lkml.org 
[lkml]   [2003]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: TID/PID handling and possible rootkit
    David's analysis is pretty much right on.

    On Fri, Feb 28, 2003 at 09:24:37PM +0100, Felipe Alfaro Solana wrote:
    > Hello!
    >
    > This is a message forwarded from Red Hat's Phoebe (8.1) Linux
    > Beta. It seems that some of us, when running "chkrootkit" rootkit
    > checker, are getting consistent errors complaining that we have
    > hidden processes from the "ps" command and "procfs".
    >
    > Can you please help us disguise what's happening?
    > If so, keep reading :-)
    >
    > ----- Original Message -----
    > From: David McKellar <djmcke@yahoo.com>
    > Date: Fri, 28 Feb 2003 09:33:15 -0800 (PST)
    > To: phoebe-list@redhat.com
    > Subject: Re: chkrootkit on phoebe
    >
    > > It says I have LKM also:
    > >
    > > Checking `lkm'... You have 12 process hidden for readdir command
    > > You have 12 process hidden for ps command
    > > Warning: Possible LKM Trojan installed
    > >
    > > My system is on the net all the time so it could very well be infected.
    >
    > I have done some research and this is what I've found:
    >
    > Recompiling (get paranoid) chkrootkit creates a separate binary called
    > "chkproc" that allows you to search for hidden processes. Running
    > "chkproc -v" on my system reveals this:
    >
    > ID 1364: not in readdir output
    > PID 1364: not in ps output
    > PID 1365: not in readdir output
    > PID 1365: not in ps output
    > PID 1366: not in readdir output
    > PID 1366: not in ps output
    > You have 3 process hidden for readdir command
    > You have 3 process hidden for ps command
    >
    > My computer is behind a firewall that filters all ports < 1023 and I'm a
    > very paranoic person, so I really doubt I have got infected by a trojan.
    >
    > In my case, I've found the culprit to be "Evolution": while running
    > Evolution, there are 3 or more processes not being displayed by the
    > "ps" command, or even listed under "/proc., but they are accessible by
    > "cd"-ing to them. If I quit "Evolution", running "./chkproc -v" again does
    > not generate those warnings.
    >
    > I think this is related to changes in PID/TID handling by recent kernels.
    > If my memory serves me well, each thread of a process is given a
    > unique ID (the Thread ID) which is assigned from the same pool as the
    > PID, so, there was a time when you could see threads from the output
    > of the "ps" command. I think this behaviour has changed, and now, you
    > can't directly see threads by using "ps" or reading from "/proc". However,
    > the TID number is still reserved from the same pool as PIDs, although
    > it won't be listed in "/proc". For whatever reason it be, it seems that "procfs"
    > still allows one to "cd" to the directory entry of a thread by using the
    > Thread ID (TID), so this could be the culprit of the problem. Since
    > "chkproc" tries "cd"-ing the hard way into all possible combinations of
    > directories from within "/proc", "chkproc" is in fact "seeing" was should be
    > hidden: the entries for threads.
    >
    > This problem is reproducible on 2.4.20-2.54 and 2.5.63-mm1.
    >
    > Can any kernel guru help us here? Am we right? Are we infected?
    >
    > Thanks!
    >
    > Felipe Alfaro Solana
    >
    > --
    > ______________________________________________
    > http://www.linuxmail.org/
    > Now with e-mail forwarding for only US$5.95/yr
    >
    > Powered by Outblaze
    > -
    > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    > the body of a message to majordomo@vger.kernel.org
    > More majordomo info at http://vger.kernel.org/majordomo-info.html
    > Please read the FAQ at http://www.tux.org/lkml/
    >

    --
    Daniel Jacobowitz
    MontaVista Software Debian GNU/Linux Developer
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:33    [W:0.027 / U:0.872 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site