Dear All
I am curious to know, that in a system compromise, when someone has access to a box, does that individual have access to a shell on the system, i.e. the person is logging into the system using telnet or SSH to remotely access the box?? How does this individual/ hacker access the system. I know it is dumb question, but please someone clarify this to me.

Also could someone direct me to a site that explains backdoors in detail? What are they, how to detect, etc.

Thanks

KS

To your last question of the group...

Taken from hackers playground

To find out more and to understand it all requires a system administrator to know how to hack a system - just as the best investigators know the mind of a criminal, a sysadmin must know the mind of a hacker. Do a search on goggle and read as much as you can.

A Backdoor can be via telnet, ftp, ssh, a netcat listener, a custom process, or just about any other net-aware process out there. Some holes that have been used in the past were actually executed through the Sendmail daemon, or via an insecure web cgi.

My favorite place for up-to date security information (and research on past issues) is Bugtraq. You can subscribe to the list, or browse via www.securityfocus.com .

Also, keep in mind it may be near impossible to find someone once they're in. For example, many of the Linux Rootkits floating around modify the system in a way the ls doesn't really show all files, ps doesn't show all processes, lsmod doesn't show all modules loaded. Can you imagine trying to search for "clues" when ls, ps, lsof, find, lsmod, etc etc have been modified? Ick.