Re: Duplicate '..' in /lib

[J Troy Piper <jtp@dok.org>]

[-- Attachment #1: Type: text/plain, Size: 2893 bytes --]

> As it turns out, the extraneous '..' is actually a file. I did a rm ..*,
> which left the original .. directory alone but removed the .. file. Did a
> e2fsck on reboot, no problems found.
> 

Yes, good to remove the file, but now my main concern is that your system 
may have been compromised as the old ".." dir-not-really file entry may 
have other connotations.  It is definately a possibility of a cracked 
system (as the .. file appears in many new r00tkit type exploits.) i would 
do some extensive forensics on the machine in question.  are there new 
entries in /etc/passwd or /etc/shadow that shouldn't be there?  

DISCLAIMER - I am not insisting your machine was compromised, but why be 
lax about it?  Check the system in every way possible to determine if 
someone has cracked and installed a r00tkit on your box.  just getting rid 
of the single .. entry may not be enough.  look for other suspicious 
files, keep copies of them before deleting the ones available to the 
public in /lib or /usr or whatever, and check out any suspicious files 
that were created/modified/accessed in the same window (5 or 6 minuites) 
as the double .. entry in /lib

it sounds to me like someone MAY have been trying to replace system lib 
files, or even perhaps load malicious kernel code in modules.  at my job, 
this system would be immediately taken off the 'production line' until a 
thorough examination/investigation can be done.  check logins around the 
ctime of the original .. creation and compare with who was logged in etc 
etc.

this may be nothing, it may be a nasty kernel bug, or it may be malicious 
hackers attampting to pull the wool over your eyes.

be PARANOID in any situation in which your machine MAY have been 
compromised and persue the forensic evidence until you hit a titanium
wall (a brick wall can be easily broken down). 

If you have no idea where to go from here, send me email logs of what has 
been found and i will give it my best shot at determining whether this is 
a kernel bug (which i would assume would've been caught and dealt with by 
now), or a nasty attack involving a rootkit, so the 'attackers' can regain 
access to the system.

Start with "netstat --inet -a" and see if you find any open ports that 
shouldn't be open.  That would be the first indication of a rootkit that 
allows the rootkitter (person installing the rootkit) to regain access to 
the system even after it has been 'locked down'.  

rootkits are well know for leaving SEVERAL backdoors so that if one is 
found, the attacker still has multiple ways to re-enter and re-penetrate 
the system. 

----
J Troy Piper
jtp@dok.org

PS - sorry about the FUD slam about 'the evil cracker' but we all know 
they DO exist, and the weaker the admin, the easier it is to take 
advantage of the systems under the admin's control.


[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]