linux-kernel - Re: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPweEDybuOpPVidJWg+rfs8rU8y=xo4d3H=P7XQJh_DiKrF4DQ@mail.gmail.com>
Date:	Mon, 25 Jul 2011 22:08:24 +0100
From:	Luke Kenneth Casson Leighton <lkcl@...l.net>
To:	Matthias Schniedermeyer <ms@...d.de>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: ext3 hacked filesystem (by debian exim4 exploit) available for
 analysis and bugreporting

On Mon, Jul 25, 2011 at 2:45 PM, Matthias Schniedermeyer <ms@...d.de> wrote:
> On 25.07.2011 13:08, Luke Kenneth Casson Leighton wrote:
>> folks, hi,
>>
>> apart from anything, files which cannot be deleted (and cannot be
>> detected as "corrupted" by fsck.ext3) is pretty damn serious.
>
> You did try lsattr and checked that the files aren't 'immutable'?

 i didn't! :)  didn't know about (but should have guessed) ext3
attributes.  they are indeed - thank you matthias.

root@...etbaby:/mnt/horsebox/tmp3# lsattr *
----ia------------- bin3/kill
----ia------------- bin3/ps
----ia------------- c.pl
----ia------------- e.conf
----ia------------- sbin3/sysctl
----ia------------- usrbin3/uptime
----ia------------- usrbin3/tload
----ia------------- usrbin3/free
----ia------------- usrbin3/top
----ia------------- usrbin3/vmstat
----ia------------- usrbin3/watch
----ia------------- usrbin3/skill
----ia------------- usrbin3/pmap
----ia------------- usrbin3/pgrep
----ia------------- usrbin3/slabtop
----ia------------- usrbin3/pwdx
----ia------------- usrbin3/snice
----ia------------- usrbin3/pkill
----ia------------- usrbin3/w

so - looks like it's not as bad as i thought.

apologies for taking up peoples' time with this.

 l.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/