Is there any chance that some of these processes are malicious?

Question

My significant other and I are sometimes paranoid that a foreign government usually associated with last year's Gmail security breach may be attempting to gain access to our computers.

There were a lot of strange processes running as root tonight, though I have not opened any root terminals. Can someone please look at these and tell me, yes or no, are they suspicious, and why or why not?

PID TTY          TIME CMD
    1 ?        00:00:01 init
    2 ?        00:00:00 kthreadd
    3 ?        00:00:01 ksoftirqd/0
    6 ?        00:00:00 migration/0
    7 ?        00:00:00 watchdog/0
   13 ?        00:00:00 cpuset
   14 ?        00:00:00 khelper
   15 ?        00:00:00 netns
   16 ?        00:00:00 sync_supers
   17 ?        00:00:00 bdi-default
   18 ?        00:00:00 kintegrityd
   19 ?        00:00:00 kblockd
   20 ?        00:00:00 kacpid
   21 ?        00:00:00 kacpi_notify
   22 ?        00:00:00 kacpi_hotplug
   23 ?        00:00:00 kseriod
   25 ?        00:00:00 kondemand
   26 ?        00:00:00 khungtaskd
   27 ?        00:00:03 kswapd0
   28 ?        00:00:00 ksmd
   29 ?        00:00:00 fsnotify_mark
   30 ?        00:00:00 aio
   31 ?        00:00:00 crypto
  163 ?        00:00:00 khubd
  164 ?        00:00:00 ata_sff
  165 ?        00:00:00 scsi_eh_0
  166 ?        00:00:00 scsi_eh_1
  199 ?        00:00:00 usbhid_resumer
  222 ?        00:00:00 kjournald
  271 ?        00:00:00 udevd
  442 ?        00:00:00 kpsmoused
  446 ?        00:00:36 net.agent
  450 ?        00:00:00 cfg80211
  471 ?        00:00:00 hd-audio0
  532 ?        00:00:36 net.agent
  751 ?        00:00:02 kjournald
  755 ?        00:00:00 kjournald
  756 ?        00:00:00 kjournald
  757 ?        00:00:01 kjournald
  801 ?        00:00:00 flush-8:0
 1035 ?        00:00:00 rsyslogd
 1089 ?        00:00:00 modem-manager
 1094 ?        00:00:01 polkitd
 1114 ?        00:00:02 wpa_supplicant
 1126 ?        00:00:00 gdm3
 1137 ?        00:00:00 gdm-simple-slav
 1141 tty7     00:20:11 Xorg
 1146 ?        00:00:07 acpid
 1169 ?        00:00:00 atd
 1195 ?        00:00:00 bluetoothd
 1209 ?        00:00:00 l2cap
 1212 ?        00:00:00 krfcommd
 1273 ?        00:00:00 cron
 1303 ?        00:00:00 cupsd
 1597 ?        00:00:07 kerneloops
 1627 ?        00:00:00 kconservative
 1631 ?        00:00:00 console-kit-dae
 1771 ?        00:00:00 sshd
 1800 tty1     00:00:00 getty
 1801 tty2     00:00:00 getty
 1802 tty3     00:00:00 getty
 1803 tty4     00:00:00 getty
 1804 tty5     00:00:00 getty
 1805 tty6     00:00:00 getty
 1852 ?        00:00:00 gdm-session-wor
 1857 ?        00:00:15 upowerd
 2017 ?        00:00:00 kauditd
 2172 ?        00:00:02 udisks-daemon
 2176 ?        00:00:00 udisks-daemon
 3038 ?        00:00:00 udevd
 3039 ?        00:00:00 udevd
 3251 ?        00:00:00 NetworkManager
 3440 ?        00:00:00 dhclient
 5322 ?        00:00:00 kworker/u:2
 6717 ?        00:00:00 sleep
 6720 ?        00:00:00 sleep
13386 ?        00:00:00 kworker/1:2
21237 ?        00:00:02 kworker/0:2
24297 ?        00:00:11 kworker/1:1
27326 ?        00:00:02 kworker/0:1
29045 ?        00:00:01 kworker/u:0
30132 ?        00:00:00 migration/1
30134 ?        00:00:00 ksoftirqd/1
30135 ?        00:00:00 watchdog/1
30238 ?        00:00:48 irq/19-0000:01:
31245 ?        00:00:00 kworker/u:1

Answer 1

That's a long list, surely you don't expect us to review it line by line? It's normal to have many processes running as root: unix systems often have one process to do each job, so many system services get their own process. In fact, some of these (e.g. all the /0 or / (the number identifies a CPU), and most of the ones beginning with k) are kernel threads.

If you're worried about someone gaining control of your machine, ps is not a useful tool. Any halfway decent¹ rootkit contains code to hide any malicious process from process listings. Even if the malicious code was not running as root and so couldn't change the kernel reports, it would disguise itself as something innocuous like sh.

¹ _{Yes, “decent” may not be the right word here.}

Answer 2

The idea of assessing whether a process is malicious based on its name is an idea that has been outdated for at least ... well, very long ;)

False flag operations, anyone?

1. an infector could well append/insert malicious code into any binary
2. a malicious binary could very well pose under the same name as something you'd normally consider harmless and your list gives no idea about the location of the binaries in the file system or their file bits. For example a setuid binary owned by root corresponding to one of these processes should at least be checked ...
3. a rootkit usually attempts to hide, so it would not even appear in the list

And that list is not exhaustive. Also, a system that is running malicious code with super user rights has no (technical) problem to lie to you.

At the very least an offline analysis would be required. If you use a package manager, you could compare the binaries at their expected locations against the hashes in the (signed) packages. Overall that should leave only a tiny subset of binaries actual binaries for you to inspect, besides the numerous scripts. But even for scripts, those coming in packages will have an accompanying hash against which you can check the binary.

Answer 3

The sole rootkit I've ever encountered in the wild (under Solaris 8 a long time ago) did run a password sniffer, as an "lpsched" process. The problem was that it ran two of them (bug in the rootkit) and ran them out of a directory that "man lpsched" said wasn't where lpsched lived. Also, "ps" had been trojaned to not show the extra weird lpsched processes, but top showed them.

If you're really concerned, look at all the PIDs in /proc. Look at what /proc/$PID/exe links to, to see where the executable really lives. Double check that against where the executable ought to live. Try "ls" on all the directories you find that way to see if "ls" shows them all. "ls" not showing a directory is a dead giveaway that something's wrong.

If any specific process seems suspicious, get chkrootkit (http://www.chkrootkit.org/) and rootkit hunter (http://www.chkrootkit.org/) and try them to see if they find anything. You have to be aware that some rootkits float around in the wild, but have never gotten incorporated in those rootkit hunters.