From owner-freebsd-questions@FreeBSD.ORG Thu Apr 15 00:29:24 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0363616A4CE for ; Thu, 15 Apr 2004 00:29:24 -0700 (PDT) Received: from smtp.infracaninophile.co.uk (happy-idiot-talk.infracaninophile.co.uk [81.2.69.218]) by mx1.FreeBSD.org (Postfix) with ESMTP id B38EA43D3F for ; Thu, 15 Apr 2004 00:29:22 -0700 (PDT) (envelope-from m.seaman@infracaninophile.co.uk) Received: from happy-idiot-talk.infracaninophile.co.uk (localhost.infracaninophile.co.uk [IPv6:::1])i3F7TIop040743 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 15 Apr 2004 08:29:18 +0100 (BST) (envelope-from matthew@happy-idiot-talk.infracaninophile.co.uk) Received: (from matthew@localhost)id i3F7TH8r040742; Thu, 15 Apr 2004 08:29:17 +0100 (BST) (envelope-from matthew) Date: Thu, 15 Apr 2004 08:29:17 +0100 From: Matthew Seaman To: Mike Message-ID: <20040415072917.GC40193@happy-idiot-talk.infracaninophile.co.uk> Mail-Followup-To: Matthew Seaman , Mike , freebsd-questions References: <407D910F.8050507@pacbell.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="2JFBq9zoW8cOFH7v" Content-Disposition: inline In-Reply-To: <407D910F.8050507@pacbell.net> User-Agent: Mutt/1.5.6i X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on happy-idiot-talk.infracaninophile.co.uk X-Virus-Scanned: clamd / ClamAV version devel-20040407, clamav-milter version 0.70g cc: freebsd-questions Subject: Re: False positives from chkrootkit? or hacked test server? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Apr 2004 07:29:24 -0000 --2JFBq9zoW8cOFH7v Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Apr 14, 2004 at 12:29:19PM -0700, Mike wrote: > Well... I installed and ran chkrootkit. And the output shows that: >=20 > Checking `chfn'... INFECTED > Checking `chsh'... INFECTED > Checking `date'... INFECTED > Checking `ls'... INFECTED > Checking `ps'... INFECTED >=20 > No rootkits were found. > Question: Does chkrootkit ever generate false positives? In a word: yes. This was something that was quite a popular question on this list some months back around the time of one of the earlier 5.x releases. I don't remember anyone mentioning this in the context of 4.9 or earlier systems, but that could just be my memory failing. http://lists.freebsd.org/pipermail/freebsd-security/2003-August/000755.h= tml For the rest of the traffic look at: http://www.google.co.uk/search?hl=3Den&ie=3DUTF-8&oe=3DUTF-8&safe=3Doff&= q=3Dsite%3Alists.freebsd.org+chkrootkit+chfn+INFECTED&btnG=3DSearch&meta=3D (Nb. chkrootkit has since been fixed to work correctly under 5.x) However see this: http://lists.freebsd.org/pipermail/freebsd-ports/2004-April/011362.html Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --2JFBq9zoW8cOFH7v Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (FreeBSD) iD8DBQFAfjnNdtESqEQa7a0RAr60AJ9z4BSjJofhO46yJPfXIAskVng7swCgktFE KaXumM6+iReS/KJlyzaaGiE= =lNTI -----END PGP SIGNATURE----- --2JFBq9zoW8cOFH7v--