From owner-freebsd-security@FreeBSD.ORG  Sun May 11 13:19:49 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 0502137B404
	for <freebsd-security@freebsd.org>;
	Sun, 11 May 2003 13:19:49 -0700 (PDT)
Received: from mta7.pltn13.pbi.net (mta7.pltn13.pbi.net [64.164.98.8])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5386643FF3
	for <freebsd-security@freebsd.org>;
	Sun, 11 May 2003 13:19:48 -0700 (PDT)
	(envelope-from mbsd@pacbell.net)
Received: from atlas (adsl-64-166-22-125.dsl.snfc21.pacbell.net
	[64.166.22.125])
	by mta7.pltn13.pbi.net (8.12.9/8.12.3) with ESMTP id h4BKJkp8010690;
	Sun, 11 May 2003 13:19:46 -0700 (PDT)
Date: Sun, 11 May 2003 13:19:46 -0700 (PDT)
From: =?ISO-8859-1?Q?Mikko_Ty=F6l=E4j=E4rvi?= <mbsd@pacbell.net>
X-X-Sender: mikko@atlas.home
To: Blaine Kahle <goatee@binary.net>
In-Reply-To: <20030511180321.GB37652@binary.net>
Message-ID: <20030511131555.E37892@atlas.home>
References: <A695FEAC-8224-11D7-B2CA-000393C94468@sarenet.es>
	<4.3.2.7.2.20030509110012.03940680@localhost>
	<20030511180321.GB37652@binary.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: freebsd-security@freebsd.org
Subject: Re: Hacked?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 11 May 2003 20:19:49 -0000

On Sun, 11 May 2003, Blaine Kahle wrote:

> On Fri, May 09, 2003 at 11:01:21AM -0600, Brett Glass wrote:
> > At 08:25 AM 5/9/2003, Bjoern A. Zeeb wrote:
> >
> > >this asumes that truss is ok ;-) perhaps take the truss from your
> > >other 4.7 machine ...
> >
> > Yes, you do have to be careful of this. I recently investigated a
> > machine that had been "owned," and when truss was applied to some
> > commands (e.g. netstat) it produced no output.
>
> I'm showing that truss'ing netstat produces no output on several
> versions of FreeBSD that I have installed. Is this correct behavior? The
> truss and netstat binaries both check out when compared to the listings
> at http://www.knowngoods.org/

You can't trace setuid/setgid programs.  Netstat is setgid kmem.
If you really need to truss it, make a copy and run it as a user
with the requisite privileges (or root).

  $.02,
  /Mikko