SliTaz Forum

Strange package name - have I been hacked?

(12 posts) (5 voices)

• Started 9 years ago by gdesilva
• Latest reply from gdesilva
• This topic is resolved

Tags:

No tags yet.

1. 

   gdesilva
   

   offline

   Member

   Hi,

   I noticed that in one of my Slitaz installs, in the My Packages screen I get a strange package name with all numbers in the name field and no receipt details or file name details.

   This is the system that was having the issue of Invalid HZ value problem discussed earlier -

   http://forum.slitaz.org/topic/unknown-hz-value-53-assume-100

   I thought this could be due to compiling and installing nVidia 304 driver but when I reinstalled everything from scratch, including reinstall of Slitaz, all Unknown HZ value messages disappeared and I do not have this strange package name either.

   I have a partition image created by Clonezilla which might be useful in tracking down the issue.

   How can I verify whether this system was hacked or not?

   Posted 9 years ago #
2. 

   gdesilva
   

   offline

   Member

   Well...the plot thickens!

   I get the same issue with the new installation - screenshot attached. In My Packages, the first package is the one that is of concern.
   
   Two other older installations (both Slitaz 5 rc3) have not got the same issue.

   Any ideas?

   Thanks

   Attachments

   1. scrnshot.jpeg (98.2 KB, 1,672 downloads) 9 years old

   Posted 9 years ago #
3. 

   gdesilva
   

   offline

   Member

   Just checked the tazpkg.log and found the nameless package installation which occurred yesterday.

   2015-08-03 12:12:04 - Installed - get-flash-plugin (1.5) - ebb432b6172b51900025bbcb79968041
   2015-08-03 12:12:55 - Installed - curl (7.40.0) - e8026ab3984a873f5f91f6cb01981f43
   e3ae5670c929799228da011ae593e608
   2015-08-03 12:13:04 - Installed - nspr (4.10.8) - bbce1db7235066c435f6d67c30a5fe35
   2015-08-03 12:13:04 - Installed - nss (3.17.4) - e8fedbd2bb14e822b9599ed3e44168ec
   2015-08-03 12:13:05 - Installed - flash-plugin (11.2.202.491) - b1045c949f4e17fc7a1912ca88052710
   2015-08-03 16:40:22 - Installed - get-LibreOffice (1.2) - 8baaeb47cb8e88c96b837cae58c8b6ad
   2015-08-03 16:55:53 - Installed - get-java6-jre (1.1.0) - b2cf1e33cae2bd9c8fc10e372669c932
   2015-08-03 16:56:12 - Installed - p11-kit (0.6) - d0617e5245c0290b71f7bc298e145fa3
   2015-08-03 16:56:12 - Installed - gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
   8b2695a74671860046e38c3631c928bd
   2015-08-03 16:56:16 - Installed - cups-doc (2.0.2) - e04a776535b9a9566aa595adee17fcf9

   The package that shows up is the one starting with 8b2695a in the above list. When I click on this package in Tazpanel all I get is the following

   Package 8b2695a74671860046e38c3631c928bd Install
   Name
   Category non-free
   Description
   Website
   View receipt Improve package
   Installed files

   This cannot be related to installation of nVidia 304 package as it was done on 2nd August and this package appeared yesterday.

   Any comments or explanations will be greatly appreciated.

   Posted 9 years ago #
4. 

   Ceel
   

   offline

   Administrator

   Hi gdesilva,

   I've already see this in my tazpkg.log (I'm going to try to find it, it is on an another computer, I'm actually working from a Live). I don't think there is a problem; this appear when you install gnutls:
   
2015-08-04 16:36:05 - Installed - aspell (0.60.6) - 3db204ca148f355bb6ddfa78f8456e1f
2015-08-04 16:36:05 - Installed - bluefish (2.2.5) - 98ad37003ca4750f0459d236c4bc18c6

   2015-08-04 16:36:21 - Installed - readline (6.3) - 9f4f115b61b6cfa072afe7b0d6c9e643
2015-08-04 16:36:21 - Installed - p11-kit (0.6) - d0617e5245c0290b71f7bc298e145fa3
2015-08-04 16:36:22 - Installed - gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
8b2695a74671860046e38c3631c928bd
2015-08-04 16:38:03 - Installed - tazpkg (824) - 58ab14b571f90fd9ca40eb0cf777e313

   but it shouldn' appear in TazPanel.

   You can see in my tazpkg.log above I installed bluefish, gnutls and update tazpkg. See my packages list now
   - 3d18df375ec99839... and c9e7edb9275de08... were already present in the list (ISO 20150802) before I recharge the list a first time
   - 8b2695a74671860... appears after gnutls has been installed
   Maybe a bug in TazPanel (513 and 519 versions)

   

   Attachments

   1. packages_list.png (95.6 KB, 1,367 downloads) 9 years old

   Posted 9 years ago #
5. 

