|
Title: Found a hidden process, now what? Post by: check_status on June 19, 2012, 10:25:35 AM Code: WARNING : info.procs changed during test : 366 (was 365) :o I don't know if this is a false positive or if Jynx has evolved. :o Quote Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland' http://7256log.blogspot.com/2011/10/analisis-de-jynx-linux-rootkit.htmlThis kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process. Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx This type of rootkits act injecting a shared library (. So) in all system processes. Quote Jynx Kit Userland Rootkit http://packetstormsecurity.org/files/105893/Jynx-Kit-Userland-Rootkit.htmlAuthored by ErrProne Jynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits. Title: Re: Found a hidden process, now what? Post by: John (John K.) on June 19, 2012, 10:45:30 AM Code: WARNING : info.procs changed during test : 366 (was 365) :o I don't know if this is a false positive or if Jynx has evolved. :o Quote Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland' http://7256log.blogspot.com/2011/10/analisis-de-jynx-linux-rootkit.htmlThis kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process. Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx This type of rootkits act injecting a shared library (. So) in all system processes. Quote Jynx Kit Userland Rootkit http://packetstormsecurity.org/files/105893/Jynx-Kit-Userland-Rootkit.htmlAuthored by ErrProne Jynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits. Title: Re: Found a hidden process, now what? Post by: Rugatu on June 19, 2012, 11:06:02 AM Code: WARNING : info.procs changed during test : 366 (was 365) :o I don't know if this is a false positive or if Jynx has evolved. :o Quote Gradually the Linux kernel has evolved and doing quite more complex work to modify it to those ends, so currently the most effective way to install a rootkit on a Linux system is to go towards the 'userland' http://7256log.blogspot.com/2011/10/analisis-de-jynx-linux-rootkit.htmlThis kind of rootkits there are two types , or which change the typical binary system associated information (ps and friends) and more sophisticated rootkits inject a library in the process. Have long existed rootkits acting that way, but had remained somewhat hidden, relatively recently has released a fully functional implementation of a rootkit capable of infecting a Linux system today, his name: Jynx This type of rootkits act injecting a shared library (. So) in all system processes. Quote Jynx Kit Userland Rootkit http://packetstormsecurity.org/files/105893/Jynx-Kit-Userland-Rootkit.htmlAuthored by ErrProne Jynx Kit is a LD_PRELOAD userland rootkit. Fully undetectable from chkrootkit and rootkithunter. Includes magic packet SSL reverse back connect shell. Solid building block for further LD_PRELOAD rootkits. According to your first link, the text in Spanish says: Quote En resumen, lo que hacen este tipo de rootkits es añadir una línea en el fichero /etc/ld.so.preload apuntando hacia la librería del rootkit en la que se encuentran 're-escritas' ciertas funciones asociadas a la obtención de información del sistema. Which translates to: Quote In summary, what these kind of rootkits do is write a new line in "/etc/ld.so.preload" pointing to the rootkit's library, in which you can find rewritten certain system info functions. So in order to "unhook" it you would have to manually edit that file and remove any strange .so libs you encounter. Code: sudo nano /etc/ld.so.preload Title: Re: Found a hidden process, now what? Post by: check_status on June 19, 2012, 09:41:41 PM Well, either the file is empty or it's contents are hidden. :D
Title: Re: Found a hidden process, now what? Post by: dooglus on June 20, 2012, 02:23:08 AM The rootkit would make that file appear to be normal; that's what they do.
