Can wtmp be modified?

ivanatora · 12-05-2005, 01:08 PM

One of my boxes has been hacked and now I'm trying to catch the intruder's address. I see logins when I use 'last', but I'm not sure if these records could be faked. I know 'last' takes its data from /var/log/wtmp and it's not normaly readable data, but kind of a crypted data. Can it be modified so 'last' lies?

int0x80 · 12-05-2005, 01:16 PM

Yes. Several tools exist, such as dwipe, that can modify WTMP, UTMP, LASTLOG, and log directories to clean out the presence of an intruder.

Capt_Caveman · 12-05-2005, 11:23 PM

Chkrootkit (and I believe rkhunter) perform checks for wtmp deletion. They might be good places to start if you think you machine might have been compromised. If it has been compromised, then you might want to use a second (known clean) machine to sniff traffic to the potentially compromised machine. Trying to do it locally can be an uphill battle if it's been rooted and a rookit was installed.

Could you explain in more detail why you are sure it's been hacked?