Security Check on my computer

vi0lat0r · 04-07-2004, 07:22 AM

I went to check my email this morning and I had this email from my computer...

Quote:

Security Warning: World Writable files found :
- /home/vi0lat0r/.phoenix/default/ypqm7ioh.slt/chrome/flashblock.jar
- /home/vi0lat0r/.phoenix/default/ypqm7ioh.slt/chrome/userContent.css
- /tmp/.ICE-unix
- /tmp/.ICE-unix/dcop26384-1081295844
- /tmp/.X11-unix
- /tmp/.X11-unix/X0
- /tmp/.font-unix
- /tmp/.font-unix/fs-1
- /var/lib/texmf
- /var/lib/texmf/ls-R
- /var/spool/postfix/dev/log
- /var/spool/postfix/private/bounce
- /var/spool/postfix/private/cyrus
- /var/spool/postfix/private/cyrus-chroot
- /var/spool/postfix/private/cyrus-deliver
- /var/spool/postfix/private/cyrus-inet
- /var/spool/postfix/private/defer
- /var/spool/postfix/private/error
- /var/spool/postfix/private/lmtp
- /var/spool/postfix/private/lmtp-filter
- /var/spool/postfix/private/local
- /var/spool/postfix/private/maildrop
- /var/spool/postfix/private/proxymap
- /var/spool/postfix/private/relay
- /var/spool/postfix/private/rewrite
- /var/spool/postfix/private/smtp
- /var/spool/postfix/private/smtp-filter
- /var/spool/postfix/private/tlsmgr
- /var/spool/postfix/private/trace
- /var/spool/postfix/private/uucp
- /var/spool/postfix/private/verify
- /var/spool/postfix/private/virtual
- /var/spool/postfix/public/cleanup
- /var/spool/postfix/public/flush
- /var/spool/postfix/public/pickup
- /var/spool/postfix/public/qmgr
- /var/spool/postfix/public/showq
- /var/spool/samba
- /var/spool/spamassassin
- /var/spool/spamassassin/auto-whitelist.db

Security Warning: These files belonging to packages are modified on the system :
- /boot/message-graphic
- /usr/X11R6/bin/rxvt
- /usr/X11R6/lib/X11/fonts/Type1/fonts.cache-1
- /usr/X11R6/lib/X11/fonts/misc/fonts.alias
- /usr/X11R6/lib/X11/icewm/menu
- /usr/lib/wnn/ja_JP/dic/gerodic/g-jinmei.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/bio.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/chimei.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/computer.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/full.fzk
- /usr/lib/wnn/ja_JP/dic/pubdic/jinmei.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/kihon.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/kougo.fzk
- /usr/lib/wnn/ja_JP/dic/pubdic/koyuu.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/setsuji.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/special.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/std.fzk
- /usr/lib/wnn/ja_JP/dic/pubdic/symbol.dic
- /usr/lib/wnn/ja_JP/dic/pubdic/tankan.dic
- /usr/lib/wnn/ja_JP/dic/wnncons/tankan2.dic
- /usr/lib/wnn/ja_JP/dic/wnncons/tankan3.dic
- /usr/share/a2ps/afm/fonts.map
- /usr/share/fonts/bitmap/tscii/fonts.cache-1
- /usr/share/fonts/ttf/arabic/fonts.cache-1
- /usr/share/fonts/ttf/bengali/fonts.cache-1
- /usr/share/fonts/ttf/korean/fonts.cache-1
- /usr/share/fonts/ttf/tamil/fonts.cache-1
- /usr/share/fonts/ttf/thai/fonts.cache-1
- /usr/share/fonts/ttf/tscii/fonts.cache-1
- /usr/share/fonts/type1/greek/fonts.cache-1
- /usr/share/fonts/type1/hebrew/fonts.cache-1
- /usr/share/texmf/ls-R
- /var/lib/nfs/state

