Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have specific problem a bit advanced for me. On my router log I have seen following lines:

Internal                Prot.   External             NAT    Time-out 

192.168.0.167:56396     TCP     186.112.54.84:22    60753   54416
192.168.0.167:45776     TCP     62.213.111.201:23   62531   48429

I have re-flashed my router and for few days this lines disappeared, but now they are again here. Ok second IP address is from Russia today. I have visited the site (but why telnet port 23) and the first one is from Columbia DSL user I think. I also have the following line logged:

192.168.0.167:39485     TCP     41.46.0.90:23   62635   53810

the IP is from Egypt. I am not able to find the process on Ubuntu with netstat. I was also unable to find the given connections. I also tried rkhunter and chkroot but it is too advanced for me. Could you give me a hint how to find corresponding processes on Ubuntu (12.10)

With ossec installed I get the following lines (amoung others):

** Alert 1357654774.6683: mail - syslog,errors, 2013 Jan 08 15:19:34 rr->/var/log/auth.log Rule: 1002 (level 2) -> 'Unknown problem somewhere in the system.' Jan 8 15:19:34 rr dbus[412]: [system] Rejected send message, 2 matched rules; type="method_call", sender=":1.62" (uid=1000 pid=2285 comm="/usr/lib/indicator-session/indicator-session-servi") interface="org.freedesktop.DBus.Properties" member="GetAll" error name="(unset)" requested_reply="0" destination=":1.19" (uid=0 pid=1157 comm="/usr/sbin/console-kit-daemon --no-daemon ")

share|improve this question
    
Judging from the info provided, it looks like you tried to telnet to a remote site and not the other way around. Not sure what the problem is. –  Kevin Bowen Dec 28 '12 at 10:45

2 Answers 2

Try lsof | grep 45776 or with other port number.

share|improve this answer
    
It doesnt list anything. I have tried with latest inputs in log file. I have also tried netstat -lan. –  josef Dec 28 '12 at 10:48
    
wireshark or tcpdump programs can show if there any activity from ports listed by your router... In wireshark you also can filter an outgoing port (e.g. 23). –  ASten Dec 28 '12 at 10:51
1  
If this is a rootkit, all these traces will be hidden in userspace. –  gertvdijk Dec 28 '12 at 11:51

Consider checking the integrity of all your binaries on your system using debsums. This might show some altered kernel (kernel module) or system application. I've seen altered OpenSSH daemons to hide the activity and an altered Bluetooth kernel module to even create a backdoor at the kernel level. I was able to locate this by an automated checksum of all binaries on the system installed via the package management.

  • Install the package debsums, e.g.

    sudo apt-get install debsums
    
  • Run debsums with errors on the output only.

    sudo debsums -s
    

    Some files might be missing or no MD5sums are available for some packages. Just be aware of changed binaries.

Additionally, do get familiar with the rootkit hunters. I think they're not that hard to use. Be sure to use the latest version and the latest malware definitions in order to find the latest ones too. However, this is not a bulletproof test. I suggest to ask a more specific question on this on either security SE or unix SE.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.