[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191102045559.GA2676@pi3.com.pl>
Date: Sat, 2 Nov 2019 05:55:59 +0100
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: "SYSTEM HAS BEEN COMPROMISED" - false positive.
Kernel 5.3.7 Centos 7
Hi,
I've pushed some significant changes to the official repo. Linux kernel 5.3+
introduced new logic for JUMP_LABEL engine. New changes suppose to bring
support for it, nevertheless I would still treat them as 'beta' so far. Please
let me know in case of any problems.
Thanks,
Adam
On Sun, Oct 27, 2019 at 03:31:48PM +0100, Adam Zabrocki wrote:
> Hi,
>
> I will take a look on this soon. Sorry for delay.
>
> Best regards,
> Adam
>
> On Thu, Oct 24, 2019 at 01:14:10PM +0200, bryn1u85 . wrote:
> > Hey guys,
> >
> > After KRG installed and rebooted clear Centos 7 server with 5.3.7 kernel,
> > im getting flase positive message that my system has been compromised.
> >
> > [ 15.215179] [p_lkrg] Verifying 20 potential UMH paths for whitelisting...
> > > [ 15.215440] [p_lkrg] 4 UMH paths were whitelisted...
> > > [ 15.770986] [p_lkrg] [kretprobe] register_kretprobe() for
> > > <ovl_create_or_link> failed! [err=-22]
> > > [ 15.771146] [p_lkrg] ERROR: Can't hook ovl_create_or_link function :(
> > > [ 16.101128] [p_lkrg] System does NOT support SMEP. LKRG can't enforece
> > > smep_panic :(
> > > [ 16.101291] [p_lkrg] LKRG initialized successfully!
> > > [ 16.101388] OOM killer enabled.
> > > [ 16.101389] Restarting tasks ... done.
> > > [ 16.111918] [p_lkrg] Disabling "clean" message.
> > > [ 16.505143] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 16.507699] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 20.284601] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 20.287154] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 20.467062] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow
> > > Control: None
> > > [ 20.467403] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
> > > [ 20.473798] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 20.476426] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 20.487083] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 20.489683] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 20.552752] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 20.557202] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 20.567645] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > > [ 20.570199] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 21.449073] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xd08e6ff0783c57b9] and should be [0x853fd9c99ce7506e] !!!
> > > [ 21.452966] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 22.757754] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 22.760538] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.427505] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.429955] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.452633] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.456172] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.467435] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.470119] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.480574] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.483170] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.520029] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.523148] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 23.949947] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > > [ 23.954075] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 24.709764] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > [ 24.713784] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 25.314291] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > [ 25.318615] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 27.216958] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > [ 27.221325] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 31.553746] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > > [ 31.557484] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 46.916572] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 46.920946] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 46.938976] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 46.943298] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 61.849477] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 61.853839] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 77.210168] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 77.214487] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 92.570441] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 92.574755] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 107.930713] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 107.935054] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 123.291483] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 123.295817] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 138.651453] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 138.655770] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 144.437314] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 144.441864] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 154.012063] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 154.016381] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 169.372487] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 169.376807] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 184.733001] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 184.737362] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 200.093039] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 200.097373] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 215.453739] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 215.458065] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 230.809842] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 230.813139] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 246.174271] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 246.178591] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 261.534753] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 261.539121] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 276.895308] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 276.899637] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 292.256060] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 292.260376] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 307.616310] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 307.620630] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 322.976587] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 322.980904] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 338.337086] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 338.341404] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 344.481200] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 344.485567] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 353.697625] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 353.701967] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 369.057955] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 369.062276] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [ 369.079009] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > > [ 369.083003] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > > DIFFERENT 1 CHECKSUMS !!!
> > > [root@...039183 ~]#
> > >
> >
> > Someone can help ?
> >
> > Thanks !
>
> --
> pi3 (pi3ki31ny) - pi3 (at) itsec pl
> http://pi3.com.pl
>
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
