finding packets

Okay, I have a question. Say you suspect a computer to have a trojan installed on it and that trojan installed a packet sniffer on said computer to sniff your network. This packet sniffer causes the computer to save all the packets, right? Is there any way to locate the packets on the computer? How about detection of the packet sniffer itself, since it isn't considered spyware?

I'm not worried about the trojan, I think I know how to get rid of it. My question more pertains to the packet sniffer. Does it save the packets on the infected computer? If so, can someone down the line access those packets and see the passwords and browsing information the packet sniffer obtained? I'm just kind of paranoid.

Hi,

Quote:

---

How about detection of the packet sniffer itself, since it isn't considered spyware?

---

Get the latest versions of A-Squared and Ewido. Update them and run them in safe mode

Be sure to check all 4 boxes in the A-Suared scan settings. I particular "riskware" and "unknown malware" but be careful, you may get false positives with aggressive heuristic scans.

"Riskware will show up stuff like John the Ripper, nmap and so on that are not malware unless you didn't install them yourself ;)

Most sniffer/keyloggers etc... store the logs on a local file until it either
a) reaches a certain size or
b) certain amount of time has passed.
(there may be other triggers, too. Like visiting citibank.com)
It really depends on what was put there, and where that particular packet sniffer hides its data, and keep in mind, the data could be encrypted.

Correct me if I'm wrong, but dont must packet sniffers operate at the physical layer ?

Wait, so they aren't stored on the infected computer? Or they are automatically deleted? I'm confused. Btw, what exactly is a "local file?"

Hi,

Quote:

---

Wait, so they aren't stored on the infected computer? Or they are automatically deleted? I'm confused. Btw, what exactly is a "local file?"

---

Actually, that's what dmorgan is telling you. The files are stored on the "infected" computer until one of the things dmorgan notes takes place (I'm not an expert on this. I'm just trying to clarify what I think you are being told). A "local file" is a file on the target computer (what you are calling the "infected" computer).

Local file: file on a computer you are using.
remote file: file on another computer.

If a person installs a packet sniffer with a log file on your computer, the log file would be a "remote file" to him/her but a "local file" to you. Make sense?

okay... so they are saved and then deleted, I take it. So you can't find the packets? I'm still slightly confused........

Just curious, are you asking these questions because you think you have a sniffer installed? Or are you just asking hypothetical questions for your own information?

If you think you do have a sniffer installed, what Operating System are you using?

Quote:

---

f so, can someone down the line access those packets and see the passwords and browsing information the packet sniffer obtained? I'm just kind of paranoid.

---

To answer this question: Yes. Otherwise, it would be kind of useless to install a packet sniffer :)

I think that there may be one installed, but that might just be paranoia. I'm asking so that I can find out for certain. I also am really paranoid and don't want the user of the infected computer to be able to acess passwords and browsing history of the other computers on the network, so I want to make sure there are no packets stored on the computer.

What operating system is the possibly infected computer using?

XP. By the way, thanks for all your help.

Just do a search for all the files that have changed in the last day. You'll have a long list, but your packet file will be in there.

Can't say I ever heard of a sniffer trojan...

I agree with Brokencrow in that I haven't heard of a trojan with packet sniffing capabilities.
Maybe Kurokage means keylogger instead of of sniffer?

Regardless, the idea of incorperating a network packet sniffer into a trojan is an interesting idea.
A way to expand the trojan's snooping capabilities beyond the local machine to a network segment (assuming the machine is on a network).

Imagine if the trojan incorperated something similar to EffeTechs PassDetect - Ace Password Sniffer
(Currently Ace Password Sniffer can monitor and capture passwords through FTP, POP3, HTTP, SMTP, Telnet, including some web mail password.)

Granted, the trojan would be pretty large, unless it was configured to pull additional modules from a remote location.... food for thought.

Quote:

---

I agree with Brokencrow in that I haven't heard of a trojan with packet sniffing capabilities.
Maybe Kurokage means keylogger instead of of sniffer?

---

Hi, if a cracker has had access through a trojan, wouldn't that allow them to install a sniffer?

Kurokage:
A packet sniffer being used to sniff a network will put a computer's network card into what is called "promiscuous mode." Here is a freeware tool whose author claims it can detect if a Windows computer's NIC (Network Interface Card) is running in promiscuous mode. http://www.ntsecurity.nu/toolbox/promiscdetect/ But don't rely on this alone. There are other ways/tools for detecting sniffers. Try a Google search for "detecting packet sniffers" for other tools and articles that will educate you on the topic.

You might just want to try the tools that Nihil mentioned first (if you haven't). If you have do have a trojan installed the best course might be to not worry about the sniffer. Just go ahead and reinstall your OS. If a computer has been trojaned it would be best not to trust that installation. As far as what kinds of files might be safe to salvage from your old installation, someone else will need to advise you on that. And, if you suspect that this computer is trojaned you have already isolated it from the rest of your network (haven't you)? See this thread.

