RE: Chkrootkit finds bindshell
From: Keith Bucher (kbucher_at_halomede.com)
Date: 08/23/05
- Previous message: Corey LeBleu: "Re: ONLINE Masters program for Information Security?"
- Maybe in reply to: Phil Cryer: "Chkrootkit finds bindshell"
- Next in thread: Esteban B.: "Re: Chkrootkit finds bindshell"
- Reply: Esteban B.: "Re: Chkrootkit finds bindshell"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 23 Aug 2005 08:29:09 -0700 To: phil@cryer.us
> -------- Original Message --------
> Subject: Chkrootkit finds bindshell
> From: "Phil Cryer" <phil@cryer.us>
> Date: Mon, August 22, 2005 7:58 am
> To: security-basics@securityfocus.com
>
> On:
>
> [root@pepe /usr/local/www/data]# uname -a
> FreeBSD pepe.cryer.us 6.0-CURRENT-SNAP004 FreeBSD 6.0-CURRENT-SNAP004 #0: Thu Jun 2 06:12:51 UTC 2005 root@wv1u.samsco.home:/usr/obj/usr/src/sys/GENERIC i386
>
> chkrootkit found:
> Checking `bindshell'... INFECTED (PORTS: 465)
>
> Googling finds that it's often a 'false positive'. What is the concensus from this group? What should be done?
>
> P
The bindshell check for chkrootkit simply checks to see if a specified
port is listening, it does not determine whether the process listening
on the port is legitimate or not. Use lsof or a similar utility to
find what process is listening on port 465 and then determine whether
it is legitimate or not (I've gotten this false positive from Exim
listening on port 465 before.)
Keith Bucher
- Previous message: Corey LeBleu: "Re: ONLINE Masters program for Information Security?"
- Maybe in reply to: Phil Cryer: "Chkrootkit finds bindshell"
- Next in thread: Esteban B.: "Re: Chkrootkit finds bindshell"
- Reply: Esteban B.: "Re: Chkrootkit finds bindshell"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
