I did my research and the first things that I did to test my system was to run some commands based on my research. The problem is trying to determine if I am truly infected. Any, confirmation will be helpful based on the results of the commands given.
Ebury version 1.5 On Linux-based systems, an additional shared library file 'libns2.so' is installed and the existing libkeyutils file is patched to link against this library instead of libc6. The malicious 'libns2.so' file can be located by running the following command, which should not return any results on clean systems. Based on this information above I have ran the command down below to see if I am infected nothing shows up.
# find /lib* -type f -name libns2.so /lib64/libns2.so #
Ran this command that I found on ubuntufourms to see if I am infected.Command says I am infected.
ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected" System infected
Ebury now uses Unix domain sockets instead of shared memory segments for interprocess communication. The malicious socket can be located using 'netstat' as follows. Again, this command should not return any results on clean systems.
# -nap | grep "@/proc/udevd" #
Nothing showed up probably because of the iptables rules that blocks all incoming ssh connections.
Why, has the grep commands that I found on ubuntufourms say I am infected when the others say I am not. Can the backdoor be dormant if iptables is blocking any ssh connection if there is a backdoor?