0

Somebody is accusing me that my linux ubuntu machine could be the source for a server attack.

Their technique was replacing the original ssh by this patched ssh and, as such eliminated all sshd logging and debugging information while allowing any user account to be logged into when provided a special password; also, in some cases, they made links between this spurious ssh2 and the original ssh. This explains why, on , I found the ssh host key changed. Additionally, they put some other stuff in /tmp/ , /var/tmp/ , /dev/.lib1/ and /dev/shm/, /dev/.lib1/ and /dev/shm/
, /dev/.lib1/ and /dev/shm/

Any ideas if this can be possible. I didn't have other reports and I am connecting through ssh at at least a dozen other servers. how to check for sniffers in Ubuntu? how can I check if my ssh is still valid?

Improve this question
5
  • 1
    You have to provide a lot more information and a real question if you are to get any help. The answer to the only question here is "Yes."
    – pehrs
    Aug 5, 2010 at 9:21
  • @pehrs my question is how to check for the sniffers. what other information do you think I should provide?
    – Elzo Valugi
    Aug 5, 2010 at 9:26
  • What about 1: A lot more information about your environment. 2: What kind of "sniffer" are you looking for? In security a sniffer is typically a program monitoring the network for specific information, which doesn't make much sense with the question. (I have a feeling you are really trying to ask how you can check if your ssh2 has been replaced. And the answer to that is "not easily, and certainly not without booting from a recovery cd". For a theoretical view read citeseerx.ist.psu.edu/viewdoc/… )
    – pehrs
    Aug 5, 2010 at 9:44
  • Do you mean a sniffer as in monitoring network traffic, or is someone using "sniffing" meaning a keystroke logger (different things)? If someone is accusing you of being hacked, that's different than accusing you have having a system that can be used for sniffing traffic.
    – Bart Silverstrim
    Aug 5, 2010 at 12:50
  • I'm not entirely clear if you're saying you found evidence of something wrong, someone is demonstrating that your system can be hacked, or someone is giving you a scenario of how your system can attack systems or be attacked. Is your computer possibly rooted or no?
    – Bart Silverstrim
    Aug 5, 2010 at 12:52

6 Answers 6

Reset to default
1

Are you trying to verify your sshd ?

If yes then you could propably do two things 1) Check the official checksum and yours (someone said it before) 2) use the lsof to check what files the sshd has open. One common thing is to modify sshd, keep somewhere the passwords and aftewards using a backdoor withdraw the file.

Generally, what i suggest is to temporary replace the sshd with another version, but keep the "hacked" version for further testing ( If it's hacked and you haven't change anything to your system, then you are still vulnerable, so be examining the sshd may help you)

But, just in case, have a look for possible backdoors. Have you kept any logs from the "attack" ?

Improve this answer
1
1

Is it something like rkhunter (http://www.rootkit.nl/) you are looking for? It is available as deb package (aptitude install rkhunter)

Improve this answer
3
  • I dont know what I am looking for, this is the problem
    – Elzo Valugi
    Aug 5, 2010 at 10:58
  • 1
    Running tools on a hacked system isn't reliable...it may prove that you've been hacked, but can't prove you haven't been. Even so you'd need to run from a boot disc to prevent tampering. Your best source of detection would have been maintaining checksums of system files on a read-only media, updated after system updates, and then running comparisons for anomalies.
    – Bart Silverstrim
    Aug 5, 2010 at 12:54
  • looks like searching for a needle in the haystack.
    – Elzo Valugi
    Aug 7, 2010 at 14:25
1

As pehrs said, propably you are not interested in detecting a sniffer. (Even if someone is sniffing your network, it won't make sense because your stream is encrypted. He should do offline analysis, which will take time / weeks / months / years depending on your password).

But, in case that you ask how you could detect if something is changed, have a look at ossec. It's a really ggoooood tools for detecting intrusions. It can be used for many many things.

P.S in case that you are really interested in detecting the sniffer, have a look at Find Sniffer on LAN

cheers

Improve this answer
1
  • ossec is interesting, however it doesn't seem like the solution for me. Thanks
    – Elzo Valugi
    Aug 7, 2010 at 14:26
1

Any ideas if this can be possible.

Yes, that is possible. :)

I didn't have other reports and I am connecting through ssh at at least a dozen other servers.

With a hacked ssh? Yikes!

how to check for sniffers in Ubuntu?

Do you mean looking for rootkits, replaced files, or network scanning software?

If your ssh process is hacked, there is only one solution for this: SHUTDOWN THE MACHINE NOW! Just pull the plug, to avoid shutdown scripts to run. and relax again :)

You can't really try to fix a hacked system, because you can't tell which other parts of the machine are infected, and allow the hack to continue. The only sane way is doing a fresh installation, and copying your documents from the old disk.

The old disk can be used for inspection (from a different system), and comparing the binary files with the files your package manager installed.

Improve this answer
1
  • it is too complicated but thanks.
    – Elzo Valugi
    Aug 7, 2010 at 14:28
1

The safest option is to back up your configs, format the system, then do a fresh install and make sure it's fully updated as soon as possible, preferably offline.

However, it sounds like this was just an accusation from someone on the Internet. What evidence do they have? Is there anything suspicious that you see happening on your machine?

Regardless, one thing you might try is passing your network connection through another system and monitoring the traffic going to and from it. Something like ntop or etherape can help.

Improve this answer
2
  • there is no evidence. this is what I try to find. how can I find if my ssh is tainted or listen in any way?
    – Elzo Valugi
    Aug 7, 2010 at 14:24
  • If you have another system with the same OS on it, you can get the MD5SUM of the sshd file and compare. md5sum /usr/sbin/sshd If the files differ, it's a cause for concern. Note that this requires that the same version of the package be installed on both, so do an aptitude update ; aptitude full-upgrade before checking. Even this isn't foolproof with a sufficiently advanced rootkit, but it's a good start. Honestly, you should probably start by asking the guy who made the accusation to provide some sort of evidence.
    – dpflug
    Aug 8, 2010 at 14:56
1

You want to build a CD with a root file system, assorted rootkit-finding tools and (if you have it) a tripwire database from your system, from a point in time when you know it was not hacked.

Though, to some extent, checksums from a ssh binary installed from the same repository should be decent enough, I guess.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .