Re: Different MD5 from same kernel module tun.ko on different servers same distro

From	"x9p" <debian-security@x9pneu.com>
Newsgroups	linux.debian.security
Subject	Re: Different MD5 from same kernel module tun.ko on different servers same distro
Date	2017-09-03 05:00 +0200
Message-ID	<ultiG-2Hk-5@gated-at.bofh.it> (permalink)
References	<uls3f-1WP-9@gated-at.bofh.it> <ulsPD-2xW-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

> A better tool to compare binaries is diffoscope, it can disassembles
> ELF binaries and compare the assembly.
>
> Please upload the two tun.ko files to the trydiffoscope website so
> that we can investigate the differences more closely:
>
> https://try.diffoscope.org/

Thanks for the tip, just did, results are here:

https://try.diffoscope.org/ttrrkzfqqbre.html

didn't look like code was modified, just symbols

> These look like they are two different builds of the Debian Linux
> kernel package. If you or your cloud provider did not rebuild the
> Debian Linux kernel package, then it is possible your cloud server has
> been compromised and tun.ko modified with the version from a different
> build of the package.

I didn't compiled myself this module, neither cloud provider I believe,
bcz VPS is unmanaged.

> Are there any other modified files on the system? You can use debsums to
> check.
>

Just run it, all 65418 files came clean (OK). Also tun.ko because I
restored it from linux-image-3.16.0-4-amd64_3.16.43-2+deb8u3_amd64.deb

Also copied back old tun.ko (wrong MD5) and after run debsums again, it
failed on tun.ko - so behaviour of tool is ok.

> PS: I would suggest upgrading to Debian stretch at some point.

In my plans, soon.

>
> --
> bye,
> pabs
>
> https://wiki.debian.org/PaulWise
>
>

cheers.
Thanks for the help.

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Different MD5 from same kernel module tun.ko on different servers  same distro "x9p" <debian-security@x9pneu.com> - 2017-09-03 03:40 +0200
  Re: Different MD5 from same kernel module tun.ko on different servers  same distro Paul Wise <pabs@debian.org> - 2017-09-03 04:30 +0200
    Re: Different MD5 from same kernel module tun.ko on different  servers same distro "x9p" <debian-security@x9pneu.com> - 2017-09-03 05:00 +0200

csiph-web