[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 Oct 2019 13:14:10 +0200
From: "bryn1u85 ." <m.bryn1u@...il.com>
To: lkrg-users@...ts.openwall.com
Subject: "SYSTEM HAS BEEN COMPROMISED" - false positive. Kernel 5.3.7 Centos 7
Hey guys,
After KRG installed and rebooted clear Centos 7 server with 5.3.7 kernel,
im getting flase positive message that my system has been compromised.
[ 15.215179] [p_lkrg] Verifying 20 potential UMH paths for whitelisting...
> [ 15.215440] [p_lkrg] 4 UMH paths were whitelisted...
> [ 15.770986] [p_lkrg] [kretprobe] register_kretprobe() for
> <ovl_create_or_link> failed! [err=-22]
> [ 15.771146] [p_lkrg] ERROR: Can't hook ovl_create_or_link function :(
> [ 16.101128] [p_lkrg] System does NOT support SMEP. LKRG can't enforece
> smep_panic :(
> [ 16.101291] [p_lkrg] LKRG initialized successfully!
> [ 16.101388] OOM killer enabled.
> [ 16.101389] Restarting tasks ... done.
> [ 16.111918] [p_lkrg] Disabling "clean" message.
> [ 16.505143] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 16.507699] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 20.284601] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 20.287154] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 20.467062] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow
> Control: None
> [ 20.467403] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
> [ 20.473798] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 20.476426] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 20.487083] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 20.489683] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 20.552752] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 20.557202] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 20.567645] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> [ 20.570199] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 21.449073] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xd08e6ff0783c57b9] and should be [0x853fd9c99ce7506e] !!!
> [ 21.452966] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 22.757754] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 22.760538] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.427505] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.429955] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.452633] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.456172] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.467435] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.470119] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.480574] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.483170] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.520029] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.523148] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 23.949947] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> [ 23.954075] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 24.709764] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> [ 24.713784] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 25.314291] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> [ 25.318615] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 27.216958] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> [ 27.221325] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 31.553746] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> [ 31.557484] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 46.916572] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 46.920946] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 46.938976] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 46.943298] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 61.849477] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 61.853839] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 77.210168] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 77.214487] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 92.570441] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 92.574755] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 107.930713] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 107.935054] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 123.291483] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 123.295817] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 138.651453] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 138.655770] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 144.437314] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 144.441864] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 154.012063] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 154.016381] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 169.372487] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 169.376807] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 184.733001] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 184.737362] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 200.093039] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 200.097373] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 215.453739] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 215.458065] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 230.809842] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 230.813139] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 246.174271] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 246.178591] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 261.534753] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 261.539121] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 276.895308] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 276.899637] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 292.256060] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 292.260376] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 307.616310] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 307.620630] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 322.976587] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 322.980904] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 338.337086] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 338.341404] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 344.481200] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 344.485567] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 353.697625] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 353.701967] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 369.057955] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 369.062276] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [ 369.079009] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> [ 369.083003] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> DIFFERENT 1 CHECKSUMS !!!
> [root@...039183 ~]#
>
Someone can help ?
Thanks !
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
