0

I tried logging in to my admin account and it said password incorrect. There is no way it could have been incorrect since I copy-pasted it from a usb drive. I reset my password, installed chkrootkit and found out that I've been infected with a rootkit. So what do I do, just delete the files chkrootkit reported? Here is the terminal output:

user1@user1-linux ~ $ sudo chkrootkit
[sudo] password for username: 
ROOTDIR is `/'
Checking `amd'...                                           not found
Checking `basename'...                                      not infected
Checking `biff'...                                          not found
Checking `chfn'...                                          not infected
Checking `chsh'...                                          not infected
Checking `cron'...                                          not infected
Checking `crontab'...                                       not infected
Checking `date'...                                          not infected
Checking `du'...                                            not infected
Checking `dirname'...                                       not infected
Checking `echo'...                                          not infected
Checking `egrep'...                                         not infected
Checking `env'...                                           not infected
Checking `find'...                                          not infected
Checking `fingerd'...                                       not found
Checking `gpm'...                                           not found
Checking `grep'...                                          not infected
Checking `hdparm'...                                        not infected
Checking `su'...                                            not infected
Checking `ifconfig'...                                      not infected
Checking `inetd'...                                         not infected
Checking `inetdconf'...                                     not found
Checking `identd'...                                        not found
Checking `init'...                                          not infected
Checking `killall'...                                       not infected
Checking `ldsopreload'...                                   not infected
Checking `login'...                                         not infected
Checking `ls'...                                            not infected
Checking `lsof'...                                          not infected
Checking `mail'...                                          not found
Checking `mingetty'...                                      not found
Checking `netstat'...                                       not infected
Checking `named'...                                         not found
Checking `passwd'...                                        not infected
Checking `pidof'...                                         not infected
Checking `pop2'...                                          not found
Checking `pop3'...                                          not found
Checking `ps'...                                            not infected
Checking `pstree'...                                        not infected
Checking `rpcinfo'...                                       not found
Checking `rlogind'...                                       not found
Checking `rshd'...                                          not found
Checking `slogin'...                                        not infected
Checking `sendmail'...                                      not found
Checking `sshd'...                                          not found
Checking `syslogd'...                                       not tested
Checking `tar'...                                           not infected
Checking `tcpd'...                                          not infected
Checking `tcpdump'...                                       not infected
Checking `top'...                                           not infected
Checking `telnetd'...                                       not found
Checking `timed'...                                         not found
Checking `traceroute'...                                    not found
Checking `vdir'...                                          not infected
Checking `w'...                                             not infected
Checking `write'...                                         not infected
Checking `aliens'...                                        no suspect files
Searching for sniffer's logs, it may take a while...        nothing found
Searching for rootkit HiDrootkit's default files...         nothing found
Searching for rootkit t0rn's default files...               nothing found
Searching for t0rn's v8 defaults...                         nothing found
Searching for rootkit Lion's default files...               nothing found
Searching for rootkit RSHA's default files...               nothing found
Searching for rootkit RH-Sharpe's default files...          nothing found
Searching for Ambient's rootkit (ark) default files and dirs... nothing found
Searching for suspicious files and dirs, it may take a while... The following suspicious files and directories were found:  
/usr/lib/python3/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/jvm/.java-1.7.0-openjdk-amd64.jinfo /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/pymodules/python2.7/.path /lib/modules/3.19.0-32-generic/vdso/.build-id
/lib/modules/3.19.0-32-generic/vdso/.build-id
Searching for LPD Worm files and dirs...                    nothing found
Searching for Ramen Worm files and dirs...                  nothing found
Searching for Maniac files and dirs...                      nothing found
Searching for RK17 files and dirs...                        nothing found
Searching for Ducoci rootkit...                             nothing found
Searching for Adore Worm...                                 nothing found
Searching for ShitC Worm...                                 nothing found
Searching for Omega Worm...                                 nothing found
Searching for Sadmind/IIS Worm...                           nothing found
Searching for MonKit...                                     nothing found
Searching for Showtee...                                    nothing found
Searching for OpticKit...                                   nothing found
Searching for T.R.K...                                      nothing found
Searching for Mithra...                                     nothing found
Searching for LOC rootkit...                                nothing found
Searching for Romanian rootkit...                           nothing found
Searching for Suckit rootkit...                             Warning: /sbin/init INFECTED
Searching for Volc rootkit...                               nothing found
Searching for Gold2 rootkit...                              nothing found
Searching for TC2 Worm default files and dirs...            nothing found
Searching for Anonoying rootkit default files and dirs...   nothing found
Searching for ZK rootkit default files and dirs...          nothing found
Searching for ShKit rootkit default files and dirs...       nothing found
Searching for AjaKit rootkit default files and dirs...      nothing found
Searching for zaRwT rootkit default files and dirs...       nothing found
Searching for Madalin rootkit default files...              nothing found
Searching for Fu rootkit default files...                   nothing found
Searching for ESRK rootkit default files...                 nothing found
Searching for rootedoor...                                  nothing found
Searching for ENYELKM rootkit default files...              nothing found
Searching for common ssh-scanners default files...          nothing found
Searching for suspect PHP files...                          nothing found
Searching for anomalies in shell history files...           nothing found
Checking `asp'...                                           not infected
Checking `bindshell'...                                     not infected
Checking `lkm'...                                           chkproc: nothing detected
chkdirs: nothing detected
Checking `rexedcs'...                                       not found
Checking `sniffer'...                                       lo: not promisc and no packet sniffer sockets
eth0: PACKET SNIFFER(/sbin/dhclient[1166])
Checking `w55808'...                                        not infected
Checking `wted'...                                          chkwtmp: nothing deleted
Checking `scalper'...                                       not infected
Checking `slapper'...                                       not infected
Checking `z2'...                                            user user2 deleted or never logged from lastlog!
user user1 deleted or never logged from lastlog!
user user3 deleted or never logged from lastlog!
Checking `chkutmp'...                                        The tty of the following user process(es) were not found
 in /var/run/utmp !
! RUID          PID TTY    CMD
! rasmus       2650 pts/0  /usr/bin/xflux -l 60° -k 3400 -nofork
chkutmp: nothing deleted
Checking `OSX_RSPLUG'...                                    not infected

