Suspicious activity in Linux!

Printable View

09-30-2009
Yarin

Suspicious activity in Linux!

For the 3rd time in 2 months, this has happened...

Two processes pop up in my process list (in System Activity, Ctrl+Esc). They have no name, or command string. Their owner is "root, -1" (no other processes running have "-1" in their user string). Their CPU usage is reported as "unknown". I can't kill them, because they are constantly going away, and popping back up (which effectively revives them, and changes their PID). In the coming up/going away shuffle, sometimes System Activity will report 3 process being there (but it's almost always 2).

I have a dual core, so when a program maxes out the CPU, it'll only use one core, which is nice when things misbehave. But my CPU usage widgets are showing that these processes are consistently using about 3/4 of both cores at the same time. (Makes sense, right? 2 processes, 2 cores)

This goes on for about 5 minutes then stops. And there seems to be no apparent reason why this happens, I can't think of anything that I do that might trigger it. The first time it happened was not to soon after I installed my OS, so the first time could've been triggered by that (if it's nice), or by the installation of a bad package (if it's not nice).

This is so un-Linux-like, which makes me that much more uneasy about it.
Anyone have any idea what could be going on? Or how to get more information about how certain processes came about?

Thanks,
Yarin
09-30-2009
brewbuck

If the processes stick around long enough, try the following:

Code:

cat /proc/XXX/maps

Where XXX is the PID of one of the processes. The actual binary file which is running should show up in the list somewhere. (This is a general way to determine what a program is, if it has changed its argument list to try to hide itself)
09-30-2009
abachler

Yup, Linux is no more impervious to virii than windows, just that most virus writers target windows. Same goes for Mac-OS.
09-30-2009
Yarin

Correct me if I'm wrong, but couldn't the process change it's proc files, thus making that useless? (being that it's running in root) Nevertheless, I'll try it next time.

>> Yup, Linux is no more impervious to virii than windows
I wouldn't say that. A program run on Windows can do anything (unless you have an 'OS Firewall'), whereas a program couldn't do squat on Linux without gaining root access, which would only happen if you let it, or if you accidentally get it while in root.

Does anyone know what the difference between "root" and "root, -1" is?
09-30-2009
Mario F.

Quote:

Originally Posted by Yarin

I wouldn't say that. A program run on Windows can do anything (unless you have an 'OS Firewall'), whereas a program couldn't do squat on Linux without gaining root access, which would only happen if you let it, or if you accidentally get it while in root.

So you never heard of UAC, or before that Multiple User Accounts introduced in Windows NT back in 1993.
09-30-2009
abachler

Quote:

Originally Posted by Yarin

Correct me if I'm wrong, but couldn't the process change it's proc files, thus making that useless? (being that it's running in root) Nevertheless, I'll try it next time.

>> Yup, Linux is no more impervious to virii than windows
I wouldn't say that. A program run on Windows can do anything (unless you have an 'OS Firewall'), whereas a program couldn't do squat on Linux without gaining root access, which would only happen if you let it, or if you accidentally get it while in root.

Does anyone know what the difference between "root" and "root, -1" is?

An application running on windows cannot do 'anything it want's', unless it is running with root privileges, Which on windows is called running with admin privileges, which 99% of people do. If you run linux under admin all the time then anything you run on your system can wreak just as much havoc.

Gun's don't kill people, I do.

Windows isn't any more vulnerable than linux, Windows Users just don't take advantage of its security features.
09-30-2009
kermit

Next time it runs, see if you can tell what it is connected to with a pstree -ap. Other than that, have you tried chkrootkit and rkhunter?
09-30-2009
brewbuck

Quote:

Originally Posted by Yarin

Correct me if I'm wrong, but couldn't the process change it's proc files, thus making that useless? (being that it's running in root) Nevertheless, I'll try it next time.

It could only alter the contents of /proc if it installed some kind of kernel module. That's certainly not impossible, but it would mean that you have a fairly sophisticated rootkit installed on your machine.
09-30-2009
brewbuck

Another thing to try would be to pull the network for a few hours and see if the behavior changes.
09-30-2009
Kennedy

Quote:

Originally Posted by Yarin

"root" and "root, -1" is?

That completely depends on your options to procps.

The doesn't have a name thing, however, could be a kernel thread without a name (though, I think that may still show up a s [] in stead of nothing).
10-01-2009
MK27

Quote:

Originally Posted by Yarin

Does anyone know what the difference between "root" and "root, -1" is?

I would assume the gid, altho I did not know -1 was valid for that. If you do not have a -1 in /etc/group, try creating one and see if it works. If it does, you might be able to do something to limit that group.

I did google "linux gid -1" but nothing.
10-01-2009
Yarin

Quote:

Originally Posted by Mario F.

So you never heard of UAC, or before that Multiple User Accounts introduced in Windows NT back in 1993.

I've heard. But I've never seem UAC in action on Windows before, programs just whine about lack of permission - you'd have to "Run as User", or something. If users running admin accounts when they shouldn't was the only reason for Windows problems, then why all the vulnerability patches?

Quote:

Originally Posted by kermit

Next time it runs, see if you can tell what it is connected to with a pstree -ap. Other than that, have you tried chkrootkit and rkhunter?

That also sounds good.
I've run rkhunter, it didn't find anything. I haven't tried chkrootkit yet.

Quote:

Originally Posted by brewbuck

Another thing to try would be to pull the network for a few hours and see if the behavior changes.

I'm on dial-up, so the network is already 'pulled' most of the time. Twice it happened when I was off-line, and once when I was on. And when I was on, it wasn't communicating.

Quote:

Originally Posted by MK27

I would assume the gid, altho I did not know -1 was valid for that. If you do not have a -1 in /etc/group, try creating one and see if it works. If it does, you might be able to do something to limit that group.

I did google "linux gid -1" but nothing.

Can't find any group named -1. Trying to create it using a system front-end, says it's not a valid name. I thought of manually adding it to the file, but I dunno what that could mess up.
Yeah, I googled for it already, but google doesn't interpret -1 the way we're wanting it to.