Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 27 Oct 2019 15:31:48 +0100
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: "SYSTEM HAS BEEN COMPROMISED" - false positive.
 Kernel 5.3.7 Centos 7

Hi,

I will take a look on this soon. Sorry for delay.

Best regards,
Adam

On Thu, Oct 24, 2019 at 01:14:10PM +0200, bryn1u85 . wrote:
> Hey guys,
> 
> After KRG installed and rebooted clear Centos 7 server with 5.3.7 kernel,
> im getting flase positive message that my system has been compromised.
> 
> [   15.215179] [p_lkrg] Verifying 20 potential UMH paths for whitelisting...
> > [   15.215440] [p_lkrg] 4 UMH paths were whitelisted...
> > [   15.770986] [p_lkrg] [kretprobe] register_kretprobe() for
> > <ovl_create_or_link> failed! [err=-22]
> > [   15.771146] [p_lkrg] ERROR: Can't hook ovl_create_or_link function :(
> > [   16.101128] [p_lkrg] System does NOT support SMEP. LKRG can't enforece
> > smep_panic :(
> > [   16.101291] [p_lkrg] LKRG initialized successfully!
> > [   16.101388] OOM killer enabled.
> > [   16.101389] Restarting tasks ... done.
> > [   16.111918] [p_lkrg] Disabling "clean" message.
> > [   16.505143] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   16.507699] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   20.284601] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   20.287154] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   20.467062] e1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow
> > Control: None
> > [   20.467403] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
> > [   20.473798] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   20.476426] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   20.487083] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   20.489683] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   20.552752] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   20.557202] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   20.567645] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x99211d6b4730d08c] and should be [0x853fd9c99ce7506e] !!!
> > [   20.570199] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   21.449073] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xd08e6ff0783c57b9] and should be [0x853fd9c99ce7506e] !!!
> > [   21.452966] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   22.757754] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   22.760538] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.427505] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.429955] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.452633] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.456172] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.467435] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.470119] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.480574] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.483170] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.520029] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.523148] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   23.949947] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xa1ecee48b9020690] and should be [0x853fd9c99ce7506e] !!!
> > [   23.954075] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   24.709764] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > [   24.713784] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   25.314291] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > [   25.318615] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   27.216958] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > [   27.221325] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   31.553746] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0x9cda5720092fbda3] and should be [0x853fd9c99ce7506e] !!!
> > [   31.557484] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   46.916572] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [   46.920946] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   46.938976] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [   46.943298] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   61.849477] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [   61.853839] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   77.210168] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [   77.214487] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [   92.570441] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [   92.574755] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  107.930713] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  107.935054] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  123.291483] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  123.295817] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  138.651453] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  138.655770] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  144.437314] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  144.441864] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  154.012063] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  154.016381] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  169.372487] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  169.376807] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  184.733001] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  184.737362] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  200.093039] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  200.097373] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  215.453739] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  215.458065] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  230.809842] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  230.813139] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  246.174271] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  246.178591] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  261.534753] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  261.539121] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  276.895308] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  276.899637] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  292.256060] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  292.260376] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  307.616310] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  307.620630] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  322.976587] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  322.980904] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  338.337086] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  338.341404] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  344.481200] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  344.485567] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  353.697625] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  353.701967] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  369.057955] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  369.062276] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [  369.079009] [p_lkrg] ALERT !!! _STEXT MEMORY BLOCK HASH IS DIFFERENT -
> > it is [0xf670e7f89c8e9175] and should be [0x853fd9c99ce7506e] !!!
> > [  369.083003] [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED
> > DIFFERENT 1 CHECKSUMS !!!
> > [root@...039183 ~]#
> >
> 
> Someone can help ?
> 
> Thanks !

-- 
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.