Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Someone rooted my box and executed a command, help!

dd if=/dev/urandom of=.huehuehue

what does this command do?

share|improve this question
2  
How do you know someone rooted your system? How did you find out this command was run? –  Marc Jun 14 '13 at 3:20
add comment

3 Answers

As others have said it fills up a file with random data.

You might ask, well, why would an attacker want to do that?

The likely reason is that, by using up all the space on the disk, it will overwrite any blocks containing data from deleted files, which may cover their tracks.

share|improve this answer
add comment

dd is the command for copying and checking from an input file if to anoutput file of.

Taken together, the command means to copy content from the input file, in this instance /dev/random, a pseudo-random number generator, into a file called .huehuehue.

I don't think this is a question particularly related to Ubuntu, personally, but it was asked here. Maybe this should be shifted to unix ?

You might also want to try running ps aux | grep dd to see if the process is still running. Get the process number and kill it.

I hope there was no other damage if this was a genuine case.

share|improve this answer
add comment

That fills up your file system by reading from a pseudo-random number generator and outputting it to a file named ".huehuehue". It's hilarious.

It's probably done running by now. Just delete the file.

sudo find / -name .huehuehue -print -delete 

If your box got rooted, you're going to want to wipe the drives and re-install. It takes longer to do the forensic work to prove they haven't added in some rootkit or timebomb that it does to just re-install.

share|improve this answer
    
how can i kill this process pidof dd is null –  MAY OR MAY NOT BE A FED Jun 14 '13 at 2:32
    
What do you mean it's null? –  poolie Jun 14 '13 at 3:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.