Identify Sniffer

From: Jon Eidson <eidson_at_unix4.is.tcu.edu>
Date: Sat, 18 Apr 1998 21:12:25 -0500 (CDT)

Help!!!

Someone has installed a packet sniffing program on our network
and has been busily collecting logins/passwords/etc. I've yet
to find it. I DO have one of the log files via someone in another
state emailing it to me!

I'm trying to identify the program that generated the output. Since
I've not done much personal hacking, I'm not aware of all the sniffing
programs ... but I'm learning ... quickly!

Anyway here are some of the lines of output it produces:

---- start ----
#interface: le0, pid: 2074
#filter: tcp and (dst port 23 or dst port 21 or dst port 513 or dst port 106)
SRC: xxxxx.xxxx.xxxxx.gov 1023 | DST: XXXXXX.PHYS.TCU.EDU 513
STAT: TIMED_OUT (125 bytes) | DATE: Wed Apr 1 01:53:31
1998

---
USER anonymous^M^MPASS 
xxxxxxxxxxx^M^MSYST^M^MMACB^M^MPASV^M^MTYPE I^M^MSIZE //Ge
ekTalk_1.1.1.hqx^M^MRETR //GeekTalk_1.1.1.hqx^M^M
---
SRC:  XXXXXX.CHM.TCU.EDU 2057 |       DST:  XXXXX.IS.TCU.EDU 23
STAT: FIN (99 bytes)            |       DATE: Wed Apr  1 02:15:35 1998
---
#P! #VT220xxxxxx(127)(127)(127)las^Mxxxxx^M^M[?62;1;6c[24;80Rl^M
---
SRC:  LOWDIN.PHYS.TCU.EDU 2048  |       DST:  XXXXXX.IS.TCU.EDU 23
STAT: FIN (106 bytes)           |       DATE: Wed Apr  1 03:36:11 1998
---
#P!P! #VT220xxxxx(127)(127)xx^M^Mxxxxxx^M^M^M^M[?62;1;6c[24;80Rl^M^M
---
---- end ----
A couple of things I've noted.  The device name of "le0" would make
me things that this is a unix system.  Since all my DEC machines
use device "ln0" I'm assuming it is NOT a DU machine doing the
sniffing.   What flavors of unix use "ln0" ???  Our departments include
an array of Suns, SGI, IBMs, DEC, MACs, Win95, WinNT, etc.  You name
it, we've probably go one.
I've noted that it doesnt matter what from of security you are using
(ie C2, etc) if a password is openly sent as a packet ALL multiuser
systems are suspect (including VMS!).  We are beginning to install
switch networking but we are a long ways from doing all departments
and buildings.
As always, I'll summarize.
Thanks in advance, Jon.
-----------------------------------------------------------------------
Jon Eidson (J.Eidson_at_tcu.edu)                Information Services
Senior Systems Programmer                    Texas Christian University
-----------------------------------------------------------------------

Received on Sun Apr 19 1998 - 04:13:27 NZST