If you can boot from a known-good live CD then you'll be able to mount your root partition and see how that file really looks, before the rootkit has a chance to run and start masking itself. Title: Re: Found a hidden process, now what? Post by: Raoul Duke on June 20, 2012, 03:49:49 AM This is the usual fix for windows computers but I heard it also works on linux
http://www.youtube.com/watch?v=4JJsy4ABHkA Title: Re: Found a hidden process, now what? Post by: check_status on June 21, 2012, 02:37:13 AM Something not correct is occuring, my auto updater, Ubuntu 11.04 64bit, is asking me to update a language pack, I don't have Firefox, and Firefox isn't present on the entire network. :o
Title: Re: Found a hidden process, now what? Post by: check_status on June 23, 2012, 07:07:12 AM The rootkit would make that file appear to be normal; that's what they do. I'm going to have to do this for sure. All of the Linux tools I've used are coming up empty, top and the like, yet the system responds as if it is overloaded by too many processes.If you can boot from a known-good live CD then you'll be able to mount your root partition and see how that file really looks, before the rootkit has a chance to run and start masking itself. When I do this, strace, I found out why there is nothing in ld.so.preload ;D : Code: access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)still looking... Edit: RKH {Warning} Is this bad? Code: Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable Title: Re: Found a hidden process, now what? Post by: Rugatu on June 23, 2012, 10:27:53 AM The rootkit would make that file appear to be normal; that's what they do. I'm going to have to do this for sure. All of the Linux tools I've used are coming up empty, top and the like, yet the system responds as if it is overloaded by too many processes.If you can boot from a known-good live CD then you'll be able to mount your root partition and see how that file really looks, before the rootkit has a chance to run and start masking itself. When I do this, strace, I found out why there is nothing in ld.so.preload ;D : Code: access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)still looking... Edit: RKH {Warning} Is this bad? Code: Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable Yes, that looks really bad! Re-install your OS before it's too late. Title: Re: Found a hidden process, now what? Post by: Bitsky on June 23, 2012, 10:59:43 AM While I don't want to stop anybody from doing whatever they want because they assume something is wrong, it would be a good idea to invest a little time into research, since that is faster and more reliable than blindly formatting, especially since rkhunter generates false positives too.
http://askubuntu.com/questions/1537/rkhunter-warning-about-etc-java-etc-udev-etc-initramfs Also, on Ubuntu there should be debsums which can be used to verify packages. Of course you can always reinstall, but you'll get the same messages again. Title: Re: Found a hidden process, now what? Post by: check_status on June 23, 2012, 12:59:37 PM Yes, I have been able to see the scripts which appear to be legitimate, therefore, must be false positives from RKH.
I'm now back to where I was before I downloaded, installed and misconfigured RKH. :-\ I'll poke around with a manufactured Live CD some and try to discover what the fuzz. Would OSSEC HIDS be of value to see what the fuzz is happening? Title: Re: Found a hidden process, now what? Post by: Foxpup on June 23, 2012, 01:02:15 PM The rootkit would make that file appear to be normal; that's what they do. I'm going to have to do this for sure. All of the Linux tools I've used are coming up empty, top and the like, yet the system responds as if it is overloaded by too many processes.If you can boot from a known-good live CD then you'll be able to mount your root partition and see how that file really looks, before the rootkit has a chance to run and start masking itself. When I do this, strace, I found out why there is nothing in ld.so.preload ;D : Code: access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)still looking... Edit: RKH {Warning} Is this bad? Code: Warning: The command '/usr/sbin/adduser' has been replaced by a script: /usr/sbin/adduser: a /usr/bin/perl script text executable Yes, that looks really bad! Re-install your OS before it's too late. ::) It's perfecty normal. My known-good MEPIS 11 installation has exactly the same setup: Code: $ file /usr/sbin/adduser /usr/bin/ldd /usr/bin/lwp-request /bin/which My known-good Debian installation is identical except it does not have /dev/.initramfs or /dev/.initramfs-tools: Code: $ file /usr/sbin/adduser /usr/bin/ldd /usr/bin/lwp-request /bin/which Title: Re: Found a hidden process, now what? Post by: check_status on June 23, 2012, 01:18:49 PM Thanks foxpup for the confirmation.
