[lkml]   [2001]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    > As it turns out, the extraneous '..' is actually a file. I did a rm ..*,
    > which left the original .. directory alone but removed the .. file. Did a
    > e2fsck on reboot, no problems found.

    Yes, good to remove the file, but now my main concern is that your system
    may have been compromised as the old ".." dir-not-really file entry may
    have other connotations. It is definately a possibility of a cracked
    system (as the .. file appears in many new r00tkit type exploits.) i would
    do some extensive forensics on the machine in question. are there new
    entries in /etc/passwd or /etc/shadow that shouldn't be there?

    DISCLAIMER - I am not insisting your machine was compromised, but why be
    lax about it? Check the system in every way possible to determine if
    someone has cracked and installed a r00tkit on your box. just getting rid
    of the single .. entry may not be enough. look for other suspicious
    files, keep copies of them before deleting the ones available to the
    public in /lib or /usr or whatever, and check out any suspicious files
    that were created/modified/accessed in the same window (5 or 6 minuites)
    as the double .. entry in /lib

    it sounds to me like someone MAY have been trying to replace system lib
    files, or even perhaps load malicious kernel code in modules. at my job,
    this system would be immediately taken off the 'production line' until a
    thorough examination/investigation can be done. check logins around the
    ctime of the original .. creation and compare with who was logged in etc

    this may be nothing, it may be a nasty kernel bug, or it may be malicious
    hackers attampting to pull the wool over your eyes.

    be PARANOID in any situation in which your machine MAY have been
    compromised and persue the forensic evidence until you hit a titanium
    wall (a brick wall can be easily broken down).

    If you have no idea where to go from here, send me email logs of what has
    been found and i will give it my best shot at determining whether this is
    a kernel bug (which i would assume would've been caught and dealt with by
    now), or a nasty attack involving a rootkit, so the 'attackers' can regain
    access to the system.

    Start with "netstat --inet -a" and see if you find any open ports that
    shouldn't be open. That would be the first indication of a rootkit that
    allows the rootkitter (person installing the rootkit) to regain access to
    the system even after it has been 'locked down'.

    rootkits are well know for leaving SEVERAL backdoors so that if one is
    found, the attacker still has multiple ways to re-enter and re-penetrate
    the system.

    J Troy Piper

    PS - sorry about the FUD slam about 'the evil cracker' but we all know
    they DO exist, and the weaker the admin, the easier it is to take
    advantage of the systems under the admin's control.

    [unhandled content-type:application/pgp-signature]
     \ /
      Last update: 2005-03-22 12:57    [W:0.022 / U:17.336 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site