I suspect to be the target of very skilled hackers.
5 or 6 years ago I found spyware on my Linux webserver, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 hash of the original ppp_deflate. Everything started because 2 sites were looking offline but they weren't.
I suspected that the only way to be infected from that spyware was to connect to a p2p network. Then I formatted a new PC, upgraded, md5 of all files and I connected it to emule network. After few minutes it was infected in an totally invisible way. No kernel crash/dump, no emule crash, no trace of intrusion. Also, at runtime the md5 hash of all file was OK, every file match his original hash. But from the live cd the ppp_deflate module had a different md5 from its original.
Then I made the last test. I formatted again and compared the md5 of original ppp_deflate and the infected ppp_deflate. And they was different. After that I did:
# rmmod ppp_deflate
and then I load the infected one
# modprobe ppp_deflate
.. now the hash of the infected module was the same of the original!!! I went to the police with my problem... but the policeman said that my Windows PC had probably been poorly configured...
5 or 6 years ago I had suspected that my box had been hacked because I found a strange guy on irc and other chat forums that knew some of my personal information. On these months was happening the same strange things..
I don't want to use antirootkit tools because I know they don't work.
Then my question is: Where should I search on my linux box to find a spyware ? My ideas are:
- firmware (efi,nic,vga,cd/dvd burner etc) (very difficult)
- MBR and bootsector (boot kit..) (maybe)
- statically compiled kernel (unlikely)
- lkm (maybe)
- initrd (maybe)
- binaries (init, core bin, etc) (too stupid)
- libraries (libc and so on) (too stupid)
- limited process automatically started by gnome (easy)
- firefox or chrome extensions (easy)
My distro is the last Ubuntu with last kernel 3.0..) I am sorry... the last thing.. I don't want to solve my problem with yet another format.. I want find if there is problem. So I want to have the most complete checklist to find malware.
I haven't any services running, also I have 2 firewalls: one on my pc and one on my router. The passwords have been changed.
Thanks very much for your answer[s].