Quote:

---

I agree with Brokencrow in that I haven't heard of a trojan with packet sniffing capabilities.
Maybe Kurokage means keylogger instead of of sniffer?

---

How long have you guys been in the security sector? Rootkits anyone?

Indeed trojans can and have been observed with sniffing capabilities, both manual and automatic.

That said, you can expect a trojan with sniffing capabilities to operate similarly to a keylogging tool with the exception of the NIC operating in permiscuous mode (sniffer).
1) It will collect data.
2) It will save it locally awaiting retrieval from the attacker or it will auto send the contents based on some pre-defined logic.
3) If the attacker is smart, the local file will be destroyed after the above has happened.

So the answer to your question is, "it depends".

Now, one thing has to happen in order for any of this to work. Your host has to either accept or initiate connections. I would start by identifying ways to monitor unusual processes and/or connections. This sounds simple but is fairly involved. Don't forget to monitor HTTP, HTTPS and your e-mail protocols, as these channels provide plenty of white noise for attackers to ship out the goods without you noticing.

--TH13

Quote:

---

Don't forget to monitor HTTP, HTTPS and your e-mail protocols, as these channels provide plenty of white noise for attackers to ship out the goods without you noticing.

---

Wouldn't netstat be a good way to do this?

It would if you have assurance that you're not running a trojaned version of the tool. Some advanced attackers replace vital system tools with their own version, which of course masks their processes. The limitation with this tool is that it's not realtime. I like to use tools such as TCPView, which provides realtime views of the system.

If I suspect a rooted host, I use a trusted forensic toolkit for analysis. I *never* trust tools on the suspect host.

--Th13

Quote:

---

Originally posted here by preacherman481
Wouldn't netstat be a good way to do this?

---

Maybe, maybe not. It depends on the attack. You have to assume that you don't have a clean system. You can't trust your binaries or APIs. If there is a rootkit... it's job is to hide itself.

You have to use forensice toolkits with binaries you can trust.

There are plenty of toolkits out there. You can use toolkits live before you take it offline for further analysis. As, there may be importatnt data in memory that can be lost when you power off.

Check out some of the following links for more info on toolkits.

http://www.forensics.nl/toolkits

I like the live cds that will run while the system is up, and then you can reboot to the live cd for further analysis. Helix has been my favorite forensics boot cd thus far.

http://www.e-fense.com/helix/index.php

Mind you, I'm no forensics expert. I just know a bit here and there from books I've read or tools I've played with.

Incident responce is one of the books I have. Though, I only have the first edition...
http://www.amazon.com/gp/product/007...Fencoding=UTF8

Quote:

---

Hi, if a cracker has had access through a trojan, wouldn't that allow them to install a sniffer?

---

Of course... they could install virtually anything themselves. I was referring to something a little more automated though. Maybe even wormlike in autonomous terms

Quote:

---

How long have you guys been in the security sector? Rootkits anyone?

---

Let me clarify my comment a tad....I was stating that I had not seen a trojan (in the classic sense) that had a built in network sniffer. That did appear to be what Kurokage was referring to originally in this thread and not rootkits. I could be mistaken. *shrugs*
You don't have to explain that once a backdoor has been established (and assuming the attacker has half a clue) that anything can be installed on that machine, including rootkits.

And to answer your question as to how long I have been in the security sector, the answer would be "Not long enough" or "not nearly as long as you" ; )
But I am in for the long haul.... thanks for asking.

Quote:

---

And to answer your question as to how long I have been in the security sector, the answer would be "Not long enough" or "not nearly as long as you" ; )
But I am in for the long haul.... thanks for asking.

---

Actually, I just read my post and just to clarify, I wasn't attempting to be a wise guy as it may appear by the wording.

Quote:

---

I was referring to something a little more automated though. Maybe even wormlike in autonomous terms

---

There are dozens of documented worms that do this. Maybe hundreds by now. Depending upon where you go, they *may* be classified as "system monitors".

The industry lacks a good framework for naming and classifying these things. This of course causes a lot of issues amongst the nerd community.

--Th13

Quote:

---

The industry lacks a good framework for naming and classifying these things. This of course causes a lot of issues amongst the nerd community.

---

Agreed, in fact, there was an absurdly long thread not to long ago disputing the difference between a RAT's and a TROJANs. Lots of different opinions and definitions.

When Kurokage mentioned there might be a trojan on the system and that he/she could handle/get rid of it, thoughts of classic trojans like netbus, sub7, B.O. came to mind. Considering Kurokage has stated (in his/her profile) that he/she isn't very computer literate, I don't surmise that he/she would know how to get rid of a rootkit if indeed one was on the system.


