[ SECURITY ] Are they false ?

[trinidad]

Okay friends.

I'm not going to assure someone that their computer is untouched by an incidence of ebury without being in the room with access to the particular box. I realize many here are deeply concerned with security but this thread seems to be headed as usual toward paranoia mode. To sum up again: rkhunter often returns false positives for shm files because it is aware of the newer version of ebury, and also reports obviated file paths, chkrootkit has had the bug in Debian to falsely detect ebury for some time now and is actually somewhat deprecated. I consider Linux itself to be a positive learning experience for anyone who wants to learn about it. The welivesecurity links are full of information which can direct you to the ebury files on your computer if you choose to look for them, which is the best way to be sure if the ebury infection is or is not present on your box. The hacker who invented it is in prison in the US, however newer versions now exist in the wild. It is unlikely that ebury is going away as it is still evolving, but as with all things of this type security people are also continuing to check its progress. The community nature of Linux itself makes successful zero day exploits very difficult to pull off. I cannot say that it is unlikely that a LL user could have contracted ebury, as LL is used in many different ways by many different users, and the likelihood of contracting ebury depends on user praxis. I can say that it is unlikely now that a US user with a broadband ISP (like Spectrum) could contract it unawares as their ISP would notify them, especially if they are looping ssh or samba through their connection.

TC     

[ian_r_h]

I assumed the lwp, java and pulse-shm reports from rkhunter are false positives (I don't use chkrootkit) given that these have occurred immediately after fresh installs of LL followed by rkhunter (and --update) and before Menu/Favourites/Install Updates on 3 different boxes every time; unless my copy of LL 3.6 64bit .iso downloaded from linuxlite.com and rkhunter downloaded via apt-get from the default repo (and different mirrors) were infected to begin with.

These persist even after sudo rkhunter --propupd

Googling found no evidence that these were anything to worry about.

I can't speak as to the rest.

[rokytnji]

No need for rootkit hunter install for me.

Code: [Select]

[email protected]:~
$ groups
harry lp uucp dialout cdrom floppy sudo audio dip video plugdev users netdev lpadmin scanner bluetooth

I already covered "users"

Wanna look for zombies?

Run

Code: [Select]

top
Even if you see 1 or 2 zombies in the readout <it probably means nada>. I see zero on mine.

[bitsnpcs]

@bitsnpcs  What I see are false positives, but to be sure read the documentation and try to locate the files of the infection itself. If they are not there you do not have the ebury rootkit infection. Has a network admin disallowed your use of the LL computer? If so refer him/her to the information I have just given you.

TC

@trinidad what is the documentation you write of , the links?
A Network admin has not disallowed me to use it.
My eldest brother and his wife disallowed me to use it/ told me not to plug it in the ethernet cable to LL machine.

@Vera Thank You for running the test.

[trinidad]

@Vera  Didn't need to do all that. Download and install from synaptic. Run sudo su. Then enter your sudo password and run chkrootkit from root.

TC

[Vera]

@newtusmaximus
Can some members run chkrootkit and rkhunter , (they are in Install/Remove Software, aka Synaptic) and reply back

OK, I installed both. My results from rkhunter are exactly the same as @newtusmaximus .

I tried to run chkrootkit but it says: can't find `awk'
To check if I have it on my system, when I type man awk, it directs me to the man pages for gawk. I then installed traditional awk via Synaptic but when I ran chkrootkit I still got the same message. This is true whether I run chkrootkit as user or as sudo. So, I had to give up on chkrootkit, but wanted to let you know my results of rkhunter as requested.

[trinidad]

@newtusmaximus  /etc/.java is created by OpenJDK. Not to worry and not normally editable. Rkhunter doesn't like it because of the obviated file path /etc/.java/.systemPrefs/.systemRootModFile

TC 

[trinidad]

@bitsnpcs  What I see are false positives, but to be sure read the documentation and try to locate the files of the infection itself. If they are not there you do not have the ebury rootkit infection. Has a network admin disallowed your use of the LL computer? If so refer him/her to the information I have just given you.

TC

[bitsnpcs]

@trinidad  no notifications from isp.
It is having the ethernet cable removed, is not plugged in, I am not allowed to plug it in.
I am using windows computer.

[newtusmaximus]

[Highlights from my rkhunter log  scan of just now


15:50:21] Info: Found file '/usr/sbin/adduser': it is whitelisted for the 'script replacement' check.

[15:50:28] Info: Found file '/usr/bin/ldd': it is whitelisted for the 'script replacement' check.

[15:50:34] Warning: The command '/usr/bin/lwp-request' has been replaced by a script: /usr/bin/lwp-request: a /usr/bin/perl -w script, ASCII text executable

[15:50:40] Info: Found file '/bin/egrep': it is whitelisted for the 'script replacement' check.
[15:50:40]   /bin/fgrep                                      [ OK ]
[15:50:41] Info: Found file '/bin/fgrep': it is whitelisted for the 'script replacement' check.

