<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6001.18183" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=158501411-26012009><FONT face=Arial
color=#0000ff size=2>Just found ZK root kit.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=158501411-26012009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=158501411-26012009><FONT face=Arial
color=#0000ff size=2>Any ideas on infection vector?</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=158501411-26012009><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=158501411-26012009><FONT face=Arial
color=#0000ff size=2>Ho hum</FONT></SPAN></DIV><BR>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> centos-bounces@centos.org
[mailto:centos-bounces@centos.org] <B>On Behalf Of </B>Nigel
Kendrick<BR><B>Sent:</B> Monday, January 26, 2009 11:01 AM<BR><B>To:</B> 'CentOS
mailing list'<BR><B>Subject:</B> [CentOS] I may have been rooted - but I may
not!?<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Morning,</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I am going to treat
this as a rooted box and reinstall from scratch, but any thoughts
appreciated:</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>This is a Trixbox
Server based on Centos, running kernel 2.6.18-53.1.4.el5 SMP</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>The phone system
stopped working but this was traced to a configuration error with a replacement
switch (it did not get added to the vlan properly), which meant that Trixbox
could not see any DNS servers and this b0rks TB.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Anyway, during
debugging I went to reboot the server and got the following:</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>/dev/kmem
missing</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>IDT table read
failed</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have run rkhunter,
which turns up nothing</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>If have forced a
filesystem check - all clean</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have checked the
logs and history file and cannot see anything</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>The server is behind
a hardware firewall and the only ports open are those needed for RTP, IAX2 and
SIP - there is no other public access and no user accounts.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Having fixed the
vlan issue, Asterisk is running fine.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I re-created
/dev/kmem, but it's missing at subsequent reboots. </FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>I have Googled many
references to the IDT table problem being associated with the SuckIT rootkit,
but I can find no evidence that it's installed.</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>OK, bearing in mind
that I will go ahead and reinstall the server (no biggie as I have Trixbox
config backups and installing TB is not a big task), I just wanted to check
whether there were any IDT table issues that may *NOT* be rootkit related and if
there are any simple fixes I can try on the box while it's isolated on the
bench? </FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>In the other
direction, has anyone seen this type of behaviour with any rootkit that is not
detected by rkhunter and doesn't leave any obvious footprints? Anything to look
for?</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial size=2>Happy
Monday!</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Thanks</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2>Nigel</FONT></SPAN></DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=384004810-26012009><FONT face=Arial
size=2></FONT></SPAN> </DIV></BODY></HTML>