Skip to Content.
Sympa Menu

baslinux - Re: [BL] chkrootkit, worms, and busybox

baslinux AT lists.ibiblio.org

Subject: Baslinux mailing list

List archive

Chronological Thread  
  • From: sindi keesan <keesan AT sdf.lonestar.org>
  • To: baslinux AT lists.ibiblio.org
  • Subject: Re: [BL] chkrootkit, worms, and busybox
  • Date: Sun, 28 Jan 2007 16:25:40 +0000 (UTC)

On Sun, 28 Jan 2007 3aoo-cvfd AT dea.spamcon.org wrote:

sindi keesan wrote:

I asked The Answer Gang at Linuxgazette why lpr worked
only for user and not root and the discussion drifted
to security. They said to only run as user.

Predictable response.

Yes. I asked them four years ago for help with mdacon and the dicsussion drifted to suid.

Linuxgazette has several articles on security and the editor in chief teaches a course on it.

I was told to check for things hiding in my files:

Also predictable.

Do you monitor the logs?

What logs? We don't run no logs.

I told them I have /var/log/packages only.

Do you run chkrootkit regularly?

I think a rootkit would find it pretty hard to function
on BL3. Still, I suppose, anything's possible.

./chkrootkit wanted netstat.

An actual rootkit is going to have the same problem.
Missing binaries, wrong libraries, 2.2 kernel,

I added netstat. Should I take it back out?

chkrootkit then told me I had six infected files:
These are all part of busybox 1.1.0

busybox binaries -- there's another problem for a rootkit.

compiled statically against uClibc.

And yet another fishhook for the hapless rootkit.

Are they really infected

I doubt it. But what do I know? The guys at the
Answer Gang are the experts, aren't they?

On standard distributions, anyway.

or is uClibc confusing chkrootkit?

That plus all the other nonstandard and unexpected
features of the BL3 environment.

I tried explaining this to them. They seemed impressed that I had 1663 ports all closed except for X (which I usually did not have open).

They are not in the typical locations but are on the
path in /busybox110.

A directory called busybox110 ??? How did that get
there? Did you create it?

Yes, after I compiled that busybox. I am using that instead of the BL2 busybox. It includes echo and su.

telnetd and su in this busybox are not infected.

telnetd, oh dear. Have you been running telnetd while
online? If so, that's the perfect entry point for
installing a rootkit.
No I have not, I just compiled it in case I wanted to play with it offline like I did once with in.telnetd and a nullmodem cable. Have not used it since I have NFS to lpay with instead.

You have 13 process hidden for ps command
(Regarding LKM Trojan)


That doesn't sound good. If true.

This is said to be a bug in chrootkit 'in some systems' which probably was fixed for newer systems but not nonstandard ones like ours.

To confirm my hypotheses I booted to ramdisk BL2, which has the original (older) busybox, mounted ext2 BL2 and made symlinks to echo and gawk (awk) and copied over netstat to /bin, and ran chrootkit from the ext2 partition. It found all the same infected files excet that uClibc had not managed to infect ifconfig.

I have two new emails about this from TAG.

They say chrootkit is 'stupid' and just does pattern matching, and a thread on puppylinux says it does not like busybox.

The permissions on /postscript/ appear to be set to user only.
We no longer need lpr and it is not secure.

Cheers,
Steven




Archive powered by MHonArc 2.6.24.

Top of Page