Windows and Web "Backdoor" Vulnerability


Summary

Several "trojan horses" have been introduced to the Microsoft Windows environment including Back Oriffice, Netbus, and Netbus II. In addition, the so-called Ramen Web backdoor has been detected as part of the Ramen Linux worm attack

Impact

These "Trojans" allow a malicious user to manipulate a Microsoft Windows system without the knowledge of the legitimate user.

The Ramen backdoor provides a Web server for replicated worms to collect their attack programs.

Problem

Back Oriffice, Netbus, and Netbus II are "Trojan Horse" programs that resemble computer viruses in that the user inadvertently installs them. Once installed, their presence is difficult to detect. These "backdoors" allow the hacker to manipulate the compromised host at will. Data can be compromised or modified.

Resolution

SARA detects possible signatures of "backdoor" presence. It is up to you, the user to confirm that the "backdoors" are really present. Refer to the Microsoft Site for details in confirming the presence of the "backdoors.

SARA also can detect the Ramen Web server. If detected and confirmed by the administrator, the system is severly compromised (root kits, kernel mods, etc.)