Re: [gentoo-user] Re: chkrootkit LKM trojan ?

[Dave S <gentoo@pusspaws.net>]

On Monday 17 July 2006 21:35, Hans-Werner Hilse wrote:
> Hi,
>
> On Mon, 17 Jul 2006 19:36:30 +0100
>
> Dave S <gentoo@pusspaws.net> wrote:
> > How accurate is chkproc?
> >  If you run chkproc on a server that runs lots of short time processes it
> > could report some false positives. chkproc compares the ps output with
> > the /proc contents. If processes are created/killed during this operation
> > chkproc could point out these PIDs as suspicious.
> >
> > That fits in with the fact that chkrootkit & rkhunter now report clean (&
> > also fits in with someone tinkering from the inside !)
>
> The problem I see here is that you can't expect chkrootkit to find
> something when scanning from a clean base (Live-CD) when the only hint
> you had was an alert from chkproc. You probably would have gotten the
> alert from chkrootkit in the first place. chkproc inspects the
> currently running system (and the /proc for the currently running
> kernel). I.e. if it has no signature for the rootkit itself, it can't
> find it again from that "clean" kernel.
>
> Do you have the possibility to monitor internet connections on an
> intermediary gateway? I think monitoring it for a few days would give
> you a better hint if there might be something active.
>
> And there are other things to think about. Do you have a webserver
> running?
Nope

> CGI scripts?
Nope

> PHP applications?
Nope

> Do you have other network   
> reachable services?

Nope none outside of my LAN
> > Were you running a firewall?  

Yep - a netgear router firewall, NAT & state aware 
>
> The past kernel bugs had very early exploit scripts. It is really a
> no-brainer to insert a rootkit if something lets you, say, write a
> script to /tmp and call it by exploitable buffer overflows, badly
> written CGI...
>
> And remember that there's (nearly) no possibility for a positive proof
> of the non-existence of a root kit.

I am now seriously considering installing tripwire - To be sure of a clean 
tripwire database I know it means a clean install ... gulp ...

>
> -hwh
-- 
gentoo-user@gentoo.org mailing list