TH - you mentioned you *never* trust tools on the suspected host... and I understand that if a rootkit was installed that it can intercept system calls and other processes so the application or tool running may return false results. What are your opinions of programs like Sysinternal's RootkitRevealer and F-Secures Blacklight? Or should that question be saved for a seperate thread?

Quote:

---

TH - you mentioned you *never* trust tools on the suspected host... and I understand that if a rootkit was installed that it can intercept system calls and other processes so the application or tool running may return false results. What are your opinions of programs like Sysinternal's RootkitRevealer and F-Secures Blacklight?

---

I have mixed views of such tools. The differentiator being that the effectiveness is decided by the hands of the analyst they're put in.

That said, the kit has to be running before it can do anything. In most cases, a nice forensic CD is sufficient to handle the problem. SLueth comes to mind as well as Helix.

Of course I have to be special and have my own custom tools along with the ultimate in forensics - ENCASE.

I seemed to have caused some intense conversation, none of which I understand. Anyway.... back on the packets, what if the packet sniffer is no longer on the computer? Is there any way to find the packets then?

Well, even I can answer that one :D

what if the packet sniffer is no longer on the computer? Is there any way to find the packets then?

No, the odds would be 1000:1 against and that is generous. If someone loaded such a tool and subsequently removed it, you can very, very reasonably assume that most of its traces have been removed as well.

If you had the resources and the inclination you might try loading your periodic back ups onto another machine and analysing them on the off chance that you may have caught them.

Why are you interested in the packets anyway, what do you hope that they will tell you?............isn't it your data anyway?

Mind you, I am talking about a normal corporate/professional investigation.................if it is Federally funded and resourced, we are potentially talking a different ball game.

:confused:

Haha, yes, it is my data, but I'm not the user of the infected computer, I'm just on his network. I'm just really paranoid and I don't want HIM seeing my data.

Chances are that an end user has no clue how to use or even read a true packet capture.

Ok, this is starting to make more sense now. I thought you suspected a sniffer on your own computer or a computer you controlled or had access to.

Quote:

---

back on the packets, what if the packet sniffer is no longer on the computer? Is there any way to find the packets then?

---

Are you saying that you suspect someone else is sniffing the network you're on, and you are wondering if there is a way to find out if any of your personal information is on his/her computer?

But that brings up another question. What makes you think there is a sniffer involved? Please don't take offense, but if the previous posts were not understandable to you, how would you have the knowledge to be aware of such a threat?

OK, that really begs the questions:

1. Who owns the network I mean legally, and administers it?
2. Who owns the computer that you use............legally?
3. Is this supposedly infected machine a laptop, desktop or server? Who owns it?
4. What makes you think that this computer is infected?
5. What is it about "packets" from your machine that are so secret?
6. Why didn't you encrypt the data.
7. If you don't want "him" to see your data, maybe he knows that, and his machine is not infected...........maybe he brought the software in deliberately?
8. Is your computer completely physically secure or do others share it/have access to it?
9. How many others share this network? Why should you be so special?

I will suggest one thing to you, if there is money involved, change your passwords and account details and learn how to do such things securely first.

If you were being monitored and all of a sudden it stops it generally means that whoever it was has got what they want and something nasty is about to happen :eek:

Wow, okay.... First of all, let me say that I PROMISE that I am not some creepy stalker person trying to learn how to do this. I'm not, I swear.

Anyway, I guess I better give a lot more background information. Again, I'd like to state that I really know nothing about computers.

Okay, my "network" is not really a network, its just what my friend was calling it. Its just a bunch of guys sharing a hub connected to the internet.

Okay, so my friend came over and was looking at my other friends computer. He claims to know something about computers, although it could be less than he originally thinks. Anyway, after looking at my friends computer, he started talking about how he thought it might be infected with a trojan and a packet sniffer. He then started telling me about how, since we were connected to a hub, everything I and everyone else connected to the hub do is also sent to the infected computer. Then he stared telling us how the packets it picked up were stored, and how, if my other friend found them, could have access to all of our browsing history, passwords, etc.

I dunno, he just made me really paranoid, so I did a little research, which made me even more paranoid, so I came here to ask. Thank you everyone who is helping me, I'm sorry I'm so dumb.

Quote:

---

...the idea of incorporating a network packet sniffer into a trojan is an interesting idea.

---

Whew, a trojan like that would be...a pig. Sniffing sucks up a lot of system resources generally, doesn't it? The capture files would be rather large too unless heavily filtered, yes?

So what would be the point? A keylogger trojan is be a much better tool for lifting a user's data. A nice little log file compared to a packet capture.

kurokage, sounds like you could use a router. I've seen hubs hooked up directly to cable modems, which is less than ideal from a security viewpoint. With a setup like that, you're probably pulling your IP directly from your ISP, with your computer fully exposed to the internet (which is ok, but not the best).

