Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to analyze my ubuntu box to detect if it was been hacked. My question is: what are all the place where to look to discover if some malicious software are started ? The following is some kind of raw list:

  1. mbr
  2. kernel image (I have md5)
  3. /sbin/init (I have md5)
  4. Kernel modules in /etc/modules
  5. all the services script in /etc/init.d and /etc/init (I have md5)
  6. /etc/rc.local
  7. gnome autorun

and ?

My question is totally honest and not malicious. It's only to detect if my box was been compromised.

share|improve this question

8 Answers 8

The objective of malware is to do something. So it will need to communicate with the outside world. So the best approach is to have a look at the network traffic that is occurring on your computer.

I like dnstop utility. Install by sudo apt-get install dnstop

Then run the utility against your network card

sudo dnstop -l 3 eth0

When the utility runs press the 3 key, this will change the screen to display all the dns requests that are made by your computer.

In my case I went to Ubuntu and it tried to access the following

Query Name               Count      %   cum%
-------------------- --------- ------ ------
www.gravatar.com             2   40.0   40.0
askubuntu.com                2   40.0   80.0
ny.stackexchange.com         1   20.0  100.0

This gives me an idea of what web sites were accessed. What you need to do is not do anything and sit back and wait for a while to see what your computer accesses. Then laboriously follow up on all those web sites it accesses.

There are many tools you could use, I thought this was an easy one for you to try out.

share|improve this answer
    
uhmm I think that the most stupid rootkit hide itself and its traffic. –  Luigi May 24 '13 at 15:02
    
@Luigi as I said, there are lots of tools for forensic analysis. If. you are that worried use Wireshark and look at the traffic on your network segment which is pretty impossible to fake as you are working at a hardware level. If you are more paranoid you could run Wireshark on a clean computer on your segment. –  Meer Borg May 24 '13 at 15:25
    
ok, but I think that the best way is to analyze the offline system by livecd. I think it's more easy because a clever malware can send informations outside only if there is others streams of data, or could send info on a covert channel. –  Luigi May 24 '13 at 15:33
    
@Luigi and how do you establish which one of the thousands of programs has been compromised? Running md5 hashes against a clean system and comparing it to your system? Best option is to wipe computer, mbr, even throw out the hard disk? Bios? Lots of attack vectors. It is a hard job, and you seem to be well informed. But what leads you to believe that you have been infected by this super stealth "virus"? –  Meer Borg May 24 '13 at 15:40
1  
Most linux distro have almost all md5 of the files contained in the packages. For example in Ubuntu there is debsums. So it's pretty easy make a big check of the full system. But of course some files are not hashed.. for example the mbr. But the kernel image and all the modules have their md5 (and sha1 or sha256 to avoid md5 collision), and the same for the /sbin/init. I have just to check only the stuff that is not hashed but I have to know in a very in deep the boot process. –  Luigi May 24 '13 at 15:51

You can never know if your PC is already infected or not. You might be able to tell by listening to the traffic coming from your computer. Below are something that you can do to ensure that your system is OK. Keep in mind that nothing is a 100%.

  • Make sure that you don't enable root account
  • Make sure that you have the latest security updates as soon as they come out
  • Don’t install software that you know you’ll hardly or never use
  • Make sure that your system has strong passwords
  • Turn off any services or processes that aren't needed
  • Install a good AV (if you’ll be dealing a lot with Windows, or maybe an email that may contain a Windows-based virus.)

As far as finding out if you've been hacked; you'll get pop-up ads, redirects to sites you didn't intend to visit, etc.

I would have to say that /sys /boot /etc among others are considered important.

Linux malware can also be detected using memory forensics tools, such as Volatility

Also you may want to look at Why do I need anti-virus software?. If you want to install an Anti-virus software I would recommend that you install ClamAV

share|improve this answer

You can also try rkhunter which scans your pc for a lot of common rootkits and trojan horses.

share|improve this answer
    
rkhunter detect only the known rootkit, furthermore it's very easy to take any public rootkit and change the source making it undetectable from rkhunter.. –  Luigi May 24 '13 at 15:12

There are specialized distributions like BackTrack that contain software to analyse situations like yours. Due to the highly specialized nature of these tools there is usually a quite steep learning curve associated with them. But then if this is truly a concern for you, it is time well spent.

share|improve this answer
    
I know backtrack, but there is not any software that make such kind of check automatically. –  Luigi May 24 '13 at 15:21
    
@Luigi If it was that easy I would be a IT security/forensic analyst with a six-figure salary... –  hmayag May 24 '13 at 20:41

It's obvious to you (for others sake I'll mention it) if your running your system as a VM then your risk potental is limited. Power button fixes thing in that case, Keep programs inside their sandbox (per~se). Strong passwords. Cant say it enough. From an SA view point, it's your first line defence. My rule of thumb, dont go belove 9 charaters, use Specials, and Upper+ Lower case+ Numbers also. It sounds hard right. IT's easy. Example... 'H2O=O18+o16=water'I use chemestry for some intersting passwords. H2O is water, but the O18 and O16 are diffrent Oxygen isotopes, but in the end, there result is water, there fore "H2O=O18+o16=water'.. Strong pasword. Go with it.. Common complaint is remebering it. SO call that computer/server/terminal 'Waterboy' It may help.

Am I nerding out?!?!

share|improve this answer

you could install and run ClamAV (softwarecenter) and check for malicious software on your computer. Should you have Wine installed: purge it via Synaptic (complete removal) , and do a reinstall if nessecary.

For the record: there is very few malicious software for Linux (don't mix it with a past with Windows !!), so the chance that your system is compromised is almost zip. A good advice is: chose a strong password for your root (you can easily change that if nessecary).

Don't get to paranoïd about Ubuntu and malicious software; stay within the lines of the softwarecenter/ don't install random PPA's / don't install .deb-packages that have no guarantees nor certified backgrounds ; doing so your system will remain clean without a hastle.

It is also advisable to remove each time you close your Firefox-browser (or Chromium) for having all cookies deleted and clean up your history; this is easily set in preferences.

share|improve this answer

Back when I ran public servers, I would install them in a non-networked environment and then install Tripwire on them (http://sourceforge.net/projects/tripwire/).

Tripwire basically checked all the files on the system and generated reports. You could exclude the ones that you say are allowed to change (like log files) or that you don't care about (mail files, browser cache locations, etc).

It was a lot of work going through the reports and setting it up, but it was nice to know that if a file changed, and you didn't install an update to change it, you knew there was something that needed to be investigated. I never actually needed all this, but I'm glad we ran it along with firewall software and regular port scans of the network.

For the last 10 years or so I've only had to maintain my personal machine, and with no one else having physical access or accounts on the box, and no public services (or much reason to target my machine specifically) I'm a little more lax so I haven't used Tripwire in years...but it may be something you're looking for to generate reports of file changes.

share|improve this answer

Best thing to do in your scenario is format weekly or shorter. Install a program like spideroak to sync your data securely. That way after reformat all you have to do is download spideroak and all your data comes back. It used to be easier with ubuntuone but that's gone now :(

btw: spideroak only guarantees zero knowledge if you never access your files on their site via a web session. you must use only their software client to access data and to change your password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.