Re: [gentoo-user] chkrootkit LKM trojan ?

[Dave S]

On Sunday 16 July 2006 22:25, Jerry McBride wrote:
> On Sunday 16 July 2006 15:54, Dave S wrote:
> > On Sunday 16 July 2006 19:54, Hemmann, Volker Armin wrote:
> > > On Sunday 16 July 2006 20:25, Dave S wrote:
> > > > HI, I have a potential security problem ...
> > > >
> > > > and err its not on gentoo, its on ubuntu but I am not getting any
> > > > response there & you guys are the most tech bunch I know  - Thought I
> > > > would lay it on the table :)
> > > >
> > > > I just had an email from chkrootkit last night -
> > > >
> > > > ---
> > > >
> > > > The following suspicious files and directories were found:
> > > >
> > > > You have     3 process hidden for readdir command
> > > > You have     3 process hidden for ps command
> > > > chkproc: Warning: Possible LKM Trojan installed
> > > >
> > > > ---
> > > >
> > > > Running chkrootkit now and all is OK
> > > >
> > > > root@dave-comp:~#
> > > > root@dave-comp:~# chkrootkit | grep chkproc
> > > > Checking `lkm'... chkproc: nothing detected
> > > > root@dave-comp:~#
> > > >
> > > > I have even 'sudo install --reinstall chkrootkit' in case its binarys
> > > > have been modified (paranoid)
> > >
> > > if you installed using the tools of the system, it could be worthless,
> > > because compromised. Boot from a cd and check from the cd.
> >
> > I understand. Booted from knoppix 5.0.1, executed a
> >
> > 'chroot /mnt/hda1 chkrootkit' and a
> > 'chroot /mnt/hda1 rkhunter -c'
> >
> > - both scans brought back nothing. From what I have read the chkrootkit &
> > rkhunter binarys would have been from the CD and therefore untainted ? Am
> > I correct ?
> >
> > Are there any other checks I can do - re-installing the system is not my
> > preferred option :)
> >
> > Dave
>
> Hi Dave,
>
> Just went through the same scare with an OLD linux server a few weeks ago.
>
> This "could" be a false positive...
>
> What you should do is run chkrootkit with verbose option turned on. Take
> the pids it show you and compare them to what's listed in /proc.
>
> Each running process has a pid and it's listed under /proc. In each pid
> listed under proc there's a /exe link that gives you the path to the
> program owning the pid. There a /status file that will give you the name of
> the program. There's other info there also. If there's any discrepancies
> between what's list in /proc and what ps tells you, you've been infected
> with LKM for sure.
>
> Naturally, you have to be there when chkrootkit complains...

Thats the problem it was an automated email at midnight - all looks OK now - 
apart from my paranoia that is ...

>
> But don't stop here...
>
> You can also try running rootkit-hunter and compare the output.

Done it - it reports clean
>
> You can cp known good tools (in your case, ps) from a backup to your
> infected box and run it to get "true" information.
>
> I knew a co-worker that ran "tree" across a suspected infected box and
> found a number of  hidden directories on it. It was indeed infected.

I will look into it.

>
> Also, if this machine was running a firewall, look in the logs. If you've
> kept a running archive, hopefully spanning a week or two, you may be able
> to figure out when and where the attack came from.

Netgear firewall ADSL NAT, tea machine, router - I will have a look in the 
logs for anything suspicious - good idea.

>
> Hope that helps.
>
> Jerry

Cheers

Dave
-- 
gentoo-user@g.o mailing list