strange files
Hi all,
I came across something odd this morning on a Sarge production server I
manage remotely. The machine runs a self-compiled 2.6.12.2 kernel and I
keep it up to date with security fixes. (I run upgrades and
dist-upgrades when I get email from debian-security-announce).
The box is an HP/Compaq somethingorother server with the following
controller:
0000:04:03.0 RAID bus controller: Compaq Computer Corporation Smart
Array 64xx (rev 01). The filesystem is ext3 on 2x160GB hardware RAID1.
The box has 3 GB ECC RAM. None of the hardware reports any failure of
any kind.
The weird this is that there are six files in / that should not be
there. 'ls -l' gives me:
-rw-rw-rw- 1 root root 0 2005-08-17 23:08 ?
-rw-rw-rw- 1 root root 0 2005-08-18 23:08 ?
-rw-rw-rw- 1 root root 0 2005-09-06 23:13 ?
-rw-rw-rw- 1 root root 0 2005-08-17 23:08 ???
-rw-rw-rw- 1 root root 0 2005-08-18 23:08 ???
-rw-rw-rw- 1 root root 0 2005-09-06 23:13 ???
Not useful.
I wrote a little C app that runs readdir() on / and gives me all the
filenames as strings and a char[] cast into int. With an utf8 console I
get the filenames as a series of squares now, but what I find more
interesting is that when I print off the integer values of each of the
chars in the filenames, I get this:
dir='/', file='', char[] = -10,-73,-128
dir='/', file='?', char[] = -10,-73,-80,-110,25,8
dir='/', file='', char[] = -14,-73,-128
dir='/', file='', char[] = -14,-73,-80,-110,25,8
dir='/', file='', char[] = -16,-73,-128
dir='/', file='', char[] = -16,-73,-80,-110,25,8
... negative numbers? (The strings won't paste properly).
I've forced fsck, which doesn't find anything out of the ordinary. I've
run chkrootkit, which finds nothing. I've checked the logs, which list a
few childish attempts at burglary via proftpd, but not anything I'm
going to lsoe sleep over, and nothing else of interest. I'm not saying
the box hasn't been compromised, but if it has, I'd like to find out HOW
before I do anything else.
I've just tried to create a file with the characters -10, -72, -80,
-110, 25, 8 as filename, and got a completely different result.
Does anyone have any suggestion as to what may be going on? I'm pretty
much at a loss.
- P.
Reply to: