0

i ran chkroot, rkhunter, and nothing was revealed.

i ran unhide brute,

and it reveals a hidden PID

so i ps aux | grep ^PID

but nothing shows up.

i run unhide brute again, and theres nothing.

i run unhide brute again in a few seconds, and theres a new PID.

what should i do ? should i be concerned... ?

2 Answers 2

2

If this is unhide from http://www.security-projects.com/ 2009-08-10 (BETA), it isn't necessarily any foul play.

A quick look at the source-code of the brute-force-check, there seems to be a race-condition present.

What it looks like is that the brute-force scan will fork processes and try to touch the entire pid space, after it's done with all trying to touch all possible pids, it will then go through the entire list and for each pid it hasn't touched it'll run a ps against that pid and check if it exists. The problem is that there's plenty of time for a legitimate process to exit during the brute-fork scan or during ps'ing other holes in the brute-fork scan, and this will then be listed as hidden.

1
  • This race condition is a common cause of false positives in tools like chkrootkit.
    – Zanchey
    Oct 28, 2009 at 11:57
0

Try using OSSEC rootcheck to test. It is better at detecting rootkits than these two tools. Link: http://www.ossec.net/rootcheck/

You must log in to answer this question.