[BL] chkrootkit, worms, and busybox
sindi keesan
keesan at sdf.lonestar.org
Sun Jan 28 00:15:23 EST 2007
I asked The Answer Gang at Linuxgazette why lpr worked only for user and
not root and the discussion drifted to security. They said to only run as
user. nmap showed I had no open ports except X so I put 'su user opera'
in the icewm menu.
But I was told to check for things hiding in my files:
>>>> Do you monitor the logs? Do you run chkrootkit regularly? Do you
>>>> monitor portscans?
I downloaded (about 40K) chkrootkit.tar.gz, unpackaged and typed 'make
sense' and it produced chkrootkit and some other files.
./chkrootkit wanted netstat. After a 7 min download (SW7.1) I extracted
it with tar -zxvf tcpicp1.tgz bin/netstat and copied it to /bin.
(I should have done this at the sdf shell account and downloaded only
netstat).
chkrootkit then told me I had six infected files:
basename dirname echo env ifconfig and traceroute.
These are all part of busybox 1.1.0 compiled statically against uClibc.
Are they really infected (with what?) or is uClibc confusing chkrootkit?
They are not in the typical locations but are on the path in /busybox110.
telnetd and su in this busybox are not infected.
Checking 'date' ... bash
/bin/csh
INFECTED
(I have a /bin/bash but no csh. Command not found.)
Date is a busybox command.
How do I interpret the above?
Many things it could not find, some it said were not infected.
---------------
Checking 'lkm'...You have 13 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed.
(LKM is loadable kernel module.)
[Online research suggests this is a bug in chkrootkit on some systems.]
no rootkits or worms found...
Chkrootkit uses some commands that are part of busybox: ls ps find cut
head set uname id strings, and also awk and netstat. It needs echo, which
is in my busybox but not BL2 busybox. I am not set up for compiling in
BL3.
I cannot check using the BL2 busybox commands instead (no echo).
Sindi
More information about the BasLinux
mailing list