viruses?

firedance · 01-22-2005, 05:09 PM

Well i just came to think about how i would know if i had a virus on linux.
I'm quite sure I wouldn't.
I started to think that my user has not that much access to make a virus effective but then i think: I enter the root password many times every day, when installing changing settings etc, couldn't the virus just look what i type? like a keylogger. Or if what i am installing is a virus, how could i know? i know nothing about linux security, Maybe there is a virus installed by default in my dist that nobody has noticed, how could I know? how could I secure my system? somebody could have switched my kernel! so now I'm running 2.6.10-1.741_FC3.virus instead of 2.6.10-1.741_FC3.stk16 , but of course it is named as my kernel. I always thought that linux was much more secure than windows, just because everybody says it is. But how could i know? i know nothing about linux security, linux could be a virus itself and i wouldn't notice.

HolyCoitus · 01-22-2005, 06:25 PM

On Linux, what would be called a Virus in Windows would be more likely called a rootkit. chkrootkit and rkhunter are good programs for checking to see if you have a rootkit installed.

http://www.rootkit.org/
http://www.chkrootkit.org/

If you're interested in actively scanning for malicious traffic or possible intrusions, I would say to check out an IDS or integrity checker. Tripwire and Snort are two of the more popular choices to my knowledge. Tripwire will check your files to see if they have changed while Snort is great for scanning active traffic.

http://www.tripwire.org/
http://www.snort.org/

Hopefully this is the kind of thing you're interested in.

firedance · 01-22-2005, 07:50 PM

perfect! thanks!
---
hmm

Code:

 rkhunter --checkall --quiet
Line:
                                                 [ BAD ]
Line: \033[49C[ BAD ]
                                                 [ BAD ]
Line: \033[49C[ BAD ]
                                                  [ BAD ]
Line: \033[50C[ BAD ]
                                              [ BAD ]
/usr/sbin/prelink: "/usr/bin/groups" is not an ELF file

Line: \033[46C[ BAD ]
                               [ Warning! ]
Line: \033[31C[ Warning! ]
Watch out Root login possible. Possible risk!
Line: Watch out Root login possible. Possible risk!
                         [ Warning (SSH v1 allowed) ]

(other scan with only bad parts)

Code:

   /bin/egrep                                                [ BAD ]
   /bin/fgrep                                                 [ BAD ]
   /bin/grep                                                  [ BAD ]
/sbin/syslogd                                              [ BAD ]   

Scanning for hidden files...                               [ Warning! ]
---------------
 /dev/.udev.tdb /etc/.pwd.lock
/etc/.fstab.hal.e
/etc/.fstab.hal.4
/etc/.java

MD5
MD5 compared: 43
Incorrect MD5 checksums: 4

File scan
Scanned files: 342
Possible infected files: 0

Application scan
Vulnerable applications: 1

ok, does this mean that I'm ok even if 4 md5 checksums are wrong?

joelunch · 04-10-2007, 10:03 PM

Did you work out what the "Line:" issue was about? We keep getting it but I can't find any such file.

rocket357 · 04-10-2007, 10:19 PM

You have root over sshv1 enabled. This is bad.

As for syslogd reporting bad, do you know if your distro runs custom (source-edited, not custom config) of syslogd? If it wasn't syslogd, I'd think nothing of it, but since it's your system logger (could be modified to not trace the attacker in your logs), I'd be worried. I'm not saying do a complete reinstall, but definitely look into it!

Did you use your distro's repository to install rkhunter and chkrootkit? If so, I'd be even more worried.

I'm not telling you this is necessary, but I'm paranoid enough for that to convince me to reinstall (and make sure remote root login via ssh is disabled and sshv2 is configured to be the only version allowed).

One thing you can do in the future is install syslogd from stock, then download the source and modify it to use another configuration file. Create a new configuration file in a weird location, set syslogd to log to a remote machine, and then recompile/reinstall syslog. If you can, put the "real" config file on a read-only filesystem, such as a CD or DVD.

Yes, it's security through obscurity, I realize this. But if you leave the original config file alone then many attackers will check it and think you aren't using remote logging, when in fact you are. Then you can routinely check your remote logs and know when something is up.

Of course, this doesn't help much when the attacker has root access, but it's a start.

Zention · 04-16-2007, 07:45 PM

What you say is quite true - but it extends to all software and all operating systems.

So, it does become a matter of trust.

Open source allows for a higher trust level, and one assumes the more eyeballs on the code the less likely some malware will slip in there, though of course it is still possible, just less likely than closed source.

Most developers will generate a hash against their source files, so you can check for that, and of course that makes it harder for a third party to install malcode, though yet again not impossible.

Tripwire and other hashing software act as a good indication if you have been compromised, once you assume the system at start is clean, but really if you want to take security seriously you have to subscribe to the various security alert sites.

cert.org is a quite good one.

Just remember though that if someone cracks into your system you do have legal recourse in most countries, and the penalties if found guilty are getting quite stiff now.