Skip to Content.
Sympa Menu

baslinux - [BL] chkrootkit, worms, and busybox

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: sindi keesan <keesan AT sdf.lonestar.org>
  • To: baslinux AT lists.ibiblio.org
  • Subject: [BL] chkrootkit, worms, and busybox
  • Date: Sun, 28 Jan 2007 05:15:23 +0000 (UTC)

I asked The Answer Gang at Linuxgazette why lpr worked only for user and not root and the discussion drifted to security. They said to only run as user. nmap showed I had no open ports except X so I put 'su user opera' in the icewm menu.

But I was told to check for things hiding in my files:

Do you monitor the logs? Do you run chkrootkit regularly? Do you
monitor portscans?

I downloaded (about 40K) chkrootkit.tar.gz, unpackaged and typed 'make sense' and it produced chkrootkit and some other files.

./chkrootkit wanted netstat. After a 7 min download (SW7.1) I extracted
it with tar -zxvf tcpicp1.tgz bin/netstat and copied it to /bin.

(I should have done this at the sdf shell account and downloaded only netstat).

chkrootkit then told me I had six infected files:

basename dirname echo env ifconfig and traceroute.

These are all part of busybox 1.1.0 compiled statically against uClibc.
Are they really infected (with what?) or is uClibc confusing chkrootkit?
They are not in the typical locations but are on the path in /busybox110.

telnetd and su in this busybox are not infected.


Checking 'date' ... bash
/bin/csh
INFECTED

(I have a /bin/bash but no csh. Command not found.)

Date is a busybox command.

How do I interpret the above?

Many things it could not find, some it said were not infected.

---------------

Checking 'lkm'...You have 13 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed.

(LKM is loadable kernel module.)

[Online research suggests this is a bug in chkrootkit on some systems.]

no rootkits or worms found...



Chkrootkit uses some commands that are part of busybox: ls ps find cut head set uname id strings, and also awk and netstat. It needs echo, which is in my busybox but not BL2 busybox. I am not set up for compiling in BL3.

I cannot check using the BL2 busybox commands instead (no echo).

Sindi




Archive powered by MHonArc 2.6.24.

Top of Page