Re: Compromised...

[derek () USFCA EDU (Derek Vadala)]

On Mon, 14 Feb 2000, Stephen J. Friedl wrote:

> While trying to get the system back up enough to assess, I found that I could
> not replace certain binaries in /bin with fresh-from-CD versions: a few
> limited files got "operation not permitted" when I tried to rename or remove
> them.
>
> I was running Red Hat Linux 5.2: it is conceivable that he could have installed
> some kind of kernel module to have helped keep him around? I still have the
> old drive freeze-dried and available.

Sure. But it's more likely that his root kit did

chattr +u files...

making them undeleteable. You can use lsattr to check:

derek@bored:~ > lsattr /bin/ls
-u------ /bin/ls

chattr -u files... as root flags removes the flag and then you should be
able to replace.

+++ath
Derek Vadala, derek () usfca edu, http://www.cynicism.com/~derek