Appendix B
87
utilities: FLOOD, MCB (Multiple Collide BOTs), SUMO BOTs, and FLASH – a
special “flood" type for use in UNIX.
The FLASH attack type is used for direct modem disconnection by sending a
ping
command with "incorrect" data in a certain sequence to a certain IP
address. The user’s modem will interpret the data as a command to disconnect
and the user will be disconnected from the Internet. However, that attack type is
applicable to some modem types only.
MCB attacks are performed via IRC channels. At the moment when IRC servers
are unable to synchronize with each other (net split), the Trojan imitates a
duplicate user’s name (nickname). After IRC servers achieve synchronization the
said name becomes invalid and such user gets disconnected from an IRC
channel.
Attacks by FLOOD BOTS/SUMO BOTS are also used in IRC networks,
"producing" numerous users with random nicknames. The attack is used to
"flood" an IRC channel or a user, who sends or receives chat messages until
user computer reaches its bandwidth limit. Then such user will also be
disconnected from an IRC channel.
Root kit
is a collection of tools used by hackers in order to receive root access to
a remote computer. It uses standard Unix programs – ps and ls. The only ef-
ficient method of recovery for computers hacked using the Root kit is resto-
ration of important data from a regular backup copy, complete deletion of
hard disk contents and reinstalling the OS.
B.3. Network worms
A malicious program belonging to this category does not add itself to executable
objects, but instead copies itself to network resources. The class title is based
exactly on the ability of worms to "crawl" through networks and other
informational channels.
They penetrate computer memory from computer networks, calculate network
addresses of other computers and send their own copies to those addresses.
Programs of that class may sometimes have work files on system disks, but they
can also use no resources on a computer at all (except for RAM).
Worm.Linux.Ramen
is the first known worm that infects RedHat Linux systems.
It infects remote Linux systems (RedHat Linux), exploiting the buffer overrun
problem. The software "hole" allows the virus to send executable code to a
remote computer and its execution there – unnoticed by an administrator
(user).
Infection source
: .
tgz
archive from a network.
