lkml.org 
[lkml]   [2011]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
Subjectext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting
From
folks, hi,

i appreciate this was some time ago, but i encountered a quite serious
issue with an ext3 filesystem that had been hacked, and a rootkit
installed. this was with a 2.6.26 kernel. the issue encountered was
that the little fuckers directly modified the ext3 filesystem so that
some files they had created could *not* be deleted. when i say "could
not be deleted" i mean "absolutely could not be deleted". also, fsck
did *not* report any "problems".

and yes, please do give me credit for knowing that you should use a
different system (offline) to analyse the [damaged] filesystem :) as
you can imagine, i was very very surprised to encounter this as an
issue.

first thing: has anyone else encountered this?

second thing: if answer "no" to above, would anyone who can prove
their credentials (public ssh key, public web site, notability blah
blah) like to analyse the 5gb filesystem? i still have a copy (it's
an LVM2 partition on a Xen hosted server).

apart from anything, this really really should go into rkhunter /
chkrootkit, but it requires someone with expertise to actually analyse
what the bloody hell happened. apart from anything, files which
cannot be deleted (and cannot be detected as "corrupted" by fsck.ext3)
is pretty damn serious.

l.


\
 
 \ /
  Last update: 2011-07-25 14:11    [W:0.065 / U:0.324 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site