Possible LKM Trojan Installed

Tons of Fun · 11-07-2005, 06:39 PM

Hello everyone. I am a regular in the Debian forums, but this is my first post in the security forums. I hope I include enough info. I am running Debian Etch with a custom kernel - 2.6.8-2.6.8-2.686, and I'm on a wireless network. About a month ago I installed chkrootkit. It's daily reports didn't show anything unusual. Then I got the following report:

/etc/cron.daily/chkrootkit:

//usr/lib/j2se/1.4/jre/.systemPrefs /usr/lib/j2se/1.4/jre/.systemPrefs/.systemRo$/usr/lib/j2se/1.4/jre/.systemPrefs
You have 2 process hidden for readdir command
You have 2 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed
ath0: PACKET SNIFFER(/sbin/dhcpcd-bin[3127])

I ran netstat and got the following report:

hank@neuromancer:~$ netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost.localdom:1026 localhost.localdom:1024 ESTABLISHED
tcp 0 0 localhost.localdom:1024 localhost.localdom:1026 ESTABLISHED
tcp 0 0 localhost.localdom:4300 localhost.localdoma:ipp ESTABLISHED
tcp 1 0 localhost.localdom:3297 localhost.localdoma:ipp CLOSE_WAIT
tcp 0 0 192.168.1.103:4410 64.233.161.147:www ESTABLISHED
tcp 0 0 localhost.localdoma:ipp localhost.localdom:4300 ESTABLISHED
tcp 0 0 192.168.1.103:4415 83.138.190.203:www ESTABLISHED
Active UNIX domain sockets (w/o servers)
Proto RefCnt Flags Type State I-Node Path
unix 2 [ ] DGRAM 6014 @/var/run/hal/hotplug_socket
unix 2 [ ] DGRAM 1461 @udevd
unix 7 [ ] DGRAM 5864 /dev/log
unix 3 [ ] STREAM CONNECTED 957295 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 957294
unix 3 [ ] STREAM CONNECTED 957279 /tmp/orbit-hank/linc-2c0a-0-7e0377ccc8d6
unix 3 [ ] STREAM CONNECTED 957278
unix 3 [ ] STREAM CONNECTED 957275 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 957274
unix 3 [ ] STREAM CONNECTED 957266 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 957265
unix 3 [ ] STREAM CONNECTED 759626
unix 3 [ ] STREAM CONNECTED 759625
unix 3 [ ] STREAM CONNECTED 759623 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 759622
unix 3 [ ] STREAM CONNECTED 759618 /tmp/orbit-hank/linc-d71-0-34fba967bcf19
unix 3 [ ] STREAM CONNECTED 759617
unix 3 [ ] STREAM CONNECTED 759615 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 759614
unix 3 [ ] STREAM CONNECTED 759613 /tmp/orbit-hank/linc-d71-0-34fba967bcf19
unix 3 [ ] STREAM CONNECTED 759612
unix 3 [ ] STREAM CONNECTED 759609 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 759608
unix 3 [ ] STREAM CONNECTED 759606 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 759605
unix 3 [ ] STREAM CONNECTED 759600 /tmp/.X11-unix/X0
unix 5 [ ] STREAM CONNECTED 759599
unix 3 [ ] STREAM CONNECTED 557492 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 557491
unix 3 [ ] STREAM CONNECTED 557485 /tmp/orbit-hank/linc-651e-0-4873e6a071613
unix 3 [ ] STREAM CONNECTED 557484
unix 3 [ ] STREAM CONNECTED 557481 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 557480
unix 3 [ ] STREAM CONNECTED 557478 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 557477
unix 3 [ ] STREAM CONNECTED 557471 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 557470
unix 3 [ ] STREAM CONNECTED 486710 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 486709
unix 3 [ ] STREAM CONNECTED 7707 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7706
unix 3 [ ] STREAM CONNECTED 7705 /tmp/.X11-unix/X0
unix 4 [ ] STREAM CONNECTED 7704
unix 3 [ ] STREAM CONNECTED 7695 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7694
unix 3 [ ] STREAM CONNECTED 7530 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7529
unix 3 [ ] STREAM CONNECTED 7528 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7527
unix 3 [ ] STREAM CONNECTED 7526 /tmp/orbit-hank/linc-10a0-0-79d4f94b998e6
unix 3 [ ] STREAM CONNECTED 7525
unix 3 [ ] STREAM CONNECTED 7520 /tmp/orbit-hank/linc-10a0-0-79d4f94b998e6
unix 3 [ ] STREAM CONNECTED 7519
unix 3 [ ] STREAM CONNECTED 7518 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7517
unix 3 [ ] STREAM CONNECTED 7516 /tmp/orbit-hank/linc-10a0-0-79d4f94b998e6
unix 3 [ ] STREAM CONNECTED 7515
unix 3 [ ] STREAM CONNECTED 7512 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7511
unix 3 [ ] STREAM CONNECTED 7506 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7505
unix 3 [ ] STREAM CONNECTED 7500 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7499
unix 3 [ ] STREAM CONNECTED 7498 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7497
unix 3 [ ] STREAM CONNECTED 7496 /tmp/orbit-hank/linc-109e-0-4fdda4fca77d5
unix 3 [ ] STREAM CONNECTED 7495
unix 3 [ ] STREAM CONNECTED 7490 /tmp/orbit-hank/linc-109e-0-4fdda4fca77d5
unix 3 [ ] STREAM CONNECTED 7489
unix 3 [ ] STREAM CONNECTED 7488 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7487
unix 3 [ ] STREAM CONNECTED 7486 /tmp/orbit-hank/linc-109e-0-4fdda4fca77d5
unix 3 [ ] STREAM CONNECTED 7485
unix 3 [ ] STREAM CONNECTED 7482 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7481
unix 3 [ ] STREAM CONNECTED 7476 /tmp/.X11-unix/X0
unix 4 [ ] STREAM CONNECTED 7475
unix 3 [ ] STREAM CONNECTED 7471 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7470
unix 3 [ ] STREAM CONNECTED 7465 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7464
unix 3 [ ] STREAM CONNECTED 7463 /tmp/orbit-hank/linc-109c-0-5c531b55cc40e
unix 3 [ ] STREAM CONNECTED 7462
unix 3 [ ] STREAM CONNECTED 7457 /tmp/orbit-hank/linc-109c-0-5c531b55cc40e
unix 3 [ ] STREAM CONNECTED 7456
unix 3 [ ] STREAM CONNECTED 7455 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7454
unix 3 [ ] STREAM CONNECTED 7453 /tmp/orbit-hank/linc-109c-0-5c531b55cc40e
unix 3 [ ] STREAM CONNECTED 7452
unix 3 [ ] STREAM CONNECTED 7449 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7448
unix 3 [ ] STREAM CONNECTED 7443 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7442
unix 3 [ ] STREAM CONNECTED 7433 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7432
unix 3 [ ] STREAM CONNECTED 7431 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7430
unix 3 [ ] STREAM CONNECTED 7429 /tmp/orbit-hank/linc-1098-0-403c9315ee5a7
unix 3 [ ] STREAM CONNECTED 7428
unix 3 [ ] STREAM CONNECTED 7423 /tmp/orbit-hank/linc-1098-0-403c9315ee5a7
unix 3 [ ] STREAM CONNECTED 7422
unix 3 [ ] STREAM CONNECTED 7421 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7420
unix 3 [ ] STREAM CONNECTED 7419 /tmp/orbit-hank/linc-1098-0-403c9315ee5a7
unix 3 [ ] STREAM CONNECTED 7418
unix 3 [ ] STREAM CONNECTED 7415 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7414
unix 3 [ ] STREAM CONNECTED 7409 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7408
unix 3 [ ] STREAM CONNECTED 7404 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7403
unix 3 [ ] STREAM CONNECTED 7400 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7399
unix 3 [ ] STREAM CONNECTED 7393 /tmp/mapping-hank
unix 3 [ ] STREAM CONNECTED 7386
unix 3 [ ] STREAM CONNECTED 7376 /tmp/orbit-hank/linc-107d-0-6c85e2438f84c
unix 3 [ ] STREAM CONNECTED 7375
unix 3 [ ] STREAM CONNECTED 7374 /tmp/orbit-hank/linc-1089-0-5687c48132318
unix 3 [ ] STREAM CONNECTED 7373
unix 3 [ ] STREAM CONNECTED 7370 /tmp/orbit-hank/linc-1089-0-5687c48132318
unix 3 [ ] STREAM CONNECTED 7369
unix 3 [ ] STREAM CONNECTED 7365 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7364
unix 3 [ ] STREAM CONNECTED 7360 /tmp/orbit-hank/linc-1089-0-5687c48132318
unix 3 [ ] STREAM CONNECTED 7359
unix 3 [ ] STREAM CONNECTED 7356 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7355
unix 3 [ ] STREAM CONNECTED 7354 /tmp/.fam1XAQ77
unix 3 [ ] STREAM CONNECTED 7353
unix 3 [ ] STREAM CONNECTED 7341 /tmp/.famuRUTJS
unix 3 [ ] STREAM CONNECTED 7340
unix 3 [ ] STREAM CONNECTED 7326 /tmp/orbit-hank/linc-1085-0-1eaa0009dfda2
unix 3 [ ] STREAM CONNECTED 7325
unix 3 [ ] STREAM CONNECTED 7324 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7323
unix 3 [ ] STREAM CONNECTED 7321 /tmp/orbit-hank/linc-1085-0-1eaa0009dfda2
unix 3 [ ] STREAM CONNECTED 7320
unix 3 [ ] STREAM CONNECTED 7317 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7316
unix 3 [ ] STREAM CONNECTED 7312 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7311
unix 3 [ ] STREAM CONNECTED 7329 /tmp/orbit-hank/linc-107d-0-6c85e2438f84c
unix 3 [ ] STREAM CONNECTED 7309
