SliTaz Forum
You are not logged in.
Hi,
I noticed that in one of my Slitaz installs, in the My Packages screen I get a strange package name with all numbers in the name field and no receipt details or file name details.
This is the system that was having the issue of Invalid HZ value problem discussed earlier -
http://forum.slitaz.org/topic/unknown-hz-value-53-assume-100
I thought this could be due to compiling and installing nVidia 304 driver but when I reinstalled everything from scratch, including reinstall of Slitaz, all Unknown HZ value messages disappeared and I do not have this strange package name either.
I have a partition image created by Clonezilla which might be useful in tracking down the issue.
How can I verify whether this system was hacked or not?
Offline
Well...the plot thickens!
I get the same issue with the new installation - screenshot attached. In My Packages, the first package is the one that is of concern.
[attachment=38850,1982]
Two other older installations (both Slitaz 5 rc3) have not got the same issue.
Any ideas?
Thanks
Offline
Just checked the tazpkg.log and found the nameless package installation which occurred yesterday.
2015-08-03 12:12:04 - Installed - get-flash-plugin (1.5) - ebb432b6172b51900025bbcb79968041
2015-08-03 12:12:55 - Installed - curl (7.40.0) - e8026ab3984a873f5f91f6cb01981f43
e3ae5670c929799228da011ae593e608
2015-08-03 12:13:04 - Installed - nspr (4.10.8) - bbce1db7235066c435f6d67c30a5fe35
2015-08-03 12:13:04 - Installed - nss (3.17.4) - e8fedbd2bb14e822b9599ed3e44168ec
2015-08-03 12:13:05 - Installed - flash-plugin (11.2.202.491) - b1045c949f4e17fc7a1912ca88052710
2015-08-03 16:40:22 - Installed - get-LibreOffice (1.2) - 8baaeb47cb8e88c96b837cae58c8b6ad
2015-08-03 16:55:53 - Installed - get-java6-jre (1.1.0) - b2cf1e33cae2bd9c8fc10e372669c932
2015-08-03 16:56:12 - Installed - p11-kit (0.6) - d0617e5245c0290b71f7bc298e145fa3
2015-08-03 16:56:12 - Installed - gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
8b2695a74671860046e38c3631c928bd
2015-08-03 16:56:16 - Installed - cups-doc (2.0.2) - e04a776535b9a9566aa595adee17fcf9
The package that shows up is the one starting with 8b2695a in the above list. When I click on this package in Tazpanel all I get is the following
Package 8b2695a74671860046e38c3631c928bd Install
Name
Category non-free
Description
Website
View receipt Improve package
Installed files
This cannot be related to installation of nVidia 304 package as it was done on 2nd August and this package appeared yesterday.
Any comments or explanations will be greatly appreciated.
Offline
Hi gdesilva,
I've already see this in my tazpkg.log (I'm going to try to find it, it is on an another computer, I'm actually working from a Live). I don't think there is a problem; this appear when you install gnutls:
[c]
2015-08-04 16:36:05 - Installed - aspell (0.60.6) - 3db204ca148f355bb6ddfa78f8456e1f
2015-08-04 16:36:05 - Installed - bluefish (2.2.5) - 98ad37003ca4750f0459d236c4bc18c6
2015-08-04 16:36:21 - Installed - readline (6.3) - 9f4f115b61b6cfa072afe7b0d6c9e643
2015-08-04 16:36:21 - Installed - p11-kit (0.6) - d0617e5245c0290b71f7bc298e145fa3
2015-08-04 16:36:22 - Installed - gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
8b2695a74671860046e38c3631c928bd
2015-08-04 16:38:03 - Installed - tazpkg (824) - 58ab14b571f90fd9ca40eb0cf777e313
[/c]
but it shouldn' appear in TazPanel.
You can see in my tazpkg.log above I installed bluefish, gnutls and update tazpkg. See my packages list now
- 3d18df375ec99839... and c9e7edb9275de08... were already present in the list (ISO 20150802) before I recharge the list a first time
- 8b2695a74671860... appears after gnutls has been installed
Maybe a bug in TazPanel (513 and 519 versions)
[attachment=38853,1983]
Offline
Hi gdesilva,
curl (7.40.0) - e8026ab3984a873f5f91f6cb01981f43
e3ae5670c929799228da011ae593e608
gnutls (3.3.12) - 3fd7086bf20603b6e72e7124b5614edb
8b2695a74671860046e38c3631c928bd
Maybe, both packages curl and gnutls has more than one line in packages.md5. Please test it:
[c]fgrep ' curl-' /var/lib/tazpkg/packages.md5
fgrep ' gnutls-' /var/lib/tazpkg/packages.md5[/c]
Please, post your output here.
