19

I recently ran sudo chkrootkit and this was one of the results:

Searching for Linux/Ebury - Operation Windigo ssh...        Possible Linux/Ebury - Operation Windigo installetd

In my research on this I discovered this thread, so I tried running the commands recommended there, the first two commands:

netstat -nap | grep "@/proc/udevd"
find /lib* -type f -name libns2.so

Outputted nothing. However this command:

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"

Outputted:

System infected

So am I infected or not? I read about this (though I found a more descriptive report before but can't find it again), so could this be it? I have done a fresh install and it is still being detected. So is there any way of further checking and should I be worried?


OS Information:

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 15.10
Release:    15.10
Codename:   wily
Flavour: GNOME
GNOME Version: 3.18

Package Information:

chkrootkit:
  Installed: 0.50-3.1ubuntu1
  Candidate: 0.50-3.1ubuntu1
  Version table:
 *** 0.50-3.1ubuntu1 0
        500 http://archive.ubuntu.com/ubuntu/ wily/universe amd64 Packages
        100 /var/lib/dpkg/status

3 Answers 3

13

The problem you have is that in Wily, the command "ssh -G" doesn't output the "Illegal Operation" string at the top, but it still does show the command help, so I think you are fine. All my Wily installs are reporting the same issue. It's a detection flaw. chkrootkit needs to be updated to change it's suspicion detection mechanism.

2
  • 4
    A genuine -G option was added in openssh 6.8P1. Feb 9, 2016 at 16:33
  • So, if I have version: OpenSSH_7.2p2 Ubuntu-4ubuntu1, OpenSSL 1.0.2g-fips 1 Mar 2016 and -G still brings up the help, what does that mean? It says "-G Causes ssh to print its configuration after evaluating Host and Match blocks and exit"
    – Chev_603
    Jul 31, 2016 at 6:57
8

I also received that "possible" infestation result running OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g-fips on Ubuntu 16.04 . Looking on-line for this issue I found the site:
https://www.cert-bund.de/ebury-faq
which gives some tests to perform. The shared memory tests where not conclusive, but the other three test results were indicative of a false positive. I've created a small simple script to run after the possible positive result shows up on chkrootkit:

#! /bin/bash
#
# Result filesize should be less that 15KB.
sudo find /lib* -type f -name libkeyutils.so* -exec ls -la {} \;
# Result should return null.
sudo find /lib* -type f -name libns2.so
# Result should return null.
sudo netstat -nap | grep "@/proc/udevd"

I would also recommend installing rkhunter as a further check for rootkits.

7

The correct version of the test is:

ssh -G 2>&1 | grep -e illegal -e unknown -e Gg > /dev/null && echo "System clean" || echo "System infected"

As a -G option has been added to ssh, the -e Gg is needed to prevent false positives.

You must log in to answer this question.