I recently ran sudo chkrootkit and this was one of the results:

Searching for Linux/Ebury - Operation Windigo ssh...        Possible Linux/Ebury - Operation Windigo installetd

In my research on this I discovered this thread, so I tried running the commands recommended there, the first two commands:

netstat -nap | grep "@/proc/udevd"
find /lib* -type f -name libns2.so

Outputted nothing. However this command:

ssh -G 2>&1 | grep -e illegal -e unknown > /dev/null && echo "System clean" || echo "System infected"

Outputted:

System infected

So am I infected or not? I read about this (though I found a more descriptive report before but can't find it again), so could this be it? I have done a fresh install and it is still being detected. So is there any way of further checking and should I be worried?


OS Information:

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 15.10
Release:    15.10
Codename:   wily
Flavour: GNOME
GNOME Version: 3.18

Package Information:

chkrootkit:
  Installed: 0.50-3.1ubuntu1
  Candidate: 0.50-3.1ubuntu1
  Version table:
 *** 0.50-3.1ubuntu1 0
        500 http://archive.ubuntu.com/ubuntu/ wily/universe amd64 Packages
        100 /var/lib/dpkg/status
up vote 13 down vote accepted

The problem you have is that in Wily, the command "ssh -G" doesn't output the "Illegal Operation" string at the top, but it still does show the command help, so I think you are fine. All my Wily installs are reporting the same issue. It's a detection flaw. chkrootkit needs to be updated to change it's suspicion detection mechanism.

  • 3
    A genuine -G option was added in openssh 6.8P1. – Stéphane Chazelas Feb 9 '16 at 16:33
  • So, if I have version: OpenSSH_7.2p2 Ubuntu-4ubuntu1, OpenSSL 1.0.2g-fips 1 Mar 2016 and -G still brings up the help, what does that mean? It says "-G Causes ssh to print its configuration after evaluating Host and Match blocks and exit" – Chev_603 Jul 31 '16 at 6:57

I also received that "possible" infestation result running OpenSSH_7.2p2 Ubuntu-4ubuntu2.1, OpenSSL 1.0.2g-fips on Ubuntu 16.04 . Looking on-line for this issue I found the site:
https://www.cert-bund.de/ebury-faq
which gives some tests to perform. The shared memory tests where not conclusive, but the other three test results were indicative of a false positive. I've created a small simple script to run after the possible positive result shows up on chkrootkit:

#! /bin/bash
#
# Result filesize should be less that 15KB.
sudo find /lib* -type f -name libkeyutils.so* -exec ls -la {} \;
# Result should return null.
sudo find /lib* -type f -name libns2.so
# Result should return null.
sudo netstat -nap | grep "@/proc/udevd"

I would also recommend installing rkhunter as a further check for rootkits.

The correct version of the test is:

ssh -G 2>&1 | grep -e illegal -e unknown -e Gg > /dev/null && echo "System clean" || echo "System infected"

As a -G option has been added to ssh, the -e Gg is needed to prevent false positives.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.