When new version of program is installed, then old line from packages.md5 should be removed, and then new line should be added. But it may fail for unknown reason (maybe when package version not changed?).
________
Hi Ceel,
Just seen your post above mine 
Maybe a bug in TazPanel (513 and 519 versions)
Seems, in TazPkg. Not in TazPanel.
________
I moved md5 sum of packages into packages.info (for packages available on mirror) and installed.info (for installed packages). Anyone can check md5 of available and installed packages:
[c]awk -F$'\t' -vp='curl' '$1==p{print $9}' /var/lib/tazpkg/installed.info
e3ae5670c929799228da011ae593e608
awk -F$'\t' -vp='curl' '$1==p{print $9}' /var/lib/tazpkg/packages.info
e3ae5670c929799228da011ae593e608[/c]
________
Oh, I've got it! \o/
[c]e8026ab3984a873f5f91f6cb01981f43 --> package libcurl
e3ae5670c929799228da011ae593e608 --> package curl
3fd7086bf20603b6e72e7124b5614edb --> package libgnutls
8b2695a74671860046e38c3631c928bd --> package gnutls[/c]
Just slightly broken logic
Offline
So, is there no reason for concerning about these packages with strange names?
No security risks?
Offline
Hi Genesis,
No, there are no security risks. It is only another bug in the TazPkg.
When it searches for md5sum (that long alphanumeric value) for "curl" — it finds md5sums both for "curl" and "libcurl", and shows them both.
The probability that infection occurs through the package is very low. It is likely that during the infection some unusual file will appear somewhere in the /usr/bin or anywhere in an unpredictable place. Or some "good" file will be replaced by "bad" one. The command [c]tazpkg check --full[/c] will help check these issues (but it works too long).
________
Hi Ceel,
Bug confirmed. I'll see if I can to fix it today.
Offline
Ceel,
That bug ("ghost" packages) fixed in the tazpkg-827 (changeset)
I boot current ISO, upgraded tazpkg manually to the 827. Then I installed packages as you again. This time "ghosts" are gone away
________
OK. Now we need the new ISO on the server (and I forgot how to make it manually).
PS. Started it.
Offline
I logged in to post the following: -facepalm-
Please ask yourself the following questions before reporting a suspected 'hack': Do I handle sensitive information on a daily basis involving my or other governments, businesses, or terrorist organisations? Have I recently angered Anonymous in some way?
If you answered yes to any of the above: Congratulations! Your paranoia is justified!
If you answered no to both: Please walk to the nearest mirror and look at it. That person's paranoia isn't justified. They probably have boring files and porn collection. That person assumes when they see something odd, it's some sign of them being 'hacked' - where logical reasoning would have proved otherwise. Now lift your right hand and slap that person. Thank you.
I'm sorry if that was mean, but this is like the third time you've started a hack scare when it really wasn't.
Why not focus on real security risks like the version of bash we have in the repositories? We have quite a few packages like that and you're more likely to find such a leak than a SliTaz dev trying to slip in a backdoor - but thanks for your vote of confidence in them.
Offline
Thanks a lot for all those who took the trouble to look into this.
@Trizar_za, have you considered joining Microsoft? Your attitude fits perfectly well with theirs! I am also sorry if this is a mean comment but find this sort of attitude from a so called Linux guru rather appalling. In fact this is not the first time you have come up with such callous statements.
If users reporting issues is an annoyance to you, however small or stupid you may think they are, then Mr. Keymaster, it is time that you hand over the keys to some one else who can handle the pressure without bursting an artery! I do appreciate whatever contribution you are making towards Slitaz but it would be more useful if you can possibly leave your attitude behind in the washroom before jumping on the keyboard.
Hope you are not offended 
Offline
No, there are no security risks. It is only another bug in the TazPkg.
Thank you, Aleksej!
Offline
Thanks Aleksej for your time and efforts in answering 'dumb' questions by dumb people like me! It is people like yourself who will help make Slitaz become a widely used distro. Thanks again.
Offline
[ Generated in 0.015 seconds, 7 queries executed - Memory usage: 1.56 MiB (Peak: 1.77 MiB) ]