unix 3 [ ] STREAM CONNECTED 7308 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7307
unix 3 [ ] STREAM CONNECTED 7301 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7300
unix 3 [ ] STREAM CONNECTED 7299 /tmp/.famtXwfSJ
unix 3 [ ] STREAM CONNECTED 7298
unix 3 [ ] STREAM CONNECTED 7288 /var/run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 7287
unix 3 [ ] STREAM CONNECTED 7286 /tmp/orbit-hank/linc-107f-0-6c85e243c24d1
unix 3 [ ] STREAM CONNECTED 7285
unix 3 [ ] STREAM CONNECTED 7282 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7281
unix 3 [ ] STREAM CONNECTED 7275 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7274
unix 3 [ ] STREAM CONNECTED 7269 /tmp/orbit-hank/linc-107d-0-6c85e2438f84c
unix 3 [ ] STREAM CONNECTED 7268
unix 3 [ ] STREAM CONNECTED 7265 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7264
unix 3 [ ] STREAM CONNECTED 7262 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7261
unix 3 [ ] STREAM CONNECTED 7256 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7255
unix 3 [ ] STREAM CONNECTED 7253 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7252
unix 3 [ ] STREAM CONNECTED 7250 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7249
unix 3 [ ] STREAM CONNECTED 7248 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7247
unix 3 [ ] STREAM CONNECTED 7246 /tmp/orbit-hank/linc-107b-0-6c85e24331131
unix 3 [ ] STREAM CONNECTED 7245
unix 3 [ ] STREAM CONNECTED 7242 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7241
unix 3 [ ] STREAM CONNECTED 7239 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7238
unix 3 [ ] STREAM CONNECTED 7231 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7230
unix 3 [ ] STREAM CONNECTED 7221 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7220
unix 3 [ ] STREAM CONNECTED 7219 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7218
unix 3 [ ] STREAM CONNECTED 7217 /tmp/orbit-hank/linc-1073-0-68adc23b247a9
unix 3 [ ] STREAM CONNECTED 7216
unix 3 [ ] STREAM CONNECTED 7213 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7212
unix 3 [ ] STREAM CONNECTED 7179 /tmp/.ICE-unix/4136
unix 3 [ ] STREAM CONNECTED 7178
unix 3 [ ] STREAM CONNECTED 7177 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7176
unix 3 [ ] STREAM CONNECTED 7163 /tmp/orbit-hank/linc-104f-0-1e74852b6bf3c
unix 3 [ ] STREAM CONNECTED 7157
unix 3 [ ] STREAM CONNECTED 7135 /tmp/orbit-hank/linc-104f-0-1e74852b6bf3c
unix 3 [ ] STREAM CONNECTED 7134
unix 3 [ ] STREAM CONNECTED 7133 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7132
unix 3 [ ] STREAM CONNECTED 7125 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7124
unix 3 [ ] STREAM CONNECTED 7118 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7117
unix 3 [ ] STREAM CONNECTED 7102 /tmp/.famRfJl15
unix 3 [ ] STREAM CONNECTED 7101
unix 3 [ ] STREAM CONNECTED 7069 /tmp/orbit-hank/linc-104f-0-1e74852b6bf3c
unix 3 [ ] STREAM CONNECTED 7068
unix 3 [ ] STREAM CONNECTED 7065 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 7064
unix 3 [ ] STREAM CONNECTED 7059 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 7058
unix 3 [ ] STREAM CONNECTED 7053 /tmp/orbit-hank/linc-1028-0-386d2ee5b6861
unix 3 [ ] STREAM CONNECTED 7052
unix 3 [ ] STREAM CONNECTED 7051 /tmp/orbit-hank/linc-104d-0-7ec021db21abd
unix 3 [ ] STREAM CONNECTED 7050
unix 3 [ ] STREAM CONNECTED 7038 /tmp/.esd/socket
unix 3 [ ] STREAM CONNECTED 7037
unix 2 [ ] STREAM 7032
unix 3 [ ] STREAM CONNECTED 6974 /tmp/orbit-hank/linc-1028-0-386d2ee5b6861
unix 3 [ ] STREAM CONNECTED 6973
unix 3 [ ] STREAM CONNECTED 6972 /tmp/orbit-hank/linc-1046-0-e26b187a3c26
unix 3 [ ] STREAM CONNECTED 6813
unix 2 [ ] DGRAM 6799
unix 3 [ ] STREAM CONNECTED 6794 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 6793
unix 5 [ ] STREAM CONNECTED 6773 /tmp/.X11-unix/X0
unix 3 [ ] STREAM CONNECTED 6737
unix 2 [ ] DGRAM 6718
unix 2 [ ] DGRAM 6426
unix 3 [ ] STREAM CONNECTED 6013 /var/run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 6012
unix 3 [ ] STREAM CONNECTED 5994
unix 3 [ ] STREAM CONNECTED 5993
unix 2 [ ] DGRAM 5905
unix 2 [ ] DGRAM 5878
hank@neuromancer:~$

