OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
FreeBSD Security Archives: RE: Strange things on my computer /

RE: Strange things on my computer / Help

Beck David (dbeckfreesoft.hu)
Fri, 29 Oct 1999 17:17:22 +0200

Beck David <dbeckfreesoft.hu> writes:
> - but the kernel complains in every 10 minutes for some _out_ going
> ICMP packets, which goes to two hosts. I am absolutely sure
> that nor me nor any of my programs has nothing to do with that hosts

What kind of ICMP packets? Could you set up a sniffer to capture those
packets? (tcpdump will do). They may be completely benign (e.g.
ICMP_UNREACH or ICMP_TIMXCEED)

> - when I found this I started to look for the program which generates
> the ICMP packets but I didn't find anything

The TCP/IP stack generates ICMP packets on its own in certain
circumstances.

> Do you guys suspect that my machine got exploited ? /I do, but I can't
> prove it./

Like somebody else suggested, compare MD5 checksums of your system
binaries (using a known-good copy of /sbin/md5) with those of
known-good binaries. The best choice of known-good binaries is the
live file system on the second CD-ROM in the set you used to install
the machine in the first place.

If you can afford the downtime (generally speaking, if you suspect a
compromise, you don't have much choice but to accept the downtime),
boot the system from known-good boot floppies or (preferably) a
bootable CD-ROM such as the one that comes with the Walnut Creek
distribution before running checks.

-----------
- The ICMP type is 3.3: port unreachable

Thank you guys your advises.
I check my system using the live filesystem.

Cheers, David.

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

This archive was generated by hypermail 2.0b3 on Fri Oct 29 1999 - 10:20:17 CDT