Sorry about the messed up formatting, I don't know how to get it to display properly. Anyways, these files are infected:

The following suspicious files and directories were found:  
/usr/lib/python3/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/jvm/.java-1.7.0-openjdk-amd64.jinfo /usr/lib/python2.7/dist-packages/PyQt4/uic/widget-plugins/.noinit /usr/lib/pymodules/python2.7/.path /lib/modules/3.19.0-32-generic/vdso/.build-id
/lib/modules/3.19.0-32-generic/vdso/.build-id

Searching for Suckit rootkit...                             Warning: /sbin/init INFECTED

I also changed the firewalls settings so that it logs any suspicious action. I'm on Windows right now; I hope it can't spread to my Windows partition?

EDIT: I'm using Linux Mint as my personal OS so no networks are affected. I'll just wipe the drive.

  • 1
    The only safe solution is to wipe and reinstall. And patch the infection vector so it doesn't happen again. – roaima Mar 7 '16 at 18:39
  • 3
    when did you install Linux Mint? More importantly, when did you download the installer? Their site was hacked recently (Feb 20 2016) and compromised installer ISO images were uploaded. See blog.linuxmint.com/?p=2994 – cas Mar 7 '16 at 21:19
  • Installed on the 10th, found out yesterday, md5 checksum was correct. – What's my name Mar 7 '16 at 21:51
1

In general, you don't have to worry about a Linux rootkit spreading to a Windows system, but you have to be aware that a compromised network can open any system on it up to similar problems.

Don't delete /sbin/init! It controls your boot/shutdown, so deleting it will leave you with an unbootable system.

chkrootkit only looks for signatures, it doesn't check for the presence of known rootkit files, making it prone to false positives. Java is notorious for triggering these false positives, as are many other programming tools.

You're going to want to install rkhunter and scan your system, as it looks for signature files, but it's also prone to false positives, so don't be too quick to remove files without double-checking whether they belong there or not.

If your distro has a livecd, you can often copy that /sbin/init to the system, and it should boot okay, but no guarantees.

Personally, if you're certain your password is compromised on a system acting as a firewall for a network, I'd opt for a fresh install and do a more thorough job securing the system.

Tools like chkrootkit and rkhunter tend to be more useful for endpoint systems, especially for home users, rather than for primary entrance points, mainly because by nature, they're always chasing new developments in the security realm, so they'll never block the newest exploits.

Once a firewall is rooted, it's important to check all the systems on the network, as well. A Linux firewall may have it's password changed to lock you out, but a Windows system is an easy target, too.

It's possible that such a blatant attack means that the attacker intended to blackmail you for access into your locked out system, so check your mail logs, there might be a message in there asking for money, and preferably report the problem to the authorities in your area, so they can assist in tracking down these groups.

