Welcome to Linux Forums! With a comprehensive Linux Forum, information on various types of Linux software and many Linux Reviews articles, we have all the knowledge you need a click away, or accessible via our knowledgeable members.
A customer of mine called me today and told me he thought his Linux FC 2 system was hacked. His dedicated server provider informed him of DOS attacks originating from his machine going outbound to ports 53 and 6667 to varied IPs. Investigation revealed the server was compromised nearly two weeks ago. When I got on the box I ran top and ps, both of which gave me this odd output:
Unknown HZ value! (75) Assume 100.
Running rkhunter revealed that rootkits SHV4 and SHV5 had most likely been installed. Further investigation revealed the following files to have been modified or installed by the hacker:
The files cannot be removed in any way. I've even tried copying unlink from an unaffected host but with no luck.
[root@XXXXXX]# ls -l /bin/ps
-rwxr-xr-x 1 122 114 62920 Jan 27 2005 /bin/ps
[root@XXXXXX]# /tmp/unlink /bin/ps
/tmp/unlink: cannot unlink `/bin/ps': Operation not permitted
[root@XXXXXX ]# chown root /bin/ps
chown: changing ownership of `/bin/ps': Operation not permitted
Adding a user to the system with UID 122 and trying to perform operations as that user avails nothing either. Perhaps someone here will know how to remove the files from the inode level. (We are going to re-image the server so we don't really need to delete the files, but as a Linux administrator it's very frustrating when you can delete a file as the root user). Or perhaps someone has had a similiar experience. Or perhaps the perpetrator will pick this up in a google search and get (in whatever weird, perverted way) the satisfaction he so desperately needs.
The command chattr can be used to change the fundamental attributes of the file. The attribut that has probably been set by the hacker is the immutable attribute, this will prevent the file from being deleted or moved.
Personally, I would do what you are doing and just wipe the system clean.
I will second that. And get the rebuilt system up to date - I am not sure how the FC releases work exactly, but don't they have a newer "stable" version than FC2 by now?
You also might consider creating an image / backup of the compromised system. This will let you:
* Study it to try to determine how the compromise occurred.
* Determine whether important data may have been stolen or altered.
* Maintain evidence for potentially pressing charges.
If you do not back it up before wiping it clean you lose evidence and may or may not learn anything from the compromise.
I also support getting a new system up and running, but I would have to say if you need to modify these files try doing it with a live disc, where the system will be offline and you can work more easily.
Probably better that you rebuild, though kudos on locating the modified files.
A Complete Beginner's Manual for Ubuntu 10.04 (Lucid Lynx)
Getting Started with Ubuntu 10.04 (Lucid Lynx) is a comprehensive beginners guide for the Ubuntu operating system; it features comprehensive guides, How Tos and information on anything you need to know after first installing Ubuntu. subscribe
The Incredible Guide to NEW Ubuntu (Karmic Koala)
There are a lot of people still stuck with Windows because it's the ‘easier alternative'. Linux is both cheaper and more versatile than Microsoft's operating system, but the learning curve has frightened off many people. subscribe
The GNU/Linux Advanced Administration
The GNU/Linux systems have reached an important level of maturity, allowing to integrate them in almost any kind of work environment, from a desktop PC to the sever facilities of a big company. subscribe
A Newbie's Getting Started Guide to Linux
Learn the basics of the Linux operating systems. Get to know what it is all about, and familiarize yourself with the practical side. Basically, if you're a complete Linux newbie and looking for a quick and easy guide to get you started this is it. subscribe
Linux Security Discussion about keeping your machines secure, and the crackers out.
Submit Your Article
Latest Articles
Linear Mode
