RE: Finding hidden backdoors

Hi,
I think it is a pretty good idea to try to listen to the port yourself. Nice provision to listen to other protocols too.

However, has anyone encountered any backdoor where it runs a sniffer and only does certain actions when it sees a pre-defined header. Something like a covert channel but not quite. For example, it could sniff see a header with syn,fin,ack flags set then look further into the packet for commands and run that command locally and reply with the result.

That way, no port is opened. You can't portscan yourself to check for suspicious opened ports. This script that you are running won't do as well.

How to deal with these?

Thomas Ng

> -----Original Message-----