  • Sorry for not specifying, I'm running Mint as a personal OS. I'm a complete newbie at Linux. I don't know how this makes me feel about the safety of Linux, but since it is (or so it seems to me) a do-it-yourself OS, I might have neglected the necessary steps to secure my system... – What's my name Mar 7 '16 at 20:06
  • Linux Mint is very secure against general attacks, but a skilled attacker is a challenge to any OS. The LM default install includes a firewall (iptables, configured with ufw/gufw), that is locked down very tightly, but there may be other openings (browser, etc.) that an attacker may exploit. sites.google.com/site/easylinuxtipsproject/security is a good place to start learning more about securing your system. – jb listener Mar 7 '16 at 20:30
  • I do have gufw. I recently installed Tinyproxy, Firehol and Dansguardian for self moderation. Could Tinyproxy have been a possible way in? I have zero knowledge about networks so don't bother writing an elaborate answer ;) – What's my name Mar 7 '16 at 21:49
  • It's possible, and it's also possible that one of those has poor defaults that misconfigured IPTables. Dansguardian and gufw I know have safe default installations, not sure about the others. – jb listener Mar 7 '16 at 21:58
3

A bit of internet search shows that it may well be a false positive. Check your chkrootkit version:

$  chkrootkit -V

If it's below version 0.50, it can return false positive for Suckit, see here for the bug report.


Also, it was pointed that the Mint website was compromised on the 20th of Feb 2016 with a backdoor placed in the ISO image, not sure this has anything to do with what you reported. But you can still give it a shot:

How to check if your ISO is compromised?

If you still have the ISO file, check its MD5 signature with the command “md5sum yourfile.iso” (where yourfile.iso is the name of the ISO).

The valid signatures are below:

6e7f7e03500747c6c3bfece2c9c8394f  linuxmint-17.3-cinnamon-32bit.iso
e71a2aad8b58605e906dbea444dc4983  linuxmint-17.3-cinnamon-64bit.iso
30fef1aa1134c5f3778c77c4417f7238  linuxmint-17.3-cinnamon-nocodecs-32bit.iso
3406350a87c201cdca0927b1bc7c2ccd  linuxmint-17.3-cinnamon-nocodecs-64bit.iso
df38af96e99726bb0a1ef3e5cd47563d  linuxmint-17.3-cinnamon-oem-64bit.iso

If you still have the burnt DVD or USB stick, boot a computer or a virtual machine offline (turn off your router if in doubt) with it and let it load the live session.

Once in the live session, if there is a file in /var/lib/man.cy, then this is an infected ISO.

Finally, I would not be confidant with MD5 or SHA-1 sums for validating files integrity as these have been broken for years now, better checking against SHA-256 or higher.

  • Thanks, I found out a day before I was hacked that there was a hacked iso on Mint servers. I wasn't affected, and I did check the md5 checksum, see comment on my first post. Also my admin password was changed and so was the root shell in system recovery, i used the init=\bin\bash method. – What's my name Mar 11 '16 at 11:29
  • Checking checksums alone is is insufficient (regardless of the checksum hashing algorithm). Perhaps it doesn't apply specifically for this particular instance (i.e. the Mint compromised ISO in Feb) but checking checksums won't protect you from this sort of attack generally... If the attacker uploads a compromised image, why wouldn't they also update the checksums?! The only way to know that the checksums haven't been compromised is to check the pgp/gpg key of the checksum file! AFAIK Mint now sign their checksum files so you should check that it has been signed before you can be sure... – Jeremy Davis Apr 1 '16 at 3:51
1

You may wish to consider taking an image of the infected disk and use Autopsy from sleuthkit on an offline copy of the image to create a timeline and look for file system changes at the time the /sbin/init file was changed. The perp/rootkit could have STOMPed the modified, accessed and created time stamps, but at least you can get a feel for what they were after. - turning your device into a bot, ransomware or searching for an in to your network.

See http://www.sleuthkit.org/autopsy/docs/quick/

Alternatively hire in a local certified cyber forensic specialist who possibly can let you know what actually happened.

0

It is highly unlikely that, a rootkit written for Linux platform to spread into a windows partition or host, but again, considering the speed of advancements in the malware development, one can never be sure if it has an attack vector for neighboring windows instances.

Coming to how to fight it, there is no better solution than wiping and reinstalling the OS. Otherwise, one can never be sure if you caught everything or there was one straggler that you left behind.

0

The best way I was tought to deal with root kits is to wipe the drive. However; depending on how important your data is. You could make another SU / root account and disable / deprivilege the account running the rootkit.

Have you double checked for false positives?

0

Linux mint servers were hacked recently and someone placed infected ISO files in their download servers. Situation is back to normal now.

It is most likely you were hit by that. It's highly unlikely that you get hacked by a so pro unless you annoyed NSA/mafia very very bad.

Sadly, the only good way here is wipe the linux partition and reinstall.

Linux malware per-se cannot spread to windows, but linux malware is a program, so once it has root access it can do pretty much anything it wants, like downloading malware for windows from its own download server.

Run a scan with a Rescue CD, special linux distros made by antivirus companies so you can scan windows from a vantage point (it's unlikely that the antivirus installed in windows can do anything now), format linux mint partitions and reinstall with a NEW iso file you download now that they replaced the infected ones.

here the blog post of Linux Mint Team http://blog.linuxmint.com/?p=2994

  • See my comment on my first post. – What's my name Mar 11 '16 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.