A method for detecting backdoor accounts in power distribution terminals

Abstract

The present invention proposes a method for detecting backdoor accounts of power distribution terminals, which relates to the field of network security technology and includes the following steps: building a laboratory analysis center, and conducting experimental analysis on the availability of a detection system; connecting the detection system and the terminal system, and the detection system logs into the terminal system and obtains administrator privileges; crawling the Shadow file of the system, and storing the data therein in a database in sequence; reading the data in sequence, identifying the first field and the second field representing the user name and the ciphertext, and matching the user name in the first field with all the user names in the whitelist; according to the matching results, finding out the user names and ciphertexts that do not belong to the whitelist, exporting them and performing database attack analysis, attempting to blast to obtain the plaintext password, and finally exporting a backdoor account information report. The detection method can be used to extract the user names and passwords outside the whitelist, and display the backdoor account information existing in the current terminal device system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for detecting backdoor accounts of power distribution terminals. Background Art

[0002] Backdoor accounts generally refer to accounts that remain in a computer system and bypass security controls to gain access to programs or systems. By opening specific ports in the program and controlling the backdoor account, you can remotely access the system program at any time and perform operations. Developers may create a backdoor account in the early stages of research and development so that they can access the application or operating system for troubleshooting or other purposes. However, attackers often use backdoors they detect or install backdoors as part of an attack. Therefore, whether as a management tool, a means of attack, or as a mechanism to allow the government to access encrypted data, backdoors are a security risk because there are always threat actors looking for any loopholes that can be exploited.

[0003] The current detection method for the backdoor account of the distribution automation terminal is mainly to manually input system commands to view the contents of relevant system files. This detection method inputs the system-defined file viewing command to view the contents of files such as Passwd and Shadow in the ETC directory of the system to find out whether there are hidden backdoor accounts. The Passwd file is used to store user names, encrypted passwords, and other user information, and the Shadow file is used to store specific password contents such as user encryption algorithms and Salt values. The main process of manually detecting the backdoor account of the system is to obtain the Root user and password of the target system, log in through Sudo Passwd Root, obtain administrator privileges, and then read the Shadow file in the ETC directory to check whether there are hidden backdoor accounts.

[0004] The main problems of this identification method are: 1. It cannot guarantee that the test results are completely correct. When the number of test system users is too large, the review of system users may be missed or omitted. 2. The execution efficiency is slow. When the base of the test system is too large, the manual detection method will take a lot of time. When a security incident occurs, it is impossible to effectively eliminate the system backdoor account in a timely manner.

[0005] Therefore, it is necessary to provide a quick and easy method to automatically check the backdoor accounts in the system and export them, so as to solve the problem that the inspection efficiency is low and the inspection results cannot be guaranteed to be completely correct during the manual backdoor account detection of the system. Summary of the invention

[0006] Based on the above problems, the purpose of the present invention is to provide a backdoor account detection method for distribution terminals. The method crawls down the files containing backdoor accounts in the system, deeply analyzes the user information content therein, forms a user information library based on feature interception, and performs a database attack on the hashed passwords of users outside the whitelist, thereby extracting the user names and passwords outside the whitelist and displaying the account information existing in the background system of the current terminal device.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] A method for detecting backdoor accounts of power distribution terminals comprises the following steps:

[0009] S1. Build a laboratory analysis center for the detection system and conduct experimental analysis on the availability of the detection system;

[0010] S2. Connect the detection system and the terminal system, start the detection system, and enter the whitelist list of the terminal system, the root account and password of the terminal system;

[0011] S3, the detection system automatically logs into the terminal system through the root account and password and obtains administrator privileges;

[0012] S4, crawl the Shadow files in the ETC directory of the system, and store each piece of data in the database of the detection system in turn;

[0013] S5, reading each piece of data in the database in turn, identifying the first field and the second field representing the user name and the ciphertext password respectively according to the feature symbol, and matching the user name in the first field with all the user names in the whitelist;

[0014] S6. According to the matching results, find out the usernames and ciphertexts that are not in the whitelist, export the usernames and ciphertext passwords that are not in the whitelist, and perform database collision attacks in sequence;

[0015] S7. Based on the results of the credential stuffing attack, export the backdoor account information report.

