LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-28-2006, 12:53 PM   #1
mimithebrain
Member
 
Registered: Nov 2003
Location: ~
Distribution: Ubuntu 10.04
Posts: 843
Blog Entries: 1

Rep: Reputation: 30
Exclamation chkrootkit suckit initng infected network 8%


My network is constantly used at 8%, except when I run tcpdump, ethereal, or otherwise start using the internet and computer.

I ran chkrootkit, and while I'm in initng, it tells me that /sbin/init is infected. If I run the init old generation, it doesn't say that /sbin/init is infected...

I'm security conscious and my first idea is to compare another ubuntu machine I have, and then to reformat and reinstall (aaaaaarrrgg!!)...

Advice greatly appreciated.
 
Old 03-28-2006, 04:03 PM   #2
mimithebrain
Member
 
Registered: Nov 2003
Location: ~
Distribution: Ubuntu 10.04
Posts: 843

Original Poster
Blog Entries: 1

Rep: Reputation: 30
I'm guessing:
8% because of lo activity, or bug in the applet
netstat returns no listening ports except on lo
tcpdump on everything and ethereal reports a few packets on lo, and nothing on ath0, eth0, sit0, and wifi0, even with interface (except lo) disabled.

initng created the false alarm because (possibly) chkrootkit is not programmed to handle a different init.
The other ubuntu machine reports that dhcpclient is promiscuous on that computer too (I've thought so).

The other thing would be my paranoia with security and computer health and performance... I need a vacation?
 
Old 03-28-2006, 04:37 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
initng created the false alarm because (possibly) chkrootkit is not programmed to handle a different init.
If all checks out fine (minimally the md5sums on the package and the binary), I'd say mail the false positive report to the maintainer.


The other ubuntu machine reports that dhcpclient is promiscuous on that computer too
That's a known situation. If you kill dhcpclient and it's still in promisc mode and there's no other libcap app listening (use /sbin/ip instead of ifconfig) *then* investigate.
 
Old 03-28-2006, 04:50 PM   #4
mimithebrain
Member
 
Registered: Nov 2003
Location: ~
Distribution: Ubuntu 10.04
Posts: 843

Original Poster
Blog Entries: 1

Rep: Reputation: 30
the md5 of initng the debian package is the same as the one in /sbin/initng.
*edit* I'll file a bug report... meanwhile and inside a day, a new initng just came out*/edit*
the dhcp client was killed, and no promiscuosity was reported.

That leaves pananoia... By the way, these are good methods... I'll remember those...

Last edited by mimithebrain; 03-28-2006 at 04:52 PM. Reason: bug report, and new initng
 
Old 03-29-2006, 10:39 AM   #5
mimithebrain
Member
 
Registered: Nov 2003
Location: ~
Distribution: Ubuntu 10.04
Posts: 843

Original Poster
Blog Entries: 1

Rep: Reputation: 30
The "8% activity network" has been solved:
My card, perhaps being promiscuous because of the dhcp client, kept on receiving a steady flow of packets from a peer in my network that was intended for another computer outside the network...

I can rest now
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
chkrootkit and SuckIT ddaas Linux - Security 7 12-07-2005 08:57 AM
chkrootkit found ifconfig infected ohcarol Linux - Security 4 02-28-2005 04:57 PM
Quarantine infected machines on network! mikedeatworld Linux - Networking 9 02-18-2005 08:54 AM
chkrootkit problem (port 465 infected) myguest Linux - Security 1 09-30-2004 08:07 PM
SucKIT acadcworks Linux - Security 1 11-18-2002 07:27 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:18 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration