full-disclosure - Removing ShKit Root Kit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031222062342.GB18415@mordor.angband.thangorodrim.de>
From: als at thangorodrim.de (Alexander Schreiber)
Subject: Removing ShKit Root Kit

On Sun, Dec 21, 2003 at 07:28:55PM -0500, Chris wrote:
> Can anyone reccomend some links or useful information for removing the 
> "ShKit Rootkit". CHKROOTKIT detected this thing on a RedHat 8.0 server 
> owned by a client of mine.
> 
> "Searching for ShKit rootkit default files and dirs... Possible ShKit 
> rootkit installed" <== chkrootkit output
> 
> I have only read limited information on this rootkit from a honeypot 
> report where it was used, no cleaning information. Ive googled a bunch 
> of times, dont go out of your way to answer this, the box will be redone 
> anyway. Im just curious to find out what this rootkit is about, not even 
> packetstorm has a copy to look at :)

There is exactly one way to properly clean up a rooted box: backup the
system (for later analysis and for keeping any data that might be
needed), wipe the disks and reinstall from known clean install media,
update the system to get all current security updates und properly
secure the box.

Just trying to "remove the rootkit" is not sufficient:
 - the attacker might have installed more than one root kit,
 - the attacker might have modified a standard root kit, rendering
   a "standard removal procedure" for this particular rootkit
   incomplete,
 - the attacker might have used a formerly unknown rootkit, so you have
   to analyze the system, 
 - you might simply not find everything the attacker left, because 
   kernel level tools where used and you are _running_ under the
   modified kernel environment which nicely hides parts of the
   modified system from you,
 - last but not least: even if you manage to successfully remove the
   rootkit, the original vulnerability which allowed the attacker
   to take over the machine in the first place it likely still there
 
Regards,
       Alex.
-- 
"Opportunity is missed by most people because it is dressed in overalls and
 looks like work."                                      -- Thomas A. Edison