Trinoo Found

Impact

The presence of Trinoo is a powerful denial-of-service threat to the entire network. It is also an indication that the system has already been compromised.

Background

Distributed denial-of-service is a type of attack in which a large number of hosts are used to flood a single target with unwanted traffic. The target becomes unusable while it is processing the flood of traffic. An attacker who breaks into many hosts on a network and sets up such a distributed denial-of-service attack can create a threat that is very powerful and difficult to defend against.

The Problem

Trinoo is one such distributed denial-of-service tool. A trinoo network consists of a master host and many broadcast hosts. When an attacker wishes to launch a denial-of-service attack, he or she issues commands to the master using a TCP connection. The master then communicates with all of the broadcast hosts via UDP, telling them to send a flood of UDP packets to random ports on the specified target host. The flood of UDP packets coming from the broadcast hosts causes denial of service to the target host. An attacker must have prior access to a host in order to install a trinoo master or broadcast, either by breaking in or by some other means.

Tribe Flood Network (TFN) is another distributed denial-of-service tool. It is similar to trinoo, but communicates using ICMP.

Resolution

Trinoo can be removed from a system by killing the master or broadcast process and deleting it from the system. The master process is typically called master, and the broadcast process is typically called ns, but the intruder could choose different names if desired.

Although trinoo can be easily eradicated from a single system, its presence is an indication of a much bigger problem. Since trinoo is a distributed tool, the fact that it was installed on one system makes it likely to be installed on many more systems. The entire network should be scanned. Furthermore, the presense of trinoo means that the system was probably compromised. Trinoo is often associated with breakins resulting from vulnerabilities in Tooltalk, Calendar Manager, amd, statd, and mountd, but could have been put on the system no matter how the compromise occurred. An infected system should be taken off the network until all vulnerabilities have been corrected and the system has been inspected for other backdoors and hacker trails.

Where can I read more about this?

More information about trinoo and TFN can be found in the X-Force Alert and in CERT Incident Note 99-07.