Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using ubuntu on my laptop with a EDGE connection. I have no computers on my LAN.

First time this happened as a coincidence when i left a folder shared after office on my laptop and found it infected. After that i have tried to reproduce the issue and everytime this happens:

  • If i share a folder with samba and Guest Read+Write (777) permissions, after some time (varies, sometime a couple hours, sometime more than that) i start seeing strange files as shown below:

    -r-xr--r-- 1 nobody nogroup 0 2010-08-19 23:19 ctf

    -rw-r--r-- 1 nobody nogroup 337103 2004-08-04 00:10 dnpdwh.exe

    -r-xr--r-- 1 nobody nogroup 0 2010-08-20 05:45 khx

    -r-xr--r-- 1 nobody nogroup 0 2010-08-19 20:14 khy

    -rw-r--r-- 1 nobody nogroup 596628 2008-04-14 22:01 mzbxsv.exe

    -rw-r--r-- 1 nobody nogroup 510302 2004-08-04 19:50 uxnpfo.exe

I can always delete them but they keep popping back, i don't know from where they come or even why.

[EDIT]: Issue was Samba listening on public IP and then with 777 i was inviting the un-initiated to my system who though it was windows and thus dropping by viruses. Fixed with modifying samba configuration to:

  interfaces = 127.0.0.0/8 eth0    
  bind interfaces only = yes

in

/etc/samba/smb.conf

followed by

/etc/init.d/smbd restart

Problem was evident from log entries in /var/log/samba/log.IP_HERE

It was also evident as Samba was using nobody and nogroup to write files in Publicly writable shares.

share|improve this question
    
someone accessing your shared folder and putting them in there ? is your laptop resharing that connection aswell ? –  Prix Aug 20 '10 at 7:59
    
i also doubt that but i am not sharing my connection with anyone over eth or wlan. –  Shoaibi Aug 20 '10 at 8:15
    
have u checked the content of any of the files ? nano ctf also what directory is those file in. You better run rkhunter on your system for safety –  Prix Aug 20 '10 at 8:19
    
ctf and other 0sized files are empty, while running file on the *.exe files tell "PE32 executable for MS Windows (GUI) Intel 80386 32-bit". Yes, i can try rkhunter or just avoid sharing folders with 777 but question is from where do these files come from and how. –  Shoaibi Aug 20 '10 at 8:29
1  
Hehehe so i was on the right track since the begin eheheh :) glad you fixed it –  Prix Aug 21 '10 at 0:28
show 4 more comments

1 Answer

up vote 1 down vote accepted

MMM i few things i would recommend to you:

  • look for signs of strange processes, with chkrootkit ( http://www.chkrootkit.org )

  • Do a portscan with nmap from a different machine to make sure nothing strage is open or that you have anything else secure.

  • Check your firewall rules and do changes if you see it is too wide to outsiders

  • Verify your samba conf and limit it by the known ips you have if you don't share the data with anyone else, this will keep any outsiders from using it.

  • Not sure if this would be a problem to you but you can aswell set samba to use passwords to access/create the data, that is ofc assuming the files are being created by a 3rd party and not within your own system, but then checking if your system has been rootkited as pointed above would be the best.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.