[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 29 Jan 2020 20:04:11 +0000
From: Rob van der Kraan <robkraan@...e.nl>
To: Adam Zabrocki <pi3@....com.pl>, "lkrg-users@...ts.openwall.com"
<lkrg-users@...ts.openwall.com>
Subject: Re: [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS
DIFFERENT
The LKRG alert (that the computed hashes were different) did have to do with my loading of a guest VM. But as I installed LKRG on the host, these changes were to be expected. In the words of Adam Zabrocki:
Ah, then it's expected. When you start new VM, host machine reconfigure one of
the (V)CPU/core which will be running your VM. This reconfiguration changes
some internal CPU metadata like MSRs and that's why you see this:
> > > > [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is
[0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
What you should do is to update to the latest LKRG from the repo and configure
LKRG to not check MSRs via setting lkrg.enforce_msr to 0. You can do it in 2
ways:
1) after you load LKRG, run: sysctl lkrg.enforce_msr=0
2) enforce_msr is one of the new LKRG module parameter which you can set during
module loading. E.g. insmod p_lkrg.ko enforce_msr=0
So, I git cloned the repo, ran LKRG with the new enforce_msr=0 setting, and the confusing alert has gone.
Thanks Adam
Rob
________________________________
Van: Adam Zabrocki <pi3@....com.pl>
Verzonden: dinsdag 28 januari 2020 21:22
Aan: lkrg-users@...ts.openwall.com <lkrg-users@...ts.openwall.com>
Onderwerp: Re: [lkrg-users] [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT
Hi,
Can you confirm that you are running the latest LKRG from the repo?
If no, can you update to the latest version from repo and reverify it?
Thanks,
Adam
On Tue, Jan 28, 2020 at 07:31:48PM +0000, Rob van der Kraan wrote:
> Hi, looks like Patrick Schleizer's problem in msg 225, but the specific error msg is different. Can it have anything to do with my loading of Whonix as guest OS.
>
> cat /proc/version
> Linux version 5.3.0-26-generic (buildd@...01-amd64-039) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #28~18.04.1-Ubuntu SMP Wed Dec 18 16:40:14 UTC 2019
>
> cat /proc/cmdline
> BOOT_IMAGE=/boot/vmlinuz-5.3.0-26-generic root=UUID=b0791e24-4fb6-451a-9e3b-182a4faf6bf5 ro quiet splash vt.handoff=1
>
> sudo journalctl -b -o cat | grep lkrg
> [sudo] password for r:
> Window manager warning: Buggy client sent a _NET_ACTIVE_WINDOW message with a timestamp of 0 for 0x3e00084 (lkrg-users)
> r : TTY=pts/0 ; PWD=/home/r/lkrg-main ; USER=root ; COMMAND=/sbin/insmod output/p_lkrg.ko p_init_log_level=3
> p_lkrg: loading out-of-tree module taints kernel.
> p_lkrg: module verification failed: signature and/or required key missing - tainting kernel
> [p_lkrg] Loading LKRG...
> [p_lkrg] Verifying 21 potential UMH paths for whitelisting...
> [p_lkrg] 4 UMH paths were whitelisted...
> [p_lkrg] [kretprobe] register_kretprobe() for <ovl_create_or_link> failed! [err=-22]
> [p_lkrg] ERROR: Can't hook ovl_create_or_link function :(
> [p_lkrg] LKRG initialized successfully!
> r : TTY=pts/0 ; PWD=/home/r/lkrg-main ; USER=root ; COMMAND=/bin/dmesg
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xf1ff69c8c863fbb0] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xf1ff69c8c863fbb0] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> r : TTY=pts/0 ; PWD=/home/r/lkrg-main ; USER=root ; COMMAND=/sbin/insmod output/p_lkrg.ko p_init_log_level=3
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> r : TTY=pts/0 ; PWD=/home/r/lkrg-main ; USER=root ; COMMAND=/bin/dmesg
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x6db4a08b5819213b] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x87ed3f646223c1db] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x6db4a08b5819213b] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0x372e9a398d17de97] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating kernel core .text section hash!
> [p_lkrg] [JUMP_LABEL <batch mode>] Updating module's core .text section hash!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> [p_lkrg] ALERT !!! HASHES FROM CPUs METADATA IS DIFFERENT- it is [0xdd7705d6b72d3e77] and should be [0xa05e8f027c3884d0] !!!
> [p_lkrg] ALERT !!! SYSTEM HAS BEEN COMPROMISED - DETECTED DIFFERENT 1 CHECKSUMS !!!
> r : TTY=pts/0 ; PWD=/home/r/lkrg-main ; USER=root ; COMMAND=/bin/journalctl -b -o cat
>
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
