So I had a compromised /usr/bin/host process running and trying to open HTTP requests out of my machine. I killed it. But now I am wondering. Do I need /usr/bin/host for anything? How do I re-install it? I am on Ubuntu.
1000 thanks!
Add a comment
|
1 Answer
/usr/bin/host is a DNS lookup utility.
I doubt anyone can definitively say you need it or don't, it will depend on what you are running. I'm pretty sure its a core package so you should have it - that said, the system should run at least mostly fine without it.
That said, according to this thread the problem may be worse then you think, in as much as it may not be /usr/bin/host that is trojaned it may well be the underlying shared library its calling. You should also question if