I do not know how to read the outputs of these reports. Does it look like I have that Trojan? If so, how would I clean it? And what does the output of netstat tell me? And last, where can I go to learn how to read these reports (netstat).

Thanks for any help I can get, I'm flippin over this.

tkedwards · 11-07-2005, 07:20 PM

Quote:

//usr/lib/j2se/1.4/jre/.systemPrefs /usr/lib/j2se/1.4/jre/.systemPrefs/.systemRo$/usr/lib/j2se/1.4/jre/.systemPrefs
You have 2 process hidden for readdir command
You have 2 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

I think this message can get triggered if you have processes (or threads) being created and destroyed while chkrootkit is running. Its even more likely that this is the cause since it appears to have something to do with a Java program - Java programs often create lots and lots of threads.

Quote:

ath0: PACKET SNIFFER(/sbin/dhcpcd-bin[3127])

This may also be OK - DHCP clients often need to listen on network interfaces in 'promiscuous mode' or whatever its called where it can see all packets. This is the same thing that packet sniffers do so its often picked up by root kit hunters.

Of course I could still be wrong and you might have been hacked. But you should be able to run chkrootkit at a different time and at least not get the LKM Trojan error. If you still get it try stopping whatever java app that is and then running chkrootkit. Same thing dchpcd - stop it and run chkrootkit and see if it still comes up.

Capt_Caveman · 11-07-2005, 10:50 PM

Chkrootkit will flag any files outside of standard home dirs that have filenames prefixed with a "." (aka a "hidden" file). So the JRE files are common flase positives. You should still visually inspect them to make sure they are not malicious in nature just to be thorough.

As tkedwards mentioned, the dhclient is a very common flase positive as well due to the type of PF_PACKET network socket it uses. Again verify package integrity by md5sum just to be sure.

For the hidden process warning, run chrootkit -x lkm and see what process are being flagged as "hidden" (if any) and then verify the integrity of those files. If checks come back with hidden processes some times, but not others, the see the chkrootkit FAQ regarding this issue.