ACK Tunneling Trojans

– Arne Vidstrom, arne.vidstrom@ntsecurity.nu
Summary

Trojans normally use ordinary TCP or UDP communication between their client and server parts. Any firewall between the attacker and the victim that blocks incoming traffic will usually stop all trojans from working. ICMP tunneling has existed for quite some time now, but if you block ICMP in the firewall you’ll be safe from that. This paper describes another concept, that I call ACK Tunneling. ACK Tunneling works through firewalls that don’t apply their rule sets on TCP ACK segments (ordinary packet filters belong to this class of firewalls).

sdbot 0.5b (test release) by [sd] =================================== web site: http://sdbot.n3.net/ e-mail: sdbot@mail.ru sonork id: 100.2600 icq: 21381594 irc: irc.lcirc.net, #sdbot how to edit the source file ----------------------------- extract the files from the zip into a folder, and look for a file called 'sdbot05b.c' (LCC/mingw) or 'sdbot05b.cpp' (MSVC++). these are source files for sdbot. the contents of both files are exactly the same, they are seperate.....

Hacker defender v0.7.3====================== Main---- Hacker defender v0.7.3 byHoly_Father <holy_father@phreaker.net> & Ratter/29A <ratter@atlas.cz>Copyright (c) 2000,forever ExEwORxbirthday: 10.01.2003home: http://rootkit.host.skBetatesters:ch0pper <THEMASKDEMON@flashmail.com>phj34r (sandstorm99@ziplip.com)ierdna (ierdna@go.ro)UnixDied Hacker defender is rootkit for Windows NT 4.0, Windows 2000 and Windows XP.Main code was written in Delphi 6. New functions are written in assembler.Backdoor and redirector clients are coded mostly in Delphi 6. program uses adapted LDE32LDE32, Length-Disassembler Engine, 32-bit, (x) 1999-2000 Z0MBiEspecial edition.....