Security Warning: These config files belonging to packages are modified on the
system :
- /etc/X11/fs/config
- /etc/cups/classes.conf
- /etc/cups/printers.conf
- /etc/exports
- /etc/firestarter/firewall.sh
- /etc/host.conf
- /etc/info-dir
- /etc/inittab
- /etc/login.defs
- /etc/modprobe.conf
- /etc/modprobe.preload
- /etc/modules
- /etc/modules.conf
- /etc/mtools.conf
- /etc/pam.d/system-auth
- /etc/postfix/aliases
- /etc/printcap
- /etc/sane.d/dll.conf
- /etc/shells
- /etc/ssh/sshd_config
- /etc/sysconfig/bootsplash
- /etc/sysconfig/harddrake2/previous_hw
- /etc/sysconfig/msec
- /etc/sysconfig/syslog
- /etc/sysconfig/usb
- /etc/sysctl.conf
- /etc/syslog.conf
- /etc/termcap
- /etc/xml/catalog
- /usr/share/config/kdeglobals
- /usr/share/config/kdesktoprc
- /usr/share/config/kdm/kdmrc
- /usr/share/config/konquerorrc
- /usr/share/sgml/docbook/xmlcatalog

These are the ports listening on your machine :
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
PID/Program name
tcp 0 0 *:nfs *:* LISTEN
-
tcp 0 0 *:676 *:* LISTEN
24662/rpc.statd
tcp 0 0 *:swat *:* LISTEN
24964/xinetd
tcp 0 0 localhost:10026 *:* LISTEN
25211/master
tcp 0 0 *:netbios-ssn *:* LISTEN
25494/smbd
tcp 0 0 localhost:783 *:* LISTEN
25272/spamd -d -c -
tcp 0 0 *:sunrpc *:* LISTEN
24507/portmap
tcp 0 0 *:x11 *:* LISTEN
26318/X
tcp 0 0 *:ssh *:* LISTEN
24938/sshd
tcp 0 0 *:663 *:* LISTEN
25076/rpc.mountd
tcp 0 0 *:ipp *:* LISTEN
24995/cupsd
tcp 0 0 localhost:smtp *:* LISTEN
25211/master
tcp 0 0 localhost:33913 *:* LISTEN
24964/xinetd
tcp 0 0 *:33914 *:* LISTEN
-
tcp 0 0 *:ldaps *:* LISTEN
25047/rpc.rquotad
tcp 0 0 *:microsoft-ds *:* LISTEN
25494/smbd
udp 0 0 *:nfs *:*
-
udp 0 0 wbar6.lax1-4:netbios-ns *:*
25510/nmbd
udp 0 0 *:netbios-ns *:*
25510/nmbd
udp 0 0 wbar6.lax1-:netbios-dgm *:*
25510/nmbd
udp 0 0 *:netbios-dgm *:*
25510/nmbd
udp 0 0 *:660 *:*
25076/rpc.mountd
udp 0 0 *:670 *:*
24662/rpc.statd
udp 0 0 *:673 *:*
24662/rpc.statd
udp 0 0 *:bootpc *:*
25739/dhclient
udp 0 0 *:sunrpc *:*
24507/portmap
udp 0 0 *:32881 *:*
-
udp 0 0 *:ipp *:*
24995/cupsd
udp 0 0 *:633 *:*
25047/rpc.rquotad

So is this just a 'security notice' to let me know what my writable files are, etc.? Or does this actually have meaning? It's the first time I ever got an email from my computer...

ugge · 04-07-2004, 08:31 AM

Can you see what program created the list and sent the mail?
If this is the first time this happens I would be a bit worried, unless I installed some security monitor recently.
This seems to be a security monitor, suddenly detecting changes of concern. But this conclusion may be all wrong.

Capt_Caveman · 04-08-2004, 02:29 AM

I would put money on msec:

http://www.mandrakesecure.net/en/docs/msec.php

BTW, msec is doing it's job very well. You need to turn off some of those un-needed services (portmap, nfs, etc).