Bug 859951

Description of problem:
I am examining an existing (3+ month old) installation of Fedora 17 w/ latest patches

[CODE]Linux hostname.domain 3.5.3-1.fc17.x86_64 #1 SMP Wed Aug 29 18:46:34 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux[/CODE]

If I use the pre-packaged unhide & unhide-tcp utilities I do not run into problems (See example 1 output below). However when I download & compile the source available from http://www.unhide-forensics.info/"]http://www.unhide-forensics.info/ I get the output listed in example 2.

I would like to think this discrepancy is a false positive, however I do not think this is the case and believe the machine to be compromised. The mere fact that it reports these pieces of software as using hidden processes is unsettling.

The process ID immediately destroys itself and forks a new hidden process once unhide has completed its examination make it difficult to view the details of the process.

Because of this I modified the source for the unhide binary to have strace attach to the running process upon detection. See example 3 for the patch & example 4 for the output of the scan.

The output of the scan, in every strace -p {PID} that gets issued (8 out of 10 times) returns a [i]return_syscall()[/i] leading me to believe the machine has indeed been compromised. However, not having any education in computer forensics I would like a second opinion.

Now that the background information has been laid, without re-installing a new system and testing with the unhide tool or examining the source for each of the listed software packages for process hiding techniques are there any other avenues or information that can be positively used to verify nefarious activity? Thanks in advance.

Version-Release number of selected component (if applicable):
20100201 YUM package of Unhide & Unhide-tcp

20110113 Unhide & Unhide-tcp from source

How reproducible:
always

Example 1
<pre># unhide sys
Unhide 20100201
http://www.security-projects.com/?Unhide


[*]Searching for Hidden processes through kill(..,0) scanning

[*]Searching for Hidden processes through  comparison of results of system calls

...</pre>

Example 2
<pre># ./unhide sys
Unhide 20110113
http://www.unhide-forensics.info


[*]Searching for Hidden processes through getpriority() scanning

Found HIDDEN PID: 989
Command: /sbin/auditd

Found HIDDEN PID: 1000
Command: /sbin/audispd

Found HIDDEN PID: 1013
Command: /usr/sbin/NetworkManager

...
</pre>

Example 3
<pre>
--- unhide.c
+++ unhide.c
@@ -77,7 +77,7 @@
    char cmd[100] ;
 
    struct stat buffer;
-
+   system(printf('strace -p %i', tmppid));
    printf ("Found HIDDEN PID: %i\n", tmppid) ;
 
    sprintf(cmd,"/proc/%i/cmdline",tmppid);
</pre>

Example 4<pre># ./unhide-stracer sys
Unhide 20110113
http://www.unhide-forensics.info


[*]Searching for Hidden processes through getpriority() scanning

Process 989 attached
futex(0x7f75666b0274, FUTEX_WAIT_PRIVATE, 281, NULL^X^CProcess 989 detached
 <detached ...>
Found HIDDEN PID: 989
Command: /sbin/auditd

Process 1000 attached
restart_syscall(<... resuming interrupted call ...>^X^CProcess 1000 detached
 <detached ...>
Found HIDDEN PID: 1000
Command: /sbin/audispd

...
</pre>