LinuxQuestions.org - Chkrootkit reports bindshell infected port 465

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - Chkrootkit reports bindshell infected port 465 (https://www.linuxquestions.org/questions/linux-security-4/chkrootkit-reports-bindshell-infected-port-465-a-4175652129/)

For LKM, see https://askubuntu.com/questions/5878...ble-klm-trojan

Yes, the packet sniffer is a false positive.

Quote:

Originally Posted by hydrurga (Post 5985588)

For LKM, see https://askubuntu.com/questions/5878...ble-klm-trojan

Yes, the packet sniffer is a false positive.

Rkhunter reported the LKM trojan as well a few minutes ago, but now when I run it again it doesn't report it anymore. Is that a cause for concern?

How can I determine the exact process and application that chkrootkit thought was suspicious? When I type "./chkproc -v" it says "bash: ./chkproc: No such file or directory".

Quote:

Originally Posted by Seniark (Post 5985593)

I have no idea, to be honest, whether or not that is a cause for concern.

You have to be in the chkrootkit directory (where you installed chkrootkit) for that command to work. When I run it, it lists quite a number of processes though so I don't know how useful it will be for you.

Some general reading: https://www.dedoimedo.com/computers/...m-warning.html

Ok, I got something concrete this time. :)

This is the output of chkproc:

Code:

bluelight@bluelight:/usr/lib/chkrootkit$ ./chkproc -v

PID 21961(/proc/21961): not in readdir output

PID 21961: not in ps output

PID 21962(/proc/21962): not in readdir output

PID 21962: not in ps output

You have    2 process hidden for readdir command

You have    2 process hidden for ps command

and then...

Code:

bluelight@bluelight:/proc/21961$ cd /proc/21961/ && cat cmdline

/opt/Wire/wire-desktop --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --disable-gpu-compositing --service-pipe-token=5018331470343674612 --lang=en-US --app-path=/opt/Wire/resources/app --node-integration=false --webview-tag=true --no-sandbox --preload=/opt/Wire/resources/app/renderer/static/webview-preload.js --background-color=#fff --guest-instance-id=2 --enable-blink-features --disable-blink-features --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5018331470343674612 --renderer-client-id=8 --shared-files=v8_context_snapshot_data:100,v8_natives_data:101bluelight@bluelight:/proc/21961$ 

bluelight@bluelight:/proc/21961$ cd /proc/21962/ && cat cmdline

bash: cd: /proc/21962/: No such file or directory

Wire is a chat client I downloaded from wire.com, and it's not suspicious. I suppose the second process terminated before I could see what it was.

So I suppose there's not much cause for concern. I wonder why chkrootkit is more likely to report that alarm when snap is installed, though.

Thanks a lot, man. I really appreciate the help on this forum from everyone.

Quote:

Originally Posted by Seniark (Post 5985151)

As far as I remember, I had these packages installed using snapd:

https://snapcraft.io/odio
https://snapcraft.io/somafm-qt

somafm-qt looks harmless enough, just compiling it myself now.
nevertheless, it could be communicating with soma.fm somehow.

odio - not so much. i could not find the sourcecode anywhere. it could be doing all kinds of datamining on your system and transmitting that to the maintainer.

additionally, i do not really trust snappy, who knows in what ways it phones home.

Quote:

Originally Posted by Seniark (Post 5985603)

Ok, I got something concrete this time. :)

This is the output of chkproc:

Code:

bluelight@bluelight:/usr/lib/chkrootkit$ ./chkproc -v

PID 21961(/proc/21961): not in readdir output

PID 21961: not in ps output

PID 21962(/proc/21962): not in readdir output

PID 21962: not in ps output

You have    2 process hidden for readdir command

You have    2 process hidden for ps command

and then...

Wire is a chat client I downloaded from wire.com, and it's not suspicious. I suppose the second process terminated before I could see what it was.

So I suppose there's not much cause for concern. I wonder why chkrootkit is more likely to report that alarm when snap is installed, though.

Thanks a lot, man. I really appreciate the help on this forum from everyone.

Looks like you got your culprit. :)

Quote:

Originally Posted by ondoho (Post 5985620)

I forgot to mention yesterday that I also had Opentyrian installled via snap.

https://snapcraft.io/opentyrian

I've now uninstalled snapd (sudo apt remove snapd), but not every one of its individual applications. Chkrootkit doesn't report LKM trojan for the time being.

i don't understand ubuntu's obsession with snappy.
opentyrian is available in the repos of both major distributions i am using, one of them debian - so very likely also in ubuntu's repos.:scratch:

Quote:

Originally Posted by Seniark (Post 5985644)

I've now uninstalled snapd (sudo apt remove snapd), but not every one of its individual applications.

to my understanding that means that the individual packages cannot be active anymore now - but how are you going to uninstall them now?