[CentOS] Unknown rootkit causes compromised servers

Here is the applicable article:

http://www.linux.com/feature/125548

There are links in the above article that explain tests for the system and what is currently known about the rootkit.

Apparently initial access is NOT via any vulnerability but just guessed root passwords.

There are currently 2 methods to see if you are infected:

1. In some cases, the root kit causes you to not be able to create directories starting with a number ... so as root do:

mkdir 1

If it gives you an error similar to this, you are probably infected:

mkdir: cannot create directory `1': No such file or directory

2. Run this command for several minutes while you have windows users connecting to your web server:

tcpdump -nAs 2048 src port 80 | grep "[a-zA-Z]{5}.js'"

If you get output from this script, you may be infected.

======================================================== More info:

http://blog.cpanel.net/?p=31

http://www.cpanel.net/security/notes/random_js_toolkit.html

http://www.finjan.com/Pressrelease.aspx?id=1820&PressLan=1819&lan=3

http://www.pcworld.com/article/id,141358-c,techindustrytrends/article.html

http://www.webhostingtalk.com/showthread.php?t=651748

==========================================================

This does not seem to be caused by a specific vulnerability that CentOS or RHEL or cPanel has, but rather it seems to be caused by compromised root passwords.

There are several recommendations in the above links to prevent becoming infected as well as what to do if you are infected.

While there does not seem to be anything that the CentOS Development Team can "FIX" in relation to this issue ... I thought I would put the information out so that people can test their machines and take action as necessary.

Thanks, Johnny Hughes