1

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of:

enter image description here

The first one was obviously a rootkit checker and it was something I had previously had installed. But the other two I did not recognise and their stated purpose has given me cause for alarm:

(admin): active password cracking tool - character sets

http://packages.ubuntu.com/search?keywords=john-data

And furthermore:

John the Ripper is a fast password cracker, available for many operating systems. Its primary purpose is to detect weak Unix passwords, although Windows LM hashes and a number of other password hash types are supported as well. John the Ripper is free and Open Source software, distributed primarily in source code form.

http://www.openwall.com/john/pro/linux/

Seeing as I have never installed any security software designed to detect weak passwords, and I have never installed a password cracker before (and why even on my own machine?), do I have to seriously consider this to be particularly nafarious?

I might add for context I'm in proceedings with the Investigatory Powers Tribunal over illegal surveillance from GCHQ and the presence of a password cracker (which has to be the second weirdest thing within the last two weeks, the first being a phone call from Palestine/Israel) has me particularly unnerved, especially given I am unaware of any particular packages that would require a system to expose vulnerable packages.

Should I consider this nefarious, or am I mistaken?

[My sudo password has already been changed in light of this.]

  • For sudo, root command used in Linux systems. As opposed to a login password or user password. – c1646091 Jun 26 '16 at 23:11
  • I ran sudo passwd – c1646091 Jun 26 '16 at 23:29
  • 1
    That's not how it works. sudo asks for the current user's password. When you type sudo passwd you are setting root's password. This has no relation to the password you get when you run sudo subsequently. In fact, many people recommend against allowing root logins. You may want to fix your root account – Neil Smithline Jun 26 '16 at 23:47
  • @techraf I wouldn't have figured it because I had assumed sudo was root only (my unfamiliarity with Linux still showing). I'm now quite surprised to see I've actually increased the surface attack space by not closing down alternate means of gaining root powers. – c1646091 Jun 27 '16 at 6:11
7

John is not typically run on victim's computers. It has two uses. First, an attacker runs john on their computer to try and crack a victim's password. Second, a sysadmin can run john locally to look for weak passwords. So I wouldn't assume that you've been hacked just because john was installed.

From the message in your post, it looks like you installed some package X that required john and then subsequently uninstalled X. Now the system is offering to clean up for you.

Exactly what package X was is impossible for me to know. Perhaps someone on AskUbuntu knows how to do some package history magic so that you can recover that information.

  • 3
    Exactly. Neil is right. Ubuntu would never label as "automatically installed" something that was manually installed. The packages which depends on or suggests "john" (included in Ubuntu repository) are: tiger, checksecurity (which depends on tiger), harden-tools, sipcrak. As chkrootkit is also suggested by "tiger"... there you have. – lepe Jun 27 '16 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.