2

I just noticed a symbolic link named .#tmp.tmp# in my home directory (not created by me) and it pointed to [email protected]:177780xxxx where the x's are additional numbers.

A google search revealed that 6912 is a port used by Trojan's etc. I deleted the symlink and confirmed that port 6912 is closed. But nonetheless I believe my personal system may have been compromised. I do not collect logs as it is a personal system with limited HD. I ran a clamav scan on my home directory and no infections were detected. Presently running a scan on my root directory.

I do not use the system with root privileges and run elevated commands with sudo only.

I would like to get some guidance from the community on the following beliefs or questions:

  1. Since I do not use the system with root privileges. Most likely the only files tampered with are in my home directory?
  2. Can a port be opened for communication without root privileges?
  3. Is it possible to review the contents of the file 177780xxxx?
  4. Am I reading this situation incorrectly?

Thanks for the help!

EDIT: Turns out [email protected]:177780xxxx is not really a bad thing. Actually it is intended behavior of Emacs (https://stackoverflow.com/questions/5738170/why-does-emacs-create-temporary-symbolic-links-for-modified-files) when creating temporary files. The format of the symbolic link is [email protected]:somestringofnumbers. It just turned out that the number 6912 coincided nicely with some trojan posts on a google search. Woe for me for I just completed a whole system restore!!

2 Answers 2

1

Running user commands as a normal user (and not root) is good but it is not the only factor that influences the security of your system.

Other important factors are:

  • running a Linux distribution that is still in the support cycle, i.e. where vulnerabilities are still addressed with package updates
  • applying security related updates in a timely manner
  • disabling well known security nightmares: e.g. the Flash browser plugin, the Java browser plugin, the Adobe PDF browser plugin
  • installing an Ad blocker like AdBlock Plus - because ad-networks are often used to distribute malware (e.g. via exploiting browser bugs)
  • if you are running sshd: disabling password-authentication in sshd (switch to public-key-auth instead) otherwise script-kiddies might guess your password

Even if you are using your system as normal user most of the time, an attacker might use some exploit to also gain root privileges.

By default, an unrestricted user process can open any port over 1023.

If you suspect a compromised system you should do the following:

  • shut it down immediately
  • use another clean system to connect the disk drives to - to create images of the disks - those images can then be used (read-only) for forensics and/or to rescue some user data in case your last regular backup is too old
  • wipe the partition table, boot sector etc. of your possible compromised drives
  • obtain an install image for your Linux distribution from a trusted source - e.g. download it from a clean machine and verify its checksums and signatures
  • install your system with that image

If you care about security you can choose a Linux distribution that has mandatory access control (MAC) enabled by default - e.g. Fedora or CentOS (they use SELinux). The MAC is able to render some classes of exploits ineffective.

0

Further to the previous answer re query 1... Look at another MAC: the MAC time - the Modified, Accesses and Changed/Created time of the symbolic link you found and then look for other files and folders with the same or similar modified times. Note These times can be changed using utilities such as Stomp.

It may help to assist you in how the attack came to pass - For example you could have visited a malicious site at the time and inadvertently helped install a Trojan.

Also the likely attack pathway would be gain a foothold on your host, and then, seek to escalate privileges to root. Though I have seen attackers ignore the compromised box internally and use the box instead to attack other hosts on the Internet.

There are several ways to use a miss-configured sudoers file to escalate to root and hence using Sudo does give a measure of protection, it is not hard to gain a false sense of security if it has been set up incorrectly e.g. if an attacker gains access to a user account that can run the command...

sudo /usr/bin/vi

then they can use commands in vi like :e or control o and use :w to access /etc/shadow and have a chance to crack the root encrypted password.

1
  • Yes, I used the MAC time run a find command to return a list of all modified files since then. But sadly it is filled with scores of browser temp files that are difficult to really know which are genuine vs doctored. A follow up with regard to sudo: I force the user account to enter root password to run a sudo command and not the user's password. It was my assumption that it would prevent sudo loopholes such as sudo /usr/bin/vi?
    – vsoda
    Nov 22, 2015 at 18:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .