Text 6663, 130 rader
Skriven 2006-08-01 11:08:40 av WAYNE CHIRNSIDE (1:123/140)
     Kommentar till en text av ROSS CASSELL
Ärende: Hijacked
================
-> Hello WAYNE!

-> 01 Aug 06 07:14, you wrote to me:

->  WC> -> But nevertheless, if you are using Debian or a debian like distro,
->  WC> apt can turn -> a linux box into a brick if installing packages willy
->  WC> nilly.

->  WC> Can't even turn it into a brick.

-> What I inferred is, its possible that perhaps a apt upgrade you performed
-> contributed to this issue? Not saying that is the exact case, but that is
the
-> danger apt can introduce.

It's one of two likely entry vectors.
There was a tojan alert about a Mozilla browser threat and it acted up
when I upgraded that browser.

OTOH it strikes Konqueror as well and has partitioned off a gig of hard
drive space for itself appearently.
The default settings for apt-get's config file stink I do believe.
Now changed, too late.

->  WC> I tried.
->  WC> Linux fdisk in expert mode won't touch this malware hiding
->  WC> in a hidden partition appearently written to superblocks.
->  WC> I've tried fdisking, file deleting and mkfs'ing for three days now
->  WC> to no avail.
->  WC> It just keeps coming back as it's never left.

-> Then you boot to the liveCD and blow the partitioning away and start over
from
-> scratch. When booted from the LiveCD you are running from its environment,
not
-> the corrupted one.  

Wanna bet?
What do you think I was doing by day three?
Still won't touch it.
disable hard drives in CMOS, the live CD STILL sees it and will not
partition the drive.
It lets you _think_ you did.
Look at it with fdisk -l or cfdisk and it looks fine but once
you reboot it's back and the previous partitoning is back, hell it never
left.

->  WC> -> Also I forget if you upgraded your internet access to broadband or
->  WC> not, but I -> seriously doubt you got compromised via dial-up.

->  WC> Exactly how I got compromised, dialup only here.
->  WC> I've a mystery super user hiding in a hidden partition on the har
->  WC> drive. Fdisk won't touch it even in expert mode. Can't even turn it
->  WC> into a brick.

-> See above.

Been there already, done that repeatedly, no joy.
cfdisk, mkfs, fdisk -t ext2 /dev/hda, fdisk -x option from live CD
boot, no joy.
Drive geometry is hacked with, it's subtly wrong.
The malware has taken a Gig partition yet very little media is missing.

One odd thing  in fdisk right next to the block count is the little
plus signs that were not there before the attack.

->  WC> Fdisk _looks_ like it worked, reboot, the partitioning is
->  WC> different, hard drive geometry is wrong and there's 5 percent of my
->  WC> hard drive jacked I can't get rid of short of a hammer it
->  WC> appears. This malware sneers at fdisk.

-> If you have booted to a liveCD and fdisked and the issues are not
eliminated,
-> then perhaps you have a bad drive?            

Drive checked out absolutely perfect.  
fsck runs perfectly and reports nothing on boot.
It's clearly malware.
Clever and devious and so far appearently invulnerable malware at that.

->  WC> -> Its not impossible but on dial up speeds you are an amoeba in the
->  WC> pond of -> targets, where the targets are fish.

->  WC> I know this.
->  WC> I expect I was randomly swept up however there was a strange telephone
->  WC> call last night that _seemed_ to be on a phishing expedition.
->  WC> Call me paranoid but I'm not used to fdisk failing like it has.

-> If you are on dial-up, your system is unable to connect to the internet
based
-> on a call incoming to you/it.

-> Of course when in doubt, you can alway remove the phoneline from the modem
-> whenever there is a question.

->  WC> -> If your setup is cluster-fucked, take Maurices advice,
->  WC> re-partition, re-format -> and reinstall and look into getting
->  WC> tripwire installed on it, that way you will -> know if something got
->  WC> tampered with.

->  WC> I've spent THREE days repartitioning, no joy.
->  WC> There's a hidden SU account in a partition that will not die or be
->  WC> fdisked away.
->  WC> Fdisk, reboot..., it's back :-(

-> But if you boot to the liveCD....

No joy in partitioning from live CD.
No joy disabling drives in CMOS.
Wound up pulling IDE and power cables, that dunnit.
No bookmarks, no cookies.
New passwords all around.
Possible phone phishing attempt last night.
Definate email phishing incident this morning with online banking
that arrived ( with file attachment) in the inbox right after I
setup live CD inm RAM.
Powered down to clear and sure enough there is *no* report in 
my online banking of that email warning having been sent.
All the logo's were right, the fraud was quite good.
Even the information was right as to where to check.
Just that file attachment and lack of account tampering the email 
alert claimed to alert me to.
Now had I responded to that attachment and clicked anything or even not
powered down before hitting the banks web page...

I really didn't need this just now.
The damned computer is all I've got and without a hard drive it's
severely crippled.
--- Platinum Xpress/Win/WINServer v3.0pr5
 * Origin: Try Our Web Based QWK: DOCSPLACE.ORG (1:123/140)