Compromised? (Was Re: hard disk access on every keystroke in console mode!)
michelle <auto_delete_all_incoming@dynodonalies.com> said on Mon, 15 Dec 2003 01:00:33 -0500:
> Every time I perform a keypress at the console (command line, nano, etc.) I
> can hear a tick from the hard disk.
That's exactly what I had a week before the Big Debian
Compromise. Didn't happen in X, only console. Also, trying to install
more debian packages failed through lack of disk space, despite me
still having a few hundred megs left on the relevant partititons.
If I rebooted into single user mode, or went via 'init 1', there were
still a few processes more remaining around that I thought shouldn't
be in runlevel 1, and the ticking still happened even if everything
but the kernel threads and init were killed.
There was a little bit more suspicious behaviour, but I put it down to
a bad disk.
I ran chkrootkit over it, but found nothing.
I ran IBM diagnostics over the drive (IBM travelstar, in my notebook),
and reinstalled debian, and then home directories etc from backup.
It all behaves again now.
> Also, compiling from the console is almost 4 times slower than compiling
> from inside KDE3. This doesn't make sense to me.
>
> I get similar results for 2.2, 2.4, and 2.6 kernels.
> Does anyone know what causes this?
When did it start happening for you?
I'm still a little suspicious. We are behind a strong university
firewall, so can't possibly imagine that I was compromised (although
while I was attempting to debug the situation (with no luck, of
course), I did unplug the notwork)
--
TimC -- http://astronomy.swin.edu.au/staff/tconnors/
I'm sorry. The number you have reached is imaginary. Please rotate your
phone 90 degrees and try again.
Reply to: