Date: Sun, 18 Feb 2007 14:35:54 -0500 From: Kris Kennaway <kris@obsecurity.org> To: FreeBSD MailingLists <freebsd.ml@gmail.com> Cc: questions <freebsd-questions@freebsd.org> Subject: Re: LKM Trojan? Message-ID: <20070218193554.GC54293@xor.obsecurity.org> In-Reply-To: <ded8d7170702180604u53c748a1w7de5b01a29754c38@mail.gmail.com> References: <ded8d7170702180604u53c748a1w7de5b01a29754c38@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Feb 18, 2007 at 11:04:18PM +0900, FreeBSD MailingLists wrote: > When I run chkrootkit I get the following lines. > > >Checking `lkm'... You have 107 process hidden for readdir command > >chkproc: Warning: Possible LKM Trojan installed > > rkhunter doesn't seem to find anything. > I suspect that my machine might be compromised. > running "ls" in the /proc directory returns an empty list. > I have recompiled the kernel and world but the problem persists. > Any suggestions on how to fix this without having to reinstall from scratch? When using any tool you need to understand the limitations of that tool. One of the major limitations of this kind of pattern recognition "security" tool is that they just aren't very accurate, and have lots of false positives. So you may have a "LKM trojan" (even though FreeBSD doesn't use "LKM"s, it uses "KLD"s ;), or (more likely) you might have just encountered a poorly specified search pattern in the tool. Kris
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070218193554.GC54293>