   Aleksej
   

   offline

   Coder-hobbyist

   Hi gdesilva,

   curl (7.40.0) - e8026ab3984a873f5f91f6cb01981f43
   e3ae5670c929799228da011ae593e608

   gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
   8b2695a74671860046e38c3631c928bd

   Maybe, both packages curl and gnutls has more than one line in packages.md5. Please test it:
   

   fgrep ' curl-'   /var/lib/tazpkg/packages.md5
   fgrep ' gnutls-' /var/lib/tazpkg/packages.md5

   Please, post your output here.

   When new version of program is installed, then old line from packages.md5 should be removed, and then new line should be added. But it may fail for unknown reason (maybe when package version not changed?).

   ________
   Hi Ceel,

   Just seen your post above mine :)

   Maybe a bug in TazPanel (513 and 519 versions)

   Seems, in TazPkg. Not in TazPanel.

   ________
   I moved md5 sum of packages into packages.info (for packages available on mirror) and installed.info (for installed packages). Anyone can check md5 of available and installed packages:
   

   awk -F$'\t' -vp='curl' '$1==p{print $9}' /var/lib/tazpkg/installed.info
   e3ae5670c929799228da011ae593e608
   
   awk -F$'\t' -vp='curl' '$1==p{print $9}' /var/lib/tazpkg/packages.info
   e3ae5670c929799228da011ae593e608

   ________
   Oh, I've got it! \o/

   e8026ab3984a873f5f91f6cb01981f43 --> package libcurl
   e3ae5670c929799228da011ae593e608 --> package curl
   
   3fd7086bf20603b6e72e7124b5614edb --> package libgnutls
   8b2695a74671860046e38c3631c928bd --> package gnutls

   Just slightly broken logic :)

   Posted 9 years ago #
6. 

   Genesis
   

   offline

   Member

   So, is there no reason for concerning about these packages with strange names?
   No security risks?

   Posted 9 years ago #
7. 

   Aleksej
   

   offline

   Coder-hobbyist

   Hi Genesis,

   No, there are no security risks. It is only another bug in the TazPkg.
   When it searches for md5sum (that long alphanumeric value) for "curl" — it finds md5sums both for "curl" and "libcurl", and shows them both.

   The probability that infection occurs through the package is very low. It is likely that during the infection some unusual file will appear somewhere in the /usr/bin or anywhere in an unpredictable place. Or some "good" file will be replaced by "bad" one. The command tazpkg check --full will help check these issues (but it works too long).
   ________

   Hi Ceel,
   Bug confirmed. I'll see if I can to fix it today.

   Posted 9 years ago #
8. 

   Aleksej
   

   offline

   Coder-hobbyist

   Ceel,

   That bug ("ghost" packages) fixed in the tazpkg-827 (changeset)
   TazPkg cooker

   I boot current ISO, upgraded tazpkg manually to the 827. Then I installed packages as you again. This time "ghosts" are gone away :)
   ________

   OK. Now we need the new ISO on the server (and I forgot how to make it manually).

   PS. Started it.

   Posted 9 years ago #
9. 

   Trixar_za
   

   offline

   Key Master

   I logged in to post the following: -facepalm-

   Please ask yourself the following questions before reporting a suspected 'hack': Do I handle sensitive information on a daily basis involving my or other governments, businesses, or terrorist organisations? Have I recently angered Anonymous in some way?

   If you answered yes to any of the above: Congratulations! Your paranoia is justified!

   If you answered no to both: Please walk to the nearest mirror and look at it. That person's paranoia isn't justified. They probably have boring files and porn collection. That person assumes when they see something odd, it's some sign of them being 'hacked' - where logical reasoning would have proved otherwise. Now lift your right hand and slap that person. Thank you.

   I'm sorry if that was mean, but this is like the third time you've started a hack scare when it really wasn't.

   Why not focus on real security risks like the version of bash we have in the repositories? We have quite a few packages like that and you're more likely to find such a leak than a SliTaz dev trying to slip in a backdoor - but thanks for your vote of confidence in them.

   Posted 9 years ago #
10. 

    gdesilva
    

    offline

    Member

    Thanks a lot for all those who took the trouble to look into this.

    @Trizar_za, have you considered joining Microsoft? Your attitude fits perfectly well with theirs! I am also sorry if this is a mean comment but find this sort of attitude from a so called Linux guru rather appalling. In fact this is not the first time you have come up with such callous statements.

    If users reporting issues is an annoyance to you, however small or stupid you may think they are, then Mr. Keymaster, it is time that you hand over the keys to some one else who can handle the pressure without bursting an artery! I do appreciate whatever contribution you are making towards Slitaz but it would be more useful if you can possibly leave your attitude behind in the washroom before jumping on the keyboard.

    Hope you are not offended ;)

    Posted 9 years ago #
11. 

    Genesis
    

    offline

    Member

    No, there are no security risks. It is only another bug in the TazPkg.

    Thank you, Aleksej!

    Posted 9 years ago #
12. 

    gdesilva
    

    offline

    Member

    Thanks Aleksej for your time and efforts in answering 'dumb' questions by dumb people like me! It is people like yourself who will help make Slitaz become a widely used distro. Thanks again.

    Posted 9 years ago #

RSS feed for this topic

Reply

You must log in to post.