Rkhunter reports a hidden directory

born2bewild · 10-23-2015, 02:24 PM

I ran rkhunter and there was a warning.

Warning: Hidden directory found: /bin/.gnome-desktop
Warning: Hidden directory found: /sbin/.gnome-desktop

I then ran ls to see what was in there

Code:

ls -l /bin/.gnome-desktop
total 4
-rwxr-xr-x 1 root root 342 Jun 13  2014 DELL-Configurator.desktop*

ls -l /sbin/.gnome-desktop
total 4
-rwxr-xr-x 1 root root 342 Jun 13  2014 DELL-Configurator.desktop*

This is the dell printer setup utility that I install last year from dell's website. Why would it be installed in a hidden directory?

Rkhunter doesn't say it's a rootkit, just a hidden directory. Should I be concern anyway because it's hidden?

Habitual · 10-23-2015, 02:49 PM

Quote:

Originally Posted by born2bewild

I ran rkhunter and there was a warning.

Warning: Hidden directory found: /bin/.gnome-desktop
Warning: Hidden directory found: /sbin/.gnome-desktop

Just remove them since you know how they got there.

born2bewild · 10-23-2015, 03:46 PM

Quote:

Originally Posted by Habitual

Just remove them since you know how they got there.

I might just do that.

I digged a little deeper into this directory and ran two commands on this DELL file to see what it really is.

Code:

file /sbin/.gnome-desktop/DELL-Configurator.desktop 
/sbin/.gnome-desktop/DELL-Configurator.desktop: UTF-8 Unicode text

cat /sbin/.gnome-desktop/DELL-Configurator.desktop 
[Desktop Entry]
Type=Application
Name=DELL Unified Driver Configurator
Name[fr]=Configurateur de pilote DELL Unified Driver
Comment=Manage your printers and scanners here
Comment[fr]=Grer vos imprimantes et scanners ici
Exec=/opt/DELL/mfp/bin/Configurator
Icon=/opt/DELL/mfp/share/images/Configurator.png
Terminal=false
StartupNotify=false

It's just an icon that points to the dell utility printer setup wheeewww

Sometimes when you audit your own system and you're not an IT security person. it can be an adventure when you don't understand if a warning message is harmless or not

Also, now that linux is as popular as windows we need to be proactive and check for rootkits and malwares periodically.

Habitual · 10-23-2015, 04:46 PM

Quote:

Originally Posted by born2bewild

Code:

file /sbin/.gnome-desktop/DELL-Configurator.desktop

add 'strings' to your utility-belt

Code:

strings /sbin/.gnome-desktop/DELL-Configurator.desktop

born2bewild · 10-23-2015, 05:27 PM

Quote:

Originally Posted by Habitual

add 'strings' to your utility-belt

Code:

strings /sbin/.gnome-desktop/DELL-Configurator.desktop

Thanks I will.

Habitual · 10-24-2015, 04:44 PM

You are welcome.