[0016] Preferably, in step S5, the first field and the second field are identified by intercepting with ":" as a characteristic character, wherein the data before the first ":" is the first field, and the data between the first ":" and the second ":" is the second field.

[0017] Preferably, in step S6, when the match is successful, it automatically jumps to the next data to be detected for matching; when the match fails, the user name information and ciphertext information contained in the data do not belong to the whitelist, and the first field and the second field in the data that failed to match are stored in the second database of the detection system, and a database collision attack is performed on the data in the second field.

[0018] Preferably, the steps of the credential stuffing attack are:

[0019] S61, dividing the data of the second field into three modules using the “$” symbol as a feature, namely, a first module, a second module and a third module;

[0020] S62, analyzing the encryption algorithm adopted by the ciphertext password of the second field according to the first module; obtaining the Salt value used when generating the ciphertext password according to the second module; and obtaining the current ciphertext password according to the third module;

[0021] S63, calling the password library, adding the passwords in the password library one by one according to the Salt value, using the detected encryption algorithm to encrypt the passwords after adding the Salt value to form a password dictionary, and performing a database collision attack on the ciphertext password obtained by the third module.

[0022] Preferably, the method of the database collision attack is: comparing the generated password dictionary with the ciphertext passwords in the third module one by one to achieve automated ciphertext password blasting.

[0023] Preferably, when the database collision attack fails, the username and ciphertext password of the data are output, and the next database collision data is automatically jumped to perform the database collision attack;

[0024] When the database collision attack is successful, the ciphertext password in the second field is replaced with the cracked plaintext password, the username and plaintext password of the data are output, and then the attack automatically jumps to the next data to be collided with.

[0025] Preferably, the backdoor account information report includes two parts: all user names and plaintext passwords of successful credential stuffing attacks and all user names and ciphertext passwords of failed credential stuffing attacks.

[0026] Preferably, the laboratory analysis center includes a Linux system, a Linux system user whitelist, and a root account and password corresponding to the Linux system.

[0027] Preferably, the method for experimentally analyzing the availability of the detection system is:

[0028] S11. Connect the detection system to the laboratory analysis center, log in to the Linux system using the root account and password corresponding to the Linux system, enter the Linux system whitelist information, and run the detection system;

[0029] S12, crawling the Shadow file under the ETC file, and according to the composition characteristics of the Shadow string, arranging the data with the account information of different users into the database of the detection system in sequence;

[0030] S13, verifying whether the detection system can divide each piece of data in the database into a first field and a second field according to the experimental feature symbol;

[0031] S14, verifying whether the second field can be divided into different modules according to the regular matching method, and analyzing the encryption method in the second field;

[0032] S15. Repeat steps S12-S14 for different ranges of Linux system user whitelists several times to check the detection system export results.

[0033] Compared with the prior art, the present invention has the following advantages:

[0034] The present invention proposes a method for detecting backdoor accounts of power distribution terminals. The method crawls down the Shadow files containing backdoor accounts in the system, deeply analyzes the user information content therein, forms a user information library based on feature character interception, and compares it with the user information in the whitelist, extracts the non-compliant user names and ciphertext passwords outside the whitelist, and regards them as backdoor accounts.

[0035] Perform a database collision attack on usernames and ciphertext passwords outside the whitelist. If the attack is successful, that is, there is a password in the password dictionary that can match the ciphertext password in the third module, the ciphertext password will be replaced with the plaintext password and output. The user information that is not on the whitelist after the database collision attack will be output separately and composed into a backdoor account information report, which will be submitted to the other company's management for confirmation.

