Hacked or not ?

pr...@pro.sk

unread,

Jun 12, 2004, 7:29:25 AM6/12/04

to

Hi all,

please advice me - I was on holidays for one week. After return I found in
security mails from router (chkrootkit) following message:
Checking `lkm'... You have 1 process hidden for readdir command
You have 1 process hidden for ps command
Warning: Possible LKM Trojan installed

It apeared only onece. From previous and next days reports, the message is
not present.

How could I be sure, the machine is not hacked ?

Many thanks for any response.

Peter Rosa

_______________________________________________
freebsd-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-securi...@freebsd.org"

lu...@lupe-christoph.de

unread,

Jun 12, 2004, 8:04:11 AM6/12/04

to

On Saturday, 2004-06-12 at 13:15:33 +0200, Peter Rosa wrote:

> please advice me - I was on holidays for one week. After return I found in
> security mails from router (chkrootkit) following message:
> Checking `lkm'... You have 1 process hidden for readdir command
> You have 1 process hidden for ps command
> Warning: Possible LKM Trojan installed

> It apeared only onece. From previous and next days reports, the message is
> not present.

This is an artifact. chkrootkit uses two methods to look at the running
processes - ps and /proc. When a process terminates between the two
runs, you will get this. I see it at irregular intervals on all my
machines that run chkrootkit.

But if your machine is critical, running chkrootkit once daily is not
enough. This gives a cracker too much time to nest in. Run it at least
every hour.

Are you running an integrity checker like AIDE, Tripwire, etc?

> How could I be sure, the machine is not hacked ?

You can't. Not in general. chkrootkit goes only so far. Always assume
the worst. But don't panick.

HTH,
Lupe Christoph

PS: Flames that this is not a security help mailing list to /dev/null,
please. If you want to flame me, put the energy into creating a
freebsd-security-help mailing list instead.
--
| lu...@lupe-christoph.de | http://www.lupe-christoph.de/ |
| "... putting a mail server on the Internet without filtering is like |
| covering yourself with barbecue sauce and breaking into the Charity |
| Home for Badgers with Rabies. Michael Lucas |

tar...@webmail.sub.ru

unread,

Jun 12, 2004, 10:08:15 AM6/12/04

to

On Sat, 12 Jun 2004 14:39:21 +0200
"Peter Rosa" <pr...@pro.sk> wrote:

PR> But what about the /var/log/messages logs absence ?
PR> And, how to test the machine, if it is healthy ?

Boot from CD and compare md5 checksums on system files. That's the first step.

Compare your kernel sources with clean ones, rebuild kernel and compare it with the running one. If you're running GENERIC, compare it with the distributed one.

Compare /modules directory with distribution one.

Check your (and system) .profile or .login etc.

After this step, you should have reasonably clean system.

--
Alex.

a...@wnet.ua

unread,

Jun 13, 2004, 12:17:56 PM6/13/04

to

On Sat, Jun 12, 2004 at 05:50:35PM +0400, Alex Povolotsky wrote:
> On Sat, 12 Jun 2004 14:39:21 +0200
> "Peter Rosa" <pr...@pro.sk> wrote:
>
> PR> But what about the /var/log/messages logs absence ?
> PR> And, how to test the machine, if it is healthy ?
>
> Boot from CD and compare md5 checksums on system files. That's the first step.

I'm running a frequent script, evaluating md5 for binaries, libs
etc, and reports isn't something changed

--
AY7-UANIC || AY15-RIPE