5

Let's say I hire someone (freelance), for IT work on an Ubuntu server. The server has a good firewall, I run clamav, chkrootkit & rkhunter scans weekly, and I try to keep good practices.

The thing is, if I suspect that he installed some backdoor on the machine, how would you search for it? He had root access and plenty of time, so...

I know this theme has been discussed earlier, but most were theoretical rather than practical answers.

NOTE: This is on a remote server, so I'm not able to do hardware-based analysis.

  • 4
    Really, you can't. If you suspect a server's been compromised, a clean install is the best option. There are just too many ways to hide a backdoor for there to be any reliable way of searching for them. You can't even necessarily trust the output of any commands you run. – tlng05 Jun 8 '16 at 1:05
  • @tlng05 I'm able to run a rescue image, which I know is legitimate, and then run diagnostics. – Agustín Covarrubias Jun 8 '16 at 1:08
  • 3
    That helps, but the general idea still applies. There are just too many ways a backdoor can hide and many are simplistic enough to not be picked up by scanners. You need to be able to trust the people you give root access to. – tlng05 Jun 8 '16 at 1:14
  • @tlng05 should I delete this question? hahaha – Agustín Covarrubias Jun 8 '16 at 1:15
  • 3
    Don't delete the question, it's useful and interesting to other people. – Mike Ounsworth Jun 8 '16 at 2:36
6

To expand on @tlng05's point, rootkit authors are professionals, often with decades of experience. Unless you have decades of experience fighting rootkits, then they'll know about more hiding places than you do :P

If you suspect there's a rootkit, then your only choice is to wipe the system. This is a classic example of Ken Thompson's reflection on trusting trust "you have to trust the people, because you'll never find the exploit".

Next time, I suggest being more strict about who you give root access to.

  • 1
    While this is true if the defender hasn't done any preparation, you can certainly detect a rootkit if you use AIDE or a similar offline integrity checker. This is of course assuming a software rootkit. – forest Dec 8 '18 at 4:00
1

That highly depends on the complexity of the attack. If it's a simple backdoor, you have a chance of finding/eliminating the backdoor with the following method:

1.

netstat -antp

search for the sending port/program and remember the pid + ip.

2.

lsof -p <the pid>

look up the dies which are showing up. (These are the files used by the sending process)

3.

  • Try deleting these files
  • Block the IP via. iptables (tutorial)
  • Change passwords of all your users
  • Pray

Notice, this is NOT a guaranteed way to remove the backdoor. Like tlng05 already mentioned, the most secure method would be to backup your important files and wipe the complete system. (I strongly recommend doing so too)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.