Skip to Content.
Sympa Menu

baslinux - Re: [BL] chkrootkit, worms, and busybox

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: 3aoo-cvfd AT dea.spamcon.org
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] chkrootkit, worms, and busybox
  • Date: Sun, 28 Jan 2007 21:58:54 +1300

sindi keesan wrote:
>
> I asked The Answer Gang at Linuxgazette why lpr worked
> only for user and not root and the discussion drifted
> to security. They said to only run as user.

Predictable response.

> I was told to check for things hiding in my files:

Also predictable.

> >>>> Do you monitor the logs?

What logs? We don't run no logs.

> >>>> Do you run chkrootkit regularly?

I think a rootkit would find it pretty hard to function
on BL3. Still, I suppose, anything's possible.

> ./chkrootkit wanted netstat.

An actual rootkit is going to have the same problem.
Missing binaries, wrong libraries, 2.2 kernel,

> chkrootkit then told me I had six infected files:
> These are all part of busybox 1.1.0

busybox binaries -- there's another problem for a rootkit.

> compiled statically against uClibc.

And yet another fishhook for the hapless rootkit.

> Are they really infected

I doubt it. But what do I know? The guys at the
Answer Gang are the experts, aren't they?

> or is uClibc confusing chkrootkit?

That plus all the other nonstandard and unexpected
features of the BL3 environment.

> They are not in the typical locations but are on the
> path in /busybox110.

A directory called busybox110 ??? How did that get
there? Did you create it?

> telnetd and su in this busybox are not infected.

telnetd, oh dear. Have you been running telnetd while
online? If so, that's the perfect entry point for
installing a rootkit.

> You have 13 process hidden for ps command

That doesn't sound good. If true.

Cheers,
Steven




Archive powered by MHonArc 2.6.24.

Top of Page