[0036] This detection method solves the problems of low inspection efficiency and inability to ensure completely correct inspection results during manual backdoor account detection on the system. It also conducts database collision attacks on backdoor accounts, further cracks the plaintext passwords of backdoor accounts, and thoroughly checks for possible account vulnerability risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Attached Figure 1 It is a flow chart of the method for detecting backdoor account of distribution automation terminal in the present invention;

[0038] Attached Figure 2 It is a flow chart with details of database collision attack in the distribution automation terminal backdoor account detection method of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose and technical solution of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention.

[0040] In the description of the present application, it should be understood that the terms "length", "up", "down", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0041] like Figure 1 and Figure 2 As shown, a method for detecting backdoor accounts of power distribution terminals includes the following steps:

[0042] S1. Build a laboratory analysis center for the detection system and conduct experimental analysis on the availability of the detection system;

[0043] S2. Connect the detection system and the terminal system, start the detection system, and enter the whitelist list of the terminal system, the root account and password of the terminal system;

[0044] S3, the detection system automatically logs into the terminal system through the root account and password and obtains administrator privileges;

[0045] S4, crawl the Shadow files in the ETC directory of the system, and store each piece of data in the database of the detection system in turn by matching the feature code;

[0046] S5. Read each piece of data in the database in turn, identify the first field and the second field that replace the user name information and the ciphertext information respectively, and match the user name in the first field with all the user names in the whitelist;

[0047] S6. Export the backdoor account information report based on the matching results.

[0048] Before connecting the detection system and the terminal system, first build a laboratory analysis center for the detection system, which includes the Linux system, the Linux system user whitelist, and the root account and password corresponding to the Linux system. The Linux system user whitelist is provided by the company to which the target system belongs, and the whitelist contains known, company-defined security accounts. This laboratory analysis center tests the availability of the backdoor account detection system by analyzing and comparing whitelist objects with different capacity ranges. After the experiment verifies that the system to be detected is available, it is connected to the actual terminal system for detection.

[0049] The laboratory analysis center conducts experiments based on different whitelist objects to analyze the availability of the detection system as follows:

[0050] S11. Connect the detection system to the laboratory analysis center, verify whether the detection system can automatically log in to the device when obtaining the root account and password of the Linux system, log in to the Linux system using the root account and password corresponding to the Linux system, enter the Linux system whitelist information, and run the detection system;

[0051] S12, crawling the Shadow file under the ETC file, and according to the composition characteristics of the Shadow string, arranging the data with the account information of different users into the database of the detection system in sequence;

[0052] S13, verifying whether the detection system can divide each piece of data in the database into a first field and a second field according to the experimental feature symbol; the experimental feature symbol is “:”;

[0053] S14, verify whether the second field can be divided into different modules according to the experimental feature code, and analyze the encryption method in the second field;

[0054] S15. Repeat the above steps several times for different ranges of Linux system user whitelists, and check the detection system export results.

[0055] After the laboratory analysis center completes the availability test of the detection system, the detection system is connected to the actual terminal system for testing.

[0056] Connect the detection system and the terminal system, start the detection system, enter the terminal system's whitelist, the terminal system's root account and password; the user name and password information in the whitelist are provided by the company to which the target system belongs, and are known, company-defined security accounts.

[0057] The detection system automatically logs into the terminal system through the Root account and password and obtains administrator privileges; crawls the Shadow files in the system's ETC directory, and stores each piece of data in the detection system's database in turn.

[0058] Read each piece of data in the database in sequence. When reading each piece of data in the database, find the signature in the user information of the shadow file by matching the signature, and then extract the fields representing different information meanings in sequence to obtain the corresponding positions and numerical meanings of the fields in the user data. Each line of information in the shadow file represents a piece of data, and each piece of data includes information of multiple items, where each piece of data is separated by ":" as the separator of each item in the information.

[0059] Since the system stores each line of information in the Shadow file user information as a piece of data in the database, the data can be segmented using the ":" symbol as a feature character to obtain the desired data.

[0060] This application uses “:” as a feature character to identify the first field (having user name information) and the second field (having ciphertext information) of the data. The identification method of the first field and the second field is: intercepting with “:” as the feature character, wherein the data before the first “:” is the first field, and the data between the first “:” and the second “:” is the second field.

[0061] Match the user name in the first field of each piece of data with all the user names in the whitelist. If the match is successful, it means that the user name information of the data is in the whitelist, and automatically jump to the next piece of data to be detected for matching;

[0062] When the match fails, the username and ciphertext information contained in the data do not belong to the whitelist, and there may be a backdoor account. The first field and the second field in the data that failed to match are stored in the second database of the detection system, listed as usernames and ciphertext passwords outside the whitelist, and the data in the second field is subjected to a database collision analysis.

[0063] The steps for performing database collision analysis on the data in the second field are:

[0064] S51, segmenting the second field by the feature code, using the "$" symbol as the feature, and segmenting the data of the second field into three modules, namely, the first module, the second module, and the third module, by regular matching;

[0065] S52, analyzing the encryption algorithm adopted by the ciphertext password of the second field according to the first module; obtaining the Salt value used when generating the ciphertext password according to the second module; and obtaining the current ciphertext password according to the third module;

[0066] S53, calling the password library, adding Salt values ​​to the passwords in the password library one by one, using the detected encryption algorithm to encrypt the passwords after adding the Salt value to form a password dictionary, and performing a database attack on the ciphertext password obtained by the third module, and comparing the generated password dictionary with the ciphertext passwords in the third module one by one to realize automated ciphertext password cracking.

[0067] Database collision usually refers to collecting user and password information in the password database, generating a corresponding dictionary table, and trying to log in to other websites to obtain a series of users who can log in. In this embodiment, the plaintext weak password dictionary is encrypted according to the encryption algorithm and salt of the shadow file to generate a ciphertext dictionary, and the ciphertext dictionary is used to perform a database collision attack on the ciphertext password of the third module of the second field. The dictionary is compared with the system. When it can match the ciphertext password in the third module, the database collision attack is successful, otherwise the database collision attack fails.

[0068] When the database collision attack fails, that is, all the passwords in the ciphertext dictionary cannot match the ciphertext password in the third module, the plaintext password of the user name cannot be obtained; the detection system outputs the user name and its ciphertext password, and automatically jumps to the next piece of data to be detected to perform a database collision attack;

[0069] When the database collision attack is successful, that is, there is a password in the ciphertext dictionary that can match the ciphertext in the third module, then there is a problem with the username and ciphertext password contained in the data, which may be a backdoor account. At this time, the ciphertext in the second field of the data is replaced with the cracked plaintext password, and the username and plaintext password are output, and then automatically jump to the next data to be detected to perform a database collision attack.

[0070] Finally, the backdoor account information report is exported, which mainly includes two parts: ① the usernames and plaintext passwords of all successful credential stuffing attacks; ② the usernames and ciphertext passwords output after the credential stuffing attack fails; since these two accounts are not users in the whitelist, they are regarded as backdoor accounts, and the corresponding backdoor account information report is exported and provided to the target company for confirmation.

[0071] The present invention proposes a method for detecting backdoor accounts of power distribution terminals. The method crawls down the Shadow files containing backdoor accounts in the system, deeply analyzes the user information content therein, forms a user information library based on feature character interception, and compares it with the user information in the whitelist, extracts the non-compliant user names and ciphertext passwords outside the whitelist, and regards them as backdoor accounts.

[0072] Perform a database collision attack on usernames and ciphertext passwords outside the whitelist. If the attack is successful, that is, there is a password in the password dictionary that can match the ciphertext password in the third module, the ciphertext password will be replaced with the plaintext password and output. The user information that is not on the whitelist after the database collision attack will be output separately and composed into a backdoor account information report, which will be submitted to the other company's management for confirmation.

[0073] The detection method solves the problem of low detection efficiency and inability to ensure that the detection results are completely correct during manual backdoor account detection of the system.

[0074] The above is only an embodiment of the present invention, and its description is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for detecting backdoor accounts of power distribution terminals, characterized in that: The following steps are involved: S1. Build a laboratory analysis center for the detection system and conduct experimental analysis on the availability of the detection system; S2. Connect the detection system and the terminal system, start the detection system, and enter the whitelist list of the terminal system, the root account and password of the terminal system; S3, the detection system automatically logs into the terminal system through the root account and password and obtains administrator privileges; S4, crawl the Shadow files in the ETC directory of the system, and store each piece of data in the database of the detection system in turn; S5, reading each piece of data in the database in turn, identifying the first field and the second field representing the user name and the ciphertext password respectively according to the feature symbol, and matching the user name in the first field with all the user names in the whitelist; S6. According to the matching results, find out the usernames and ciphertexts that are not in the whitelist, export the usernames and ciphertext passwords that are not in the whitelist, and perform database collision attacks in sequence. The steps of database collision attack analysis are as follows: S61, dividing the data of the second field into three modules using the "$" symbol as a feature, namely, a first module, a second module and a third module; S62, analyzing the encryption algorithm adopted by the ciphertext password of the second field according to the first module; obtaining the Salt value used when generating the ciphertext password according to the second module; and obtaining the current ciphertext password according to the third module; S63, calling the password library, adding the passwords in the password library one by one according to the Salt value, encrypting the passwords after adding the Salt value using the detected encryption algorithm to form a password dictionary, and performing a database collision attack on the ciphertext password obtained by the third module; S7. Based on the results of the credential stuffing attack, export the backdoor account information report.

2. According to a method for detecting backdoor accounts of power distribution terminals as described in claim 1, it is characterized in that: In step S5, the first field and the second field are identified by using ":" as a signature to intercept the data, wherein the data before the first ":" is the first field, and the data between the first ":" and the second ":" is the second field.

3. According to a method for detecting backdoor accounts of power distribution terminals as described in claim 1, it is characterized in that: In step S6, when the match is successful, it automatically jumps to the next data to be detected for matching; when the match fails, the user name information and ciphertext information contained in the data do not belong to the whitelist, and the first field and the second field in the data that failed to match are stored in the second database of the detection system, and the data in the second field is subjected to database collision attack analysis.

4. A method for detecting backdoor accounts of power distribution terminals according to claim 3, characterized in that: The method of the database collision attack is: comparing the generated password dictionary with the ciphertext passwords in the third module one by one to achieve automated ciphertext password blasting.

5. According to a method for detecting backdoor accounts of power distribution terminals as described in claim 3, it is characterized in that: When the attack fails, the username and ciphertext password of the data are output, and the attack automatically jumps to the next data to be attacked. When the database collision attack is successful, the ciphertext password in the second field is replaced with the cracked plaintext password, the username and plaintext password of the data are output, and then the attack automatically jumps to the next data to be collided with.

6. A method for detecting backdoor accounts of power distribution terminals according to claim 5, characterized in that: The backdoor account information report includes two parts: all user names and plain text passwords of successful credential stuffing attacks and all user names and cipher text passwords of failed credential stuffing attacks.

7. A method for detecting backdoor accounts of power distribution terminals according to claim 1, characterized in that: The laboratory analysis center includes a Linux system, a Linux system user white list, and a root account and password corresponding to the Linux system.

8. A method for detecting backdoor accounts of power distribution terminals according to claim 7, characterized in that: The method for experimental analysis of the availability of the detection system is: S11. Connect the detection system to the laboratory analysis center, log in to the Linux system using the root account and password corresponding to the Linux system, enter the Linux system whitelist information, and run the detection system; S12, crawling the Shadow file under the ETC file, and according to the composition characteristics of the Shadow string, arranging the data with the account information of different users into the database of the detection system in sequence; S13, verifying whether the detection system can divide each piece of data in the database into a first field and a second field according to the experimental feature symbol; S14, verifying whether the second field can be divided into different modules according to the regular matching method, and analyzing the encryption method in the second field; S15. Repeat steps S12-S14 for different ranges of Linux system user whitelists several times to check the detection system export results.

Images