
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: subseven-defcon8-2.1-backdoor,v 1.4 2001/08/11 17:01:21 jsmoriss Exp $
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# These rules were developed based on <http://xforce.iss.net/alerts/
# advise65.php>.
#
# There have been many previously released versions of the SubSeven 
# backdoor. SubSeven allows remote attackers to obtain cached passwords,
# play audio files, view a webcam, and capture screenshots. SubSeven 
# also contains functionality to notify intruders via IRC or ICQ when 
# new computers are infected. This version of SubSeven only works on 
# Windows 95 and Windows 98.
#
# To install, copy this file to /etc/firewall/modules/public/
# block-remote-ports/subseven-defcon8-2.1-backdoor. There's no need to
# execute rc.firewall with the --update-config parameter.
# 
#-----------------------------------------------------------------------
# START OF MODULE CODE
#-----------------------------------------------------------------------

echo "Reject $INTOPT $IPADDR -> $ANY Subseven DEFCON8 2.1 Backdoor (logged)"
ipchains -A $OUTCHAIN -j REJECT -p tcp -y -s $IPADDR $UNPRIVPORTS -d $ANY 16959 -l

