From owner-freebsd-security@FreeBSD.ORG  Sat May 22 02:13:50 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6B8EE16A4CE
	for <freebsd-security@freebsd.org>;
	Sat, 22 May 2004 02:13:50 -0700 (PDT)
Received: from mail.computerpech.nl (mail.rootkit.nl [62.177.200.5])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D15BF43D46
	for <freebsd-security@freebsd.org>;
	Sat, 22 May 2004 02:13:49 -0700 (PDT)
	(envelope-from michael@computerpech.nl)
Received: from [217.123.72.121] (helo=computerpech.nl)
	by mail.computerpech.nl with asmtp (Exim 4.34; FreeBSD)
	id 1BRSZM-000CRO-5N; Sat, 22 May 2004 11:13:28 +0200
Message-ID: <40AF19B2.1090905@computerpech.nl>
Date: Sat, 22 May 2004 11:13:22 +0200
From: "M. Boelen" <michael@computerpech.nl>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.6) Gecko/20040113
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: RazorOnFreeBSD <yann.luppo@attglobal.net>
References: <021f01c43f3a$e7eb7f40$0f01a8c0@razor>
In-Reply-To: <021f01c43f3a$e7eb7f40$0f01a8c0@razor>
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Mon, 24 May 2004 02:37:13 -0700
cc: freebsd-security@freebsd.org
Subject: Re: Hacked or not ?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 22 May 2004 09:13:50 -0000

Hi,

Someone else did already told you about Rootkit Hunter, but forget to 
say you can install it from the FreeBSD Ports collection 
(/usr/ports/security/rkhunter) ;-)

(it's has been added this month, so a lot of FreeBSD users don't know it 
yet)

Michael Boelen
Author of Rootkit Hunter

>Hi, 
>
>I have a 4.9-STABLE FreeBSD box apparently hacked!
>Yesterday I ran chkrootkit-0.41 and I don't like some of the outputs. 
>Those are:
>chfn     ... INFECTED
>chsh    ... INFECTED
>date     ... INFECTED
>ls         ... INFECTED
>ps        ... INFECTED
>
>But all the rest is NOT PROMISC, NOT INFECTED, NOTHING FOUND, NOTHING DELETED, or NOTHING DETECTED.
>I know by the FreeBSD-Security archives that chkrootkit isn't perfect with FreeBSD versions 5.x
>But I'm not in that case. So I'm a little bit afraid and as a newbie I don't really know what to do....
>I tried "truss ls" to find something strange and here are the outputs with something... suspicious for me:
>
>ioctl(1,TIOCGETA,0xbfbff534)                        = 0 (0x0)
>ioctl(1,TIOCGWINSZ,0xbfbff5a8)                    = 0 (0x0)
>getuid()                                                        = 0 (0x0)
>readlink("etc/malloc.conf",0xbfbff490,63)        ERR#2 'No such file or directory'         #SUSPICIOUS
>mmap(0x0,4096,0x3,0x1002,-1,0x0)              = 671666176 (0x2808d000)
>break(0x809b000)                                        = 0 (0x0)
>break(0x809c000)                                        = 0 (0x0)
>break(0x809d000)                                        = 0 (0x0)
>break(0x809e000)                                        = 0 (0x0)
>...........................................................................................and so on!
>
>And if I am an intrusion victim.... what can I do ? How can I restore those files? and how can I find out how this cracker did to break my firewall? I mean where is the security hole?
>PS: After verification on other commands declared not infected I found out this ERR#2 is common.... maybe I have another problem here!
>
>Thanks everyone!
>razor.
>_______________________________________________
>freebsd-security@freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-security
>To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
>
>  
>


-- 

This is my mailbox. There are many like it but this one is mine.
My mailbox is my best friend. It is my life. I must master it as I
master my life.

My mailbox, without me is useless. Without my mailbox, I am useless.
I must empty my mailbox true. I must clean him before he gets full.
I will....