Re: Am I infected with a rootkit?

From	Jesper Dybdal <jd-debian-user@dybdal.dk>
Newsgroups	linux.debian.user
Subject	Re: Am I infected with a rootkit?
Date	2023-04-19 16:00 +0200
Message-ID	<GmgvL-35uv-3@gated-at.bofh.it> (permalink)
References	<Gl9G1-2pKU-1@gated-at.bofh.it> <Gl9Zn-2pRY-3@gated-at.bofh.it> <GlTSx-2RK6-1@gated-at.bofh.it> <GlZlf-2Vda-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 2023-04-18 21:35, David Christensen wrote:
> On 4/18/23 06:43, Jesper Dybdal wrote:
>> On 2023-04-16 14:19, I wrote:
>>> ...
>>> And there in the bash history were 4 lines that I had not written :-(
>>
>> To summarize:
>>
>> * Greg has convincingly argued that there is no way for the running 
>> shell to get those lines into its history, other than by issuing them 
>> over the ssh connection.
>>
>> * We can therefore assume that the problem originated at the Windows 
>> machine (the ssh client).
>>
>> * It seems that an intruder has had control over the Windows machine, 
>> including the ssh session, and thus, at least in principle, could 
>> have done harm also to the Linux machine.
>>
>> * There is, however, no sign of an infection of the Linux machine. 
>> And the 4 lines do not suggest that whoever issued them knows what 
>> he's doing.
>>
>> * So I am going to assume that the Linux machine is ok.
>>
>> * The Windows machine could be infected with something that allows 
>> remote control.
>>
>> * So I should probably reinstall the Windows machine from scratch - 
>> or perhaps restore a really old backup (I have one from July 2022, 
>> one from 2020, and one taken shortly after the original install in 
>> 2016).
>>
>> Many thanks to everybody who answered!
>> Jesper
>
>
> I do not believe the analysis is complete -- I never saw an answer to 
> the following question (?); it is important:
>
> On 4/17/23 21:42, David Wright wrote:
> > OK, you wrote that you "pressed up-arrow a few times. And there in the
> > bash history were 4 lines …". If those 4 lines were not the first
> > things to appear when you pressed up-arrow, then I would assume that
> > the commands you typed/just/  before you went out with the dog were
> > the first lines to appear, and then your 4 lines after more up-arrows.
> >

I unfortunately did not note the exact sequence including context.

I think that I would have noticed it if those commands were visible on 
the screen before I pressed up-arrow.

> > If that's the case, then your 4 lines could have been typed
> > in a previous login as root, and that could have been some time
> > ago. They would have been languishing at the end of the file
> > /root/.bash_history before you logged in as root this time.
> Where the four commands in questions the very last commands entered 
> into Putty, or were they prior?  If the latter, how far back?  Same 
> session? Same day?  A day ago?  Week? Month?
You're right.  I had overlooked that possibility: they might indeed be 
from a previous session.  I don't think it is likely, though, since I 
had used the active session for some time before walking the dog, and I 
did not go far back in the history before I found those commands.

If something like that happens again, I'll take better care to gather 
and keep the evidence :-(

Many thanks for your effort,
Jesper

-- 
Jesper Dybdal
https://www.dybdal.dk

Thread

Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 14:30 +0200
  Re: Am I infected with a rootkit? Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2023-04-16 14:50 +0200
    Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-16 15:20 +0200
      Re: Am I infected with a rootkit? Greg Wooledge <greg@wooledge.org> - 2023-04-16 16:00 +0200
        Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-16 17:20 +0200
    Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 16:10 +0200
    Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-18 15:50 +0200
      Re: Am I infected with a rootkit? David Christensen <dpchrist@holgerdanske.com> - 2023-04-18 21:40 +0200
        Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-19 16:00 +0200
  Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-16 15:00 +0200
    Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 16:10 +0200
      Re: Am I infected with a rootkit? Jeffrey Walton <noloader@gmail.com> - 2023-04-16 16:50 +0200
      Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-16 17:20 +0200
  Re: Am I infected with a rootkit? Greg Wooledge <greg@wooledge.org> - 2023-04-16 15:10 +0200
    Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 16:40 +0200
      Re: Am I infected with a rootkit? Greg Wooledge <greg@wooledge.org> - 2023-04-16 18:00 +0200
        Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 18:50 +0200
          Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-16 19:30 +0200
        Re: Am I infected with a rootkit? "Thomas Schmitt" <scdbackup@gmx.net> - 2023-04-16 19:40 +0200
          Re: Am I infected with a rootkit? David Wright <deblis@lionunicorn.co.uk> - 2023-04-16 20:50 +0200
          Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 22:20 +0200
      Re: Am I infected with a rootkit? Curt <curty@free.fr> - 2023-04-17 18:50 +0200
  Re: Am I infected with a rootkit? Jesper Dybdal <jd-debian-user@dybdal.dk> - 2023-04-16 16:40 +0200
    Re: Am I infected with a rootkit? <tomas@tuxteam.de> - 2023-04-16 17:20 +0200
    Re: Am I infected with a rootkit? David Wright <deblis@lionunicorn.co.uk> - 2023-04-18 06:50 +0200
      Re: Am I infected with a rootkit? David <bouncingcats@gmail.com> - 2023-04-18 07:40 +0200
        Re: Am I infected with a rootkit? <tomas@tuxteam.de> - 2023-04-18 10:00 +0200
          Re: Am I infected with a rootkit? debian-user@howorth.org.uk - 2023-04-18 13:00 +0200
            Re: Am I infected with a rootkit? <tomas@tuxteam.de> - 2023-04-18 13:10 +0200
          Re: Am I infected with a rootkit? David <bouncingcats@gmail.com> - 2023-04-18 14:10 +0200
            Re: Am I infected with a rootkit? <tomas@tuxteam.de> - 2023-04-18 14:30 +0200
              Re: Am I infected with a rootkit? songbird <songbird@anthive.com> - 2023-04-18 18:00 +0200
                Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-18 18:30 +0200
                Re: Am I infected with a rootkit? Andy Smith <andy@strugglers.net> - 2023-04-18 20:40 +0200
        Re: Am I infected with a rootkit? Jesper Dybdal <jesper@dybdal.dk> - 2023-04-18 16:00 +0200
  Re: Am I infected with a rootkit? David Wright <deblis@lionunicorn.co.uk> - 2023-04-16 16:40 +0200
  Re: Am I infected with a rootkit? David Christensen <dpchrist@holgerdanske.com> - 2023-04-17 03:20 +0200
    Re: Am I infected with a rootkit? Michel Verdier <mv524@free.fr> - 2023-04-17 17:40 +0200
    Re: Am I infected with a rootkit? Stefan Monnier <monnier@iro.umontreal.ca> - 2023-04-17 19:00 +0200
      Re: Am I infected with a rootkit? Tim Woodall <debianuser@woodall.me.uk> - 2023-04-17 20:30 +0200
  Re: Am I infected with a rootkit? Richmond <dnomhcir@gmx.com> - 2023-04-18 10:40 +0200
    Re: Am I infected with a rootkit? Jesper Dybdal <jesper@dybdal.dk> - 2023-04-18 16:00 +0200
      Re: Am I infected with a rootkit? Jeremy Ardley <jeremy@ardley.org> - 2023-04-18 16:10 +0200
        Re: Am I infected with a rootkit? Charles Curley <charlescurley@charlescurley.com> - 2023-04-18 17:00 +0200

csiph-web