Bug 859951 - Possible discrepancy between yum package & source
Possible discrepancy between yum package & source
Status: CLOSED WONTFIX
Product: Fedora
Classification: Fedora
Component: unhide (Show other bugs)
17
x86_64 Linux
unspecified Severity low
: ---
: ---
Assigned To: Rakesh Pandit
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-09-24 09:19 EDT by jas
Modified: 2013-08-01 05:17 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-01 05:17:52 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description jas 2012-09-24 09:19:55 EDT
Description of problem:
I am examining an existing (3+ month old) installation of Fedora 17 w/ latest patches

[CODE]Linux hostname.domain 3.5.3-1.fc17.x86_64 #1 SMP Wed Aug 29 18:46:34 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux[/CODE]

If I use the pre-packaged unhide & unhide-tcp utilities I do not run into problems (See example 1 output below). However when I download & compile the source available from http://www.unhide-forensics.info/"]http://www.unhide-forensics.info/ I get the output listed in example 2.

I would like to think this discrepancy is a false positive, however I do not think this is the case and believe the machine to be compromised. The mere fact that it reports these pieces of software as using hidden processes is unsettling.

The process ID immediately destroys itself and forks a new hidden process once unhide has completed its examination make it difficult to view the details of the process.

Because of this I modified the source for the unhide binary to have strace attach to the running process upon detection. See example 3 for the patch & example 4 for the output of the scan.

The output of the scan, in every strace -p {PID} that gets issued (8 out of 10 times) returns a [i]return_syscall()[/i] leading me to believe the machine has indeed been compromised. However, not having any education in computer forensics I would like a second opinion.

Now that the background information has been laid, without re-installing a new system and testing with the unhide tool or examining the source for each of the listed software packages for process hiding techniques are there any other avenues or information that can be positively used to verify nefarious activity? Thanks in advance.

Version-Release number of selected component (if applicable):
20100201 YUM package of Unhide & Unhide-tcp

20110113 Unhide & Unhide-tcp from source

How reproducible:
always

Example 1
<pre># unhide sys
Unhide 20100201
http://www.security-projects.com/?Unhide


[*]Searching for Hidden processes through kill(..,0) scanning

[*]Searching for Hidden processes through  comparison of results of system calls

...</pre>

Example 2
<pre># ./unhide sys
Unhide 20110113
http://www.unhide-forensics.info


[*]Searching for Hidden processes through getpriority() scanning

Found HIDDEN PID: 989
Command: /sbin/auditd

Found HIDDEN PID: 1000
Command: /sbin/audispd

Found HIDDEN PID: 1013
Command: /usr/sbin/NetworkManager

...
</pre>

Example 3
<pre>
--- unhide.c
+++ unhide.c
@@ -77,7 +77,7 @@
    char cmd[100] ;
 
    struct stat buffer;
-
+   system(printf('strace -p %i', tmppid));
    printf ("Found HIDDEN PID: %i\n", tmppid) ;
 
    sprintf(cmd,"/proc/%i/cmdline",tmppid);
</pre>

Example 4<pre># ./unhide-stracer sys
Unhide 20110113
http://www.unhide-forensics.info


[*]Searching for Hidden processes through getpriority() scanning

Process 989 attached
futex(0x7f75666b0274, FUTEX_WAIT_PRIVATE, 281, NULL^X^CProcess 989 detached
 <detached ...>
Found HIDDEN PID: 989
Command: /sbin/auditd

Process 1000 attached
restart_syscall(<... resuming interrupted call ...>^X^CProcess 1000 detached
 <detached ...>
Found HIDDEN PID: 1000
Command: /sbin/audispd

...
</pre>
Comment 1 Fedora End Of Life 2013-07-03 22:45:27 EDT
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 2 Fedora End Of Life 2013-08-01 05:17:58 EDT
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.