Something not correct is occuring, my auto updater, Ubuntu 11.04 64bit, is asking me to update a language pack, I don't have Firefox, and Firefox isn't present on the entire network. :o Quote EvilGrade is a framework which the exploits weaknesses in the auto-update services of multiple common software packages and the attack performed by this framework is one of the best example for client exploitation. This framework tricks the service into believing there is a signed update available for the product, thus prompting the user to install the upgrade where the upgrade is the attacker’s payload. This type of attack is a bit difficult for a normal user to detect since they don’t see anything suspicious and the upgrade looks legitimate. http://resources.infosecinstitute.com/hacking-autoupdate-evilgrade/We can use this framework with the combination of DNS spoofing or Man-in-the-middle attack in order to spoof the software upgrade. This therefore tricks the victim into downloading the upgrade, thereby executing our malicious arbitrary code. The EvilGrade supports various famous software like Notepad, iTunes, Java plug-in, WinZip, Winamp, DAP, OpenOffices, LinkedIn, Speedbit, etc. Evilgrade takes the advantage of various applications because most of these verify neither the update contents nor the master update server. Basically, in this type of attack, the attacker seeks to modify the DNS traffic of the victim and return them to some other ip address controlled by the attacker. Title: Re: Found a hidden process, now what? Post by: Rugatu on June 23, 2012, 01:26:47 PM Thanks check_status, is true that every day we learn something new :)
Title: Re: Found a hidden process, now what? Post by: check_status on June 24, 2012, 02:15:54 AM If Firefox had been installed, and the update appearing to be legitimate, Ubuntu's 'update-notifier' application, I would have clicked it, even though it was only a language pack available for update. It's also entirely possible I already installed some malware because of this EvilGrade method. :'(
How can you determine what IP's update-notifier is providing the update from? Is it possible to force the sources.list addresses to use a host file instead of DNS? Can tzdata be removed from Ubuntu without breaking it's ability to function? Title: Re: Found a hidden process, now what? Post by: Rugatu on June 24, 2012, 03:40:37 AM If Firefox had been installed, and the update appearing to be legitimate, Ubuntu's 'update-notifier' application, I would have clicked it, even though it was only a language pack available for update. It's also entirely possible I already installed some malware because of this EvilGrade method. :'( How can you determine what IP's update-notifier is providing the update from? Is it possible to force the sources.list addresses to use a host file instead of DNS? Can tzdata be removed from Ubuntu without breaking it's ability to function? If you put at least one of those questions on Rugatu (http://www.rugatu.com) you will really make some bitcoiners happy ::) Title: Re: Found a hidden process, now what? Post by: Foxpup on June 24, 2012, 04:07:52 AM Is it possible to force the sources.list addresses to use a host file instead of DNS? I'm pretty sure the hosts file is always prefered over the network's DNS server anyway, though this probably can't be relied upon if you suspect a rootkit. You can, however, put the repo's IP address directly in the sources.list file, eg: Code: deb ftp://130.89.148.12/debian/ squeeze main contrib non-free Can tzdata be removed from Ubuntu without breaking it's ability to function? No. What's tzdata got to do with anything anyway?Title: Re: Found a hidden process, now what? Post by: check_status on June 24, 2012, 06:04:53 AM Is it possible to force the sources.list addresses to use a host file instead of DNS? I'm pretty sure the hosts file is always prefered over the network's DNS server anyway, though this probably can't be relied upon if you suspect a rootkit. You can, however, put the repo's IP address directly in the sources.list file, eg: Code: deb ftp://130.89.148.12/debian/ squeeze main contrib non-free Can tzdata be removed from Ubuntu without breaking it's ability to function? No. What's tzdata got to do with anything anyway?I had strange behavior appear, after wipe and reinstalls, only after the very first internet connection, which seemed to affect, gnome, network-manager and screensaver, (affected in that order). My internal domain would change to a blackberry ID. No internet connectivity after installation and gnome, network-manager, screensaver did not wig out and the internal domain name did not change. Because of this, I thought the possible infection is occurring through some first connect event, DNS or first outbound connecting program after the network is up. I eliminated ntpd and bluez before first connect and the issues still occurred. Outside of tzdata and DNS I'm not aware of what else could be contributing to this behavior. Title: Re: Found a hidden process, now what? Post by: Foxpup on June 24, 2012, 08:17:03 AM tzdata, is one of a small list of programs that is allowed complete internet access through all IDS and firewalls. What are you talking about? tzdata is a collection of data files (as the name suggests), and contains no programs. The only executable file related to it (tzconfig) is actually just a shell script consisting entirely of an echo command displaying installation instructions. Nothing related to tzdata should be accessing the network in any way, and you can safely delete any executable files related to it.Title: Re: Found a hidden process, now what? Post by: check_status on June 25, 2012, 02:28:04 AM tzdata, is one of a small list of programs that is allowed complete internet access through all IDS and firewalls. What are you talking about? tzdata is a collection of data files (as the name suggests), and contains no programs. The only executable file related to it (tzconfig) is actually just a shell script consisting entirely of an echo command displaying installation instructions. Nothing related to tzdata should be accessing the network in any way, and you can safely delete any executable files related to it.pcap: Will pcap files gathered from/on a system that may be infected provide useful data? I don't have a switch that can do port mirroring so what methods would help me to overcome this limitation? |