffic across a router or have an IDS system up and running, it's going to be a tough case to crack and will get tougher for each day that goes by.

paul

This discussion is closed to new replies.