I have a stalker, and six months ago, he got my someone to evil maid my devices with a USB stick that person had borrowed (which then took me three months to discover). This attack appeared to have rootkit'ed my devices with a VM level rootkit.

Currently, this device has had its hard drive removed, had all of its firmware rewritten/flashed (that I could find/do) and is only used from a bootable, non-writable USB stick running Kali Linux. AKA, it is a "fresh start" every time it is turned on.

However I am still suspicious of all of my devices (I know, I got some new ones). For example, on the machine just described, when the internet is disconnected suddenly, wireshark shows various connections from localhost ports to localhost ports suddenly send SYN / ACK / RST packets to each other.

However at that moment in time, I hadn't been running any services / programs on that device listening on localhost, and those ports do not appear on netstat or similar in the OS (Kali) I'm running. I don't see any localhost traffic at all when connected to the internet, with wireshark listening on all interfaces. It only occurs when I suddenly pull the cable. The port changes on each day, but it has been 9229 on several occasions, which is the default NodeJS debugging port. However I've never installed Node when running Kali, and it isn't installed by default.

Screenshot: enter image description here

Opinions welcome. Even just "You're paranoid".

New contributor
itmc5662 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • If you get the process names using netstat, it will help.
    – ThoriumBR
    Jun 23 at 13:03
  • There is nothing in netstat. I never see these ports / connections in netstat. If I open a browser / tool == I see those connections, but not these. If I close everything, and wait for the connections to time out and netstat == I see no connections. I then pull the cable (with wireshark running) and see the above).
    – itmc5662
    Jun 23 at 13:13
  • You must run netstat as root, and you have to have something on netstat -nltpa. Or lsof -i.
    – ThoriumBR
    Jun 23 at 14:23
  • welcome - could you please edit your post to include context, and information typically found in the lower 1/2 of the wireshark gui? this holds data such as the ip- and tcp- headers, etc. which allows for a more comprehensive answer ... you're not paranoid if it's true ... are you ensuring the browser is re-secured at every restart? you can keep your config and plugins in an encrypted, signed (eg. luks) container (not to mention vpn/ wireguard certs, pwd db, even some software binaries you've already verified etc.), to save effort and ensure a more secure startup after each reboot
    – brynk
    Jun 23 at 23:14

1 Answer 1

  • open a netcat listener on that port (perhaps on all-of them with lot's of netcats or redirect many ports with netfilter to single instance). The caller might get blocked on socket.read() call and you should be able to pin-point the process with netstat and proceed with investigation as usual.

  • it might be possible to trace connect() syscalls in kernel via DTrace (systemtap) framework in order to identify calling process/thread

  • if you are positive that one or even several of your devices were rootkitted by determined attacker, you'd better to replace them all instead of trying cleaning them up

Unknown localhost connections: Is this indication of continued compromise of device?

Cannot determine with available information.

New contributor
Radoslav Bodó is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

itmc5662 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.