discover virus or spyware under Linux

Question

I suspect to be the target of very skilled hackers.

5 or 6 years ago I found spyware on my Linux webserver, it was lkm masked as ppp_deflate module with md5 hash hijacked. I mean with the same md5 hash of the original ppp_deflate. Everything started because 2 sites were looking offline but they weren't.

I suspected that the only way to be infected from that spyware was to connect to a p2p network. Then I formatted a new PC, upgraded, md5 of all files and I connected it to emule network. After few minutes it was infected in an totally invisible way. No kernel crash/dump, no emule crash, no trace of intrusion. Also, at runtime the md5 hash of all file was OK, every file match his original hash. But from the live cd the ppp_deflate module had a different md5 from its original.

Then I made the last test. I formatted again and compared the md5 of original ppp_deflate and the infected ppp_deflate. And they was different. After that I did:

# rmmod ppp_deflate

and then I load the infected one

# modprobe ppp_deflate

.. now the hash of the infected module was the same of the original!!! I went to the police with my problem... but the policeman said that my Windows PC had probably been poorly configured...

5 or 6 years ago I had suspected that my box had been hacked because I found a strange guy on irc and other chat forums that knew some of my personal information. On these months was happening the same strange things..

I don't want to use antirootkit tools because I know they don't work.

Then my question is: Where should I search on my linux box to find a spyware ? My ideas are:

1. firmware (efi,nic,vga,cd/dvd burner etc) (very difficult)
2. MBR and bootsector (boot kit..) (maybe)
3. statically compiled kernel (unlikely)
4. lkm (maybe)
5. initrd (maybe)
6. binaries (init, core bin, etc) (too stupid)
7. libraries (libc and so on) (too stupid)
8. limited process automatically started by gnome (easy)
9. firefox or chrome extensions (easy)

My distro is the last Ubuntu with last kernel 3.0..) I am sorry... the last thing.. I don't want to solve my problem with yet another format.. I want find if there is problem. So I want to have the most complete checklist to find malware.

I haven't any services running, also I have 2 firewalls: one on my pc and one on my router. The passwords have been changed.

Thanks very much for your answer[s].

Answer 1

Well you made a very common mistake. Once a system is compromised you should reinstall the system and restore from backups. You can't trust it anymore. You also change every single password.

If they are skilled enough to change your MD5sum binary, they will probably be skilled enough to install a rootkit or similar.

• Was anything vulnerable, possibly vulnerable (something on the internet you wrote yourself, etc)?
• Did you reuse any passwords?
• Are there any services running?
• Does anyone else have physical access
• Do you go to dodgy sites and download cracked/special/homebrew software?

Answer 2

Diagnosis. First off, I am not convinced you were ever infected. You did not provide any evidence that you were infected. (Please understand that the MD5 of system files might routinely change for benign reasons, e.g., because the system did an automatic software upgrade and you got a new kernel version.) A change in the MD5 of a system file does not necessarily mean you are infected.

One thing I have seen in this business is that people sometimes get worried, and if they see something strange they don't understand, they attribute it to a virus or a hacker. That's understandable, but not necessarily rational. Computers are incredibly complicated, and unless you are a computer expert, you should expect that they will do things you don't understand all the time.

So, you might be right that your computer were infected. But also keep an open mind: keep in mind the possibility that maybe your computer was never infected, and maybe you are misinterpreting the things you see.

Recovery. If your machine is infected or compromised, there is only one safe way to respond: you need to "nuke it from orbit". In other words, disconnect from the network, reformat the hard drive, reinstall the operating system from a known-good source, set new passwords (don't reuse old ones), enable your system's firewall, re-connect to the network and immediately do a software update to get the latest version of all system software, change your online passwords, reinstall all your software from a known-good source, etc.

There is no complete checklist to find malware. I know you said you don't want to do a re-format, and I sympathize, but it really is the only option that will reliably remove an infection. Sorry. I know it sucks.

Answer 3

I've seen some unexplainables before similar to this. It turns out that the person being messed with was getting harrassed by an ex-employee of his ISP so the guy(ex-employee) would screw with previous customers since they knew how to manage the networks infrastructure and most coporations don't hire the caliber of employee that would make the system rock solid.

Solution: Change out your router to something that supports DD-WRT or go business/enterprise level and the problem should go away and of course generate your passwords. And don't setup a DMZ unless you want to gather evidence on a honeypot.

If you still have "unexplained issues" then you could buy or build a LAN tap for under $20 and put it between your router and modem and sniff the traffic in between with wireshark and investigate what is occuring on your network.

Out of curiosity who is your ISP and do they do any filtering, re-routing, or IP-shaping?