Many duplicate binaries created in /usr/bin and /bin

Question

I have a CentOS box that's been up for about a year. It's not got anything hugely important on it, and had a lot of PHP code that I cannot personally vouch for and is fairly old. I realise this is asking for trouble.

I did the things I'm aware of to harden SSH and restrict access via IPTables etc. Today I've noticed a lot of worrying files in /usr/bin/ and /bin/. Lots of what looks like duplicates of binaries, created over a period of a couple of months at the rate of 20 or so a day:

-rw-r--r-- 1 root root 47024 Aug 7 2011 chage;4e3f01f7
-rw-r--r-- 1 root root 47024 Aug 7 2011 chage;4e3f1007
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f1e17
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f2c27
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f3a38
-rw-r--r-- 1 root root 47024 Aug 8 2011 chage;4e3f4846

The other binaries with similar going on are - newgrp, gpasswd, lastlog, dig, usleep and doexec.

The last file date is 8th August so I don't have any logs going back that far. Is anyone able to help me in understanding what has gone on here?

Answer 1

I can't tell you why it's happening, but those numbers after the ; look a lot like timestamps:

4e3f01f7 => Sun Aug  7 17:21:59 2011
4e3f1007 => Sun Aug  7 18:21:59 2011
4e3f1e17 => Sun Aug  7 19:21:59 2011
4e3f2c27 => Sun Aug  7 20:21:59 2011
4e3f3a38 => Sun Aug  7 21:22:00 2011
4e3f4846 => Sun Aug  7 22:21:58 2011

(seconds since the epoch in hex). By the fact that they're almost exactly a minute apart, I'd suspect maybe a cron job?

They're also the same size. Maybe you should check if they match with md5sum? or if they could even be the same file hardlinked? (check inode number in stat).