[15:50:44] Info: Found file '/bin/which': it is whitelisted for the 'script replacement' check.

[15:51:55] Info: Found the 'unhide-tcp' command: /usr/sbin/unhide-tcp

[15:51:58] Info: SCAN_MODE_DEV set to 'THOROUGH'
[15:52:01]   Checking /dev for suspicious file types         [ Warning ]
[15:52:01] Warning: Suspicious file types found in /dev:
[15:52:01]          /dev/shm/pulse-shm-331478974: data
[15:52:01]          /dev/shm/pulse-shm-3524711130: data
[15:52:01]          /dev/shm/pulse-shm-1543249499: data
[15:52:01]          /dev/shm/pulse-shm-1019003171: data
[15:52:01]          /dev/shm/pulse-shm-3173629532: data
[15:52:01]          /dev/shm/pulse-shm-3776217293: data
[15:52:01]          /dev/shm/pulse-shm-1763800836: data
[15:52:01]   Checking for hidden files and directories       [ Warning ]
[15:52:01] Warning: Hidden directory found: /etc/.java

[15:52:07] System checks summary
[15:52:07] =====================
[15:52:07]
[15:52:07] File properties checks...
[15:52:07] Files checked: 150
[15:52:07] Suspect files: 1
[15:52:07]
[15:52:07] Rootkit checks...
[15:52:07] Rootkits checked : 365
[15:52:07] Possible rootkits: 0
[15:52:07]
[15:52:07] Applications checks...
[15:52:07] All checks skipped
[15:52:07]
[15:52:07] The system checks took: 1 minute and 56 seconds
[15:52:07]
[15:52:07] Info: End date is Sat Nov 11 15:52:07 GMT 2017

No idea what the significance of the above is.  help please in laypersons terms .

[trinidad]

If you got the same result with both rootkit checkers it is usually not a false positive however...

https://bugs.launchpad.net/ubuntu/+source/chkrootkit/+bug/1508248

Also have you received a notification from your ISP? Also this particularly involves ssh and other open port usages. To verify what's up on your system, read the documentation, and check for the presence of the malicious files manually. There are many discussions of this on the WWW. If you have the infection best to zero the drive and reinstall, though it can be repaired manually, that is considerably more time consuming and technical. Newer versions of this seem to be leaking out again. The shared memory SHM references in your rkhunter scan are indicative of the newer version of this infection, however the ones you show are for pulse audio so they are most likely a false postive. The operation Windigo entry is a long time bug in chkrootkit.

TC

[newtusmaximus]

chkrootkit - No warning reported.

rkhunter --check   
"System checks summary
=====================

File properties checks...
    Files checked: 150
    Suspect files: 1

Rootkit checks...
    Rootkits checked : 365
    Possible rootkits: 0

Applications checks...
    All checks skipped

The system checks took: 1 minute and 56 seconds

All results have been written to the log file: /var/log/rkhunter.log

One or more warnings have been found while checking the system.
Please check the log file (/var/log/rkhunter.log)

  /usr/bin/whoami                                          [ OK ]
    /usr/bin/gawk                                            [ OK ]
    /usr/bin/lwp-request                                     [ Warning ]
    /usr/bin/s-nail                                          [ OK ]
    /usr/bin/x86_64-linux-gnu-size                           [ OK ]
    /usr/bin/x86_64-linux-gnu-strings                        [ OK ]



  Performing filesystem checks
    Checking /dev for suspicious file types                  [ Warning ]
    Checking for hidden files and directories                [ Warning ]

Folder for chkrootkit  was blank

[newtusmaximus]

Thanks trinidad. Way above my head.
So how vulnerable are we then?

Btsnpscs - will do

[bitsnpcs]

@newtusmaximus the info came from my Linux Lite computer hard drive.
it is the only OS installed on it
it is not networked
no usb stick/ or disc that ever goes on another computer is attached to it.
The only website I visit using that LL computer is this forum
The only update method I use is Install Updates (part of LL).
LL that is installed was download from the main LL website, and MD5 checked before install.
Nobody uses the computer only me, some sit with me some times.

That computer has no wifi, it is physically unplugged from ethernet since the results.

The results are from chkrootkit, and also from rkhunter (root kit hunter) command line tools as recommended in the security section of the Linux Bible 9th Edition (current edition), followed exactly to the letter.

@trinidad thank you for the info and link.

Can some members run chkrootkit and rkhunter , (they are in Install/Remove Software, aka Synaptic) and reply back so I know if this is a overall security issue, such as the hosting company servers used by Linux Lite have been infected and are distributing it to the community,  or it is one directly targeted at me only on LL.

[trinidad]

Here.

https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/

https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/

TC