[SOLVED] /etc has blocks of files with similar timestamps -- hacked?

nachtmsk · 12-16-2020, 09:45 PM

Hi,

I'm looking around an Ubuntu box I have. In /etc I sorted by date and saw blocks of files/dirs with similar or identical timestamps on them.
In the screen shot, there are groups of files/dir with (Nov 18 and Dec 9) similar timestamps.
I know I didn't go in and touch any of those dirs on that date. Is this indication of a hacker or is it more likely just the system doing housekeeping?

Thanks
Nacht

berndbausch · 12-16-2020, 11:52 PM

System update, perhaps? Perhaps your computer is configured to do that automatically.

If you have logs (likely for Dec 9, not quite unlikely for Nov 18), check for activities at those dates. Also logs of failed login attempts.

ondoho · 12-17-2020, 02:50 AM

If I sort the directory listing by time I get a similar picture. I wouldn't worry about it.
When did you install this system? Nov 18?

nachtmsk · 12-17-2020, 08:50 AM

Quote:

Originally Posted by ondoho

If I sort the directory listing by time I get a similar picture. I wouldn't worry about it.
When did you install this system? Nov 18?

Thanks. Now that I think of it, it's quite possible I ran safe_upgrade around that time and installed some security updates.

Nacht