[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: chkrootkit infected ports 2881 - conundrum

Adam Hardy escreveu:
After the attack, I quickly realized that I have no definitive way of deciding if my system was rooted or not, and so I installed rkhunter. This provides a simple hash-based mechanism to create an image of the clean system (although I can't actually do that with the Etch version).

However even if I had been able to create the hashes on my system for rkhunter, they would have to be on read-write media, i.e. the system's local hard drive, and therefore could also be 'rooted' by the hacker, preventing rkhunter from identifying the attack.

I am not aware of an actual Debian package or indeed any program that can get around this simple conundrum.

After-the-attack identification of a rootkit attack, it seems, can always be compromised if there is no safe read-only hash or encryption of the known-good system binaries.

Unfortunately, I think that if you do not have physical access to the machine, this problem is (at least theoretically) unsolveable.

The checksums must be created when the system is in a known good state, preferably just after system installation, and stored somewhere else. With physical access, you can burn them on a CD. Without that, the machine must be connected to the network for the installation of packages, checksum generation and final transfer of the checksum file to another machine. In theory there could be an attack during that time, and you could end up with a file with false checksums, but the attacker must be able to use that time opportunity, and since you only need a ssh server, I'd say it's quite unlikely that the checksum file is someway invalid.

The biggest problem is in verification time. If you have physical access, you can boot a Live-CD and run the checkum verification with a program that is known to be good. However, without physical access, you'd have to resort to checking the system as it is, that is, in a possibly infected state. And in this case, you'd end up using the checksum program that is in the system, which could be modified to hide the rootkit, and you'd not find the infection.

There are ways to try to circumvent that (such as copying a statically linked checksum program and using that instead of the system one), but if the rootkit is running, it could, at least in theory, hide itself, for example by intercepting system calls that read infected files and returning instead data corresponding to a good file.

The only way to be completely sure that you are getting reliable results is to run the verification when the rootkit could not be running - and this requires you booting in another system via a Live CD, or removing the HD, installing it in another machine and booting that second machine, for example. Both cases require physical access.

Reply to: