From owner-freebsd-security Fri Oct 29 7:11:25 1999 Delivered-To: freebsd-security@freebsd.org Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by hub.freebsd.org (Postfix) with ESMTP id 5609E14C4C for ; Fri, 29 Oct 1999 07:11:21 -0700 (PDT) (envelope-from des@flood.ping.uio.no) Received: (from des@localhost) by flood.ping.uio.no (8.9.3/8.9.3) id QAA79664; Fri, 29 Oct 1999 16:11:00 +0200 (CEST) (envelope-from des) To: Beck David Cc: "'freebsd-security@FreeBSD.ORG'" Subject: Re: Strange things on my computer / Help References: <1BD5A68BE9E8D211BBE8006094B9EB73E97C@netfinity.freesoft.hu> From: Dag-Erling Smorgrav Date: 29 Oct 1999 16:10:59 +0200 In-Reply-To: Beck David's message of "Fri, 29 Oct 1999 12:40:20 +0200" Message-ID: Lines: 33 X-Mailer: Gnus v5.7/Emacs 20.4 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Beck David writes: > - but the kernel complains in every 10 minutes for some _out_ going > ICMP packets, which goes to two hosts. I am absolutely sure > that nor me nor any of my programs has nothing to do with that hosts What kind of ICMP packets? Could you set up a sniffer to capture those packets? (tcpdump will do). They may be completely benign (e.g. ICMP_UNREACH or ICMP_TIMXCEED) > - when I found this I started to look for the program which generates > the ICMP packets but I didn't find anything The TCP/IP stack generates ICMP packets on its own in certain circumstances. > Do you guys suspect that my machine got exploited ? /I do, but I can't > prove it./ Like somebody else suggested, compare MD5 checksums of your system binaries (using a known-good copy of /sbin/md5) with those of known-good binaries. The best choice of known-good binaries is the live file system on the second CD-ROM in the set you used to install the machine in the first place. If you can afford the downtime (generally speaking, if you suspect a compromise, you don't have much choice but to accept the downtime), boot the system from known-good boot floppies or (preferably) a bootable CD-ROM such as the one that comes with the Walnut Creek distribution before running checks. DES -- Dag-Erling Smorgrav - des@flood.ping.uio.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message