1 |
On Sunday 16 July 2006 21:52, dnlt0hn5ntzhbqkv51 wrote: |
2 |
> On Sun, 16 Jul 2006 15:54:18 -0400, Dave S <gentoo@××××××××.net> wrote: |
3 |
> > On Sunday 16 July 2006 19:54, Hemmann, Volker Armin wrote: |
4 |
> >> On Sunday 16 July 2006 20:25, Dave S wrote: |
5 |
> >> > HI, I have a potential security problem ... |
6 |
> >> > |
7 |
> >> > and err its not on gentoo, its on ubuntu but I am not getting any |
8 |
> >> > response there & you guys are the most tech bunch I know - Thought I |
9 |
> >> > would lay it on the table :) |
10 |
> >> > |
11 |
> >> > I just had an email from chkrootkit last night - |
12 |
> >> > |
13 |
> >> > --- |
14 |
> >> > |
15 |
> >> > The following suspicious files and directories were found: |
16 |
> >> > |
17 |
> >> > You have 3 process hidden for readdir command |
18 |
> >> > You have 3 process hidden for ps command |
19 |
> >> > chkproc: Warning: Possible LKM Trojan installed |
20 |
> >> > |
21 |
> >> > --- |
22 |
> >> > |
23 |
> >> > Running chkrootkit now and all is OK |
24 |
> >> > |
25 |
> >> > root@dave-comp:~# |
26 |
> >> > root@dave-comp:~# chkrootkit | grep chkproc |
27 |
> >> > Checking `lkm'... chkproc: nothing detected |
28 |
> >> > root@dave-comp:~# |
29 |
> >> > |
30 |
> >> > I have even 'sudo install --reinstall chkrootkit' in case its binarys |
31 |
> >> > have been modified (paranoid) |
32 |
> >> |
33 |
> >> if you installed using the tools of the system, it could be worthless, |
34 |
> >> because compromised. Boot from a cd and check from the cd. |
35 |
> > |
36 |
> > I understand. Booted from knoppix 5.0.1, executed a |
37 |
> > |
38 |
> > 'chroot /mnt/hda1 chkrootkit' and a |
39 |
> > 'chroot /mnt/hda1 rkhunter -c' |
40 |
> > |
41 |
> > - both scans brought back nothing. From what I have read the chkrootkit & |
42 |
> > rkhunter binarys would have been from the CD and therefore untainted ? |
43 |
> > Am I |
44 |
> > correct ? |
45 |
> > |
46 |
> > Are there any other checks I can do - re-installing the system is not my |
47 |
> > preferred option :) |
48 |
> > |
49 |
> > Dave |
50 |
> |
51 |
> I'm a newbie, so discount this appropriately. |
52 |
> |
53 |
> 1. IIUC, running rkhunter/chkrootkit from knoppix simply checks the |
54 |
> knoppix cd. |
55 |
> 2. You want second/third opinions. IIWU, |
56 |
> i. I'd scan the box with a Trojan signature scanner - e.g. fprotect, |
57 |
> AntiVir, etc. |
58 |
> from Knoppix - first assuring that you have current signatures. |
59 |
> ii. I'd reemerge/recompile the kernel WITHOUT modules or module |
60 |
> support, and clear out your usr/lib/modules (though IIUC, this |
61 |
> can be foiled). |
62 |
> iii. I'd try zeppoo. |
63 |
> 3. Try to figure out how you got it. e.g. you installed software from an |
64 |
> unreliable source; your privileges are screwed up; you have an unpatched |
65 |
> server(s) running; etc. |
66 |
|
67 |
I am pretty picky about my software - have not messed with permissions & its a |
68 |
desktop machine not running any external services. |
69 |
|
70 |
> |
71 |
> Maybe.... you could find the both the vector and the lkm - but |
72 |
> understanding that the only real solution to a |
73 |
> rootkit is restoring from a clean backup, or rebuilding :-( |
74 |
|
75 |
... gulp ... On digging around and listening to you guys I am going to go with |
76 |
a false +ve. My clue came when I discovered how chkrootkit detected the |
77 |
problem ... |
78 |
|
79 |
How accurate is chkproc? |
80 |
If you run chkproc on a server that runs lots of short time processes it |
81 |
could report some false positives. chkproc compares the ps output with |
82 |
the /proc contents. If processes are created/killed during this operation |
83 |
chkproc could point out these PIDs as suspicious. |
84 |
|
85 |
That fits in with the fact that chkrootkit & rkhunter now report clean (& also |
86 |
fits in with someone tinkering from the inside !) |
87 |
|
88 |
I will keep a slightly suspicious eye on the box from now on :) |
89 |
|
90 |
Cheers |
91 |
|
92 |
Dave |
93 |
|
94 |
|
95 |
|
96 |
|
97 |
-- |
98 |
gentoo-user@g.o mailing list |