Make sure you've got a good firewall in place on your PC. Scan everything on your PC for virii and spyware. Run all your Windows updates.

You're probably ok, most spyware does not spread in the manner described by your friend's friend. Sounds like the guy's blowin' you some smoke...IMHO.

I'm pretty sure that it can't spread to me. However, I was told that the infected computer stored packets of my and everyone elses connected to the hub's data. So then my friend said that basically, all our browsing history, passwords, aim conversations, etc are stored in the packets on the infected computer, and the user of the infected computer could come across it and see all of that.

Quote:

---

So then my friend said that basically, all our browsing history, passwords, aim conversations, etc are stored in the packets on the infected computer, and the user of the infected computer could come across it and see all of that.

---

Yes, that would be partially true IF the infected machine was indeed running a packet sniffer. I really, really doubt it's running a sniffer. Like I said, I have yet to see a "trojan" sniffer out there, and it would be a pig of a program (unpractical for the most part). Keyloggers are a different story, but keyloggers only affect the local machine, not the networked ones.

Let me add: if there's a sniffer on the networked computers, in all likelihood, someone installed it locally, on purpose, someone with physical access. Run ipig if you want your packets secured thru that hub. It'll slow you down, but it's relatively secure compared to what you've got.

Quote:

---

Wow, okay.... First of all, let me say that I PROMISE that I am not some creepy stalker person trying to learn how to do this. I'm not, I swear.

---

I know we were asking some pointed questions, but the way the picture was shaping up, I have to admit I was wondering why you were asking these questions. Your extra information helps explain. In the future, please try to give all the relevant background information up front. It saves time and will help get you answers sooner.

Back to to the problem. It seems like you are limited in your options.

First, you can go to your friend with the alledgedly infected computer and ask him to investigate the matter. Some of the posts in this thread might give him ideas on how to go about this.

Two, if he refuses to do anything and you still have doubts, get your own internet connection if at all possible.

Quote:

---

Anyway, after looking at my friends computer, he started talking about how he thought it might be infected with a trojan and a packet sniffer. He then started telling me about how, since we were connected to a hub, everything I and everyone else connected to the hub do is also sent to the infected computer. Then he stared telling us how the packets it picked up were stored, and how, if my other friend found them, could have access to all of our browsing history, passwords, etc.

---

Well if your friend (is his name Ankit Fadia? :p ) can look at this other guy's computer, he can look at yours, which means that he can install anything he likes on it effectively. No physical security = no security IMO.

I think that what he was trying to suggest is that you are ALL equally at risk, so if one of you gets infected, you could all be attacked. I think that he meant "could" rather than "might"

OK the $64,000 question...................what did your "expert" suggest that you do about it?

:D

He didn't really have much of an answer, which is why I'm turning to all of you great people for help. I dunno, unfortunately, with all my limited skills, the best I can do is "there's PROBABLY nothing there," as I haven't really found a way for certain to find the packets, apparently.

Here are three options as I see them:

Quote:

---

Run ipig if you want your packets secured thru that hub. It'll slow you down, but it's relatively secure compared to what you've got.

---

Quote:

---

First, you can go to your friend with the alledgedly infected computer and ask him to investigate the matter. Some of the posts in this thread might give him ideas on how to go about this.

---

Quote:

---

Two, if he refuses to do anything and you still have doubts, get your own internet connection if at all possible.

---

Okay, I can investigate the computer, but my friend REALLY doesn't know anything, so I'd have to do it. What exactly should I do?

Well, it seems that there is nothing on your local machine. Presumably such software would reside on any infected machine, so you will not find anything without inspecting that machine (assuming that there is one).

Similarly, it would be the infected machine that would hold the data collected.

I doubt if there are any packets.....................anyone emptied your bank account, stolen your e-mail account, drunk your beer? :D

If you want to be secure get a removable hard drive and don't share internet connections. When you share accommodation you are always at risk.

You might talk to your cohabitants about the issue?

First, check for the trojan:

Quote:

---

Get the latest versions of A-Squared and Ewido. Update them and run them in safe mode

Be sure to check all 4 boxes in the A-Suared scan settings. I particular "riskware" and "unknown malware" but be careful, you may get false positives with aggressive heuristic scans.

---

If your friend's computer has a trojan, don't even worry about finding a packet sniffer. Just backup all the data you can salvage (if you ask perhaps others here can advise on what file types are safe to keep) and reinstall Windows (reinstall, not System Restore).

Why don't you check for a trojan first, then come back and tell if you found anything.

First things first: pop a cold one and relax a bit. Sounds like it's been a long day...

;)