Baslinux mailing list

[sindi keesan <keesan AT sdf.lonestar.org>]

On Sun, 28 Jan 2007 3aoo-cvfd AT dea.spamcon.org wrote:

> sindi keesan wrote:
> > I asked The Answer Gang at Linuxgazette why lpr worked
> > only for user and not root and the discussion drifted
> > to security.  They said to only run as user.
>
> Predictable response.

Yes.  I asked them four years ago for help with mdacon and the dicsussion 
drifted to suid.

Linuxgazette has several articles on security and the editor in chief 
teaches a course on it.

> > I was told to check for things hiding in my files:
>
> Also predictable.
>
> > > > > > Do you monitor the logs?
>
> What logs?  We don't run no logs.

I told them I have /var/log/packages only.

> > > > > > Do you run chkrootkit regularly?
>
> I think a rootkit would find it pretty hard to function
> on BL3.  Still, I suppose, anything's possible.
>
> > ./chkrootkit wanted netstat.
>
> An actual rootkit is going to have the same problem.
> Missing binaries, wrong libraries, 2.2 kernel,

I added netstat.  Should I take it back out?

> > chkrootkit then told me I had six infected files:
> > These are all part of busybox 1.1.0
>
> busybox binaries -- there's another problem for a rootkit.
>
> > compiled statically against uClibc.
>
> And yet another fishhook for the hapless rootkit.
>
> > Are they really infected
>
> I doubt it.  But what do I know?  The guys at the
> Answer Gang are the experts, aren't they?

On standard distributions, anyway.

> > or is uClibc confusing chkrootkit?
>
> That plus all the other nonstandard and unexpected
> features of the BL3 environment.

I tried explaining this to them.  They seemed impressed that I had 1663 
ports all closed except for X (which I usually did not have open).

> > They are not in the typical locations but are on the
> > path in /busybox110.
>
> A directory called busybox110 ???   How did that get
> there?  Did you create it?

Yes, after I compiled that busybox.  I am using that instead of the BL2 
busybox.  It includes echo and su.

> > telnetd and su in this busybox are not infected.
>
> telnetd, oh dear.  Have you been running telnetd while
> online?  If so, that's the perfect entry point for
> installing a rootkit.
No I have not, I just compiled it in case I wanted to play with it offline 
like I did once with in.telnetd and a nullmodem cable.  Have not used it 
since I have NFS to lpay with instead.

> > You have 13  process hidden for ps command
(Regarding LKM Trojan)

> That doesn't sound good.  If true.

This is said to be a bug in chrootkit 'in some systems' which probably was 
fixed for newer systems but not nonstandard ones like ours.

To confirm my hypotheses I booted to ramdisk BL2, which has the original 
(older) busybox, mounted ext2 BL2 and made symlinks to echo and gawk (awk) 
and copied over netstat to /bin, and ran chrootkit from the ext2 
partition.  It found all the same infected files excet that uClibc had not 
managed to infect ifconfig.

I have two new emails about this from TAG.

They say chrootkit is 'stupid' and just does pattern matching, and a 
thread on puppylinux says it does not like busybox.

The permissions on  /postscript/ appear to be set to user only.
We no longer need lpr and it is not secure.

> Cheers,
> Steven