0

I did my research and the first things that I did to test my system was to run some commands based on my research. The problem is trying to determine if I am truly infected. Any, confirmation will be helpful based on the results of the commands given.

Ebury version 1.5 On Linux-based systems, an additional shared library file 'libns2.so' is installed and the existing libkeyutils file is patched to link against this library instead of libc6. The malicious 'libns2.so' file can be located by running the following command, which should not return any results on clean systems. Based on this information above I have ran the command down below to see if I am infected nothing shows up.

# find /lib* -type f -name libns2.so /lib64/libns2.so
#

Ran this command that I found on ubuntufourms to see if I am infected.Command says I am infected.

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"

   System infected

Ebury now uses Unix domain sockets instead of shared memory segments for interprocess communication. The malicious socket can be located using 'netstat' as follows. Again, this command should not return any results on clean systems.

 # -nap | grep "@/proc/udevd"
 #

Nothing showed up probably because of the iptables rules that blocks all incoming ssh connections.

Why, has the grep commands that I found on ubuntufourms say I am infected when the others say I am not. Can the backdoor be dormant if iptables is blocking any ssh connection if there is a backdoor?

closed as unclear what you're asking by Gilles, techraf, Rory Alsop Aug 4 '16 at 11:45

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    What makes you think you are infected? Also, on the basis of your hostname, you probably shouldn't be posting screenshots. – Jesse K Aug 2 '16 at 4:35
  • Apart from running a command that you don't understand and that doesn't tell anything useful that I can see, what makes you think that your system is infected with some malware? And don't post screenshots of text. – Gilles Aug 2 '16 at 9:29
  • 1
    This test is to determine susceptibility to that type of attack, not being necessarily infected as it misleads you to believe. – Julie Pelletier Aug 2 '16 at 16:01
1

It would be nice to know why you assume being infected. You usually should get warnings from your ISP that your system has outgoing connections to a dropzone server, alternatively if you run Snort it should be able to detect it. You can disable your internet connection and deactivate iptables so you can see the connection attempts.

If your system is infected on root level you have to wipe it, also all SSH keys are compromised. Also check all systems in your network.

  • I am a little concerned, because I used to live in a town where there were "targeted individuals" for harassment and I have been a subject of survelliance. Every time when a crime was committed by someone in the neighborhood planes always appear in the sky. The police actually use planes like police helicopters. Take a look at these articles starting with the planes. washingtonpost.com/business/technology/… – Travis Wells Aug 2 '16 at 15:15
  • In that case you should not be running Kali at all, it's one of the most insecure distros to run privately and productively. If you are paranoid use Tails or Qubes or otherwise any other distro will be fine. – AdHominem Aug 2 '16 at 16:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.