From: Luke Kenneth Casson Leighton <lkcl@lkcl.net>
To: linux-kernel@vger.kernel.org
Subject: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting
Date: Mon, 25 Jul 2011 13:08:06 +0100 [thread overview]
Message-ID: <CAPweEDzv+vByC1s2bWRjVQdVLqw4Xf2sUf_CQgVync_YcxtdvQ@mail.gmail.com> (raw)
folks, hi,
i appreciate this was some time ago, but i encountered a quite serious
issue with an ext3 filesystem that had been hacked, and a rootkit
installed. this was with a 2.6.26 kernel. the issue encountered was
that the little fuckers directly modified the ext3 filesystem so that
some files they had created could *not* be deleted. when i say "could
not be deleted" i mean "absolutely could not be deleted". also, fsck
did *not* report any "problems".
and yes, please do give me credit for knowing that you should use a
different system (offline) to analyse the [damaged] filesystem :) as
you can imagine, i was very very surprised to encounter this as an
issue.
first thing: has anyone else encountered this?
second thing: if answer "no" to above, would anyone who can prove
their credentials (public ssh key, public web site, notability blah
blah) like to analyse the 5gb filesystem? i still have a copy (it's
an LVM2 partition on a Xen hosted server).
apart from anything, this really really should go into rkhunter /
chkrootkit, but it requires someone with expertise to actually analyse
what the bloody hell happened. apart from anything, files which
cannot be deleted (and cannot be detected as "corrupted" by fsck.ext3)
is pretty damn serious.
l.
next reply other threads:[~2011-07-25 12:08 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-25 12:08 Luke Kenneth Casson Leighton [this message]
2011-07-25 13:45 ` Matthias Schniedermeyer
2011-07-25 21:08 ` Luke Kenneth Casson Leighton
2011-07-29 19:59 ` Pavel Machek
2011-07-29 21:31 ` Matthias Schniedermeyer
2011-07-29 22:51 ` Pádraig Brady
2011-07-30 2:47 ` Kyle Moffett
2011-07-30 9:14 ` Jim Meyering
2011-07-30 13:03 ` Luke Kenneth Casson Leighton
2011-07-30 13:15 ` Luke Kenneth Casson Leighton
2011-07-30 12:58 ` Luke Kenneth Casson Leighton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAPweEDzv+vByC1s2bWRjVQdVLqw4Xf2sUf_CQgVync_YcxtdvQ@mail.gmail.com \
--to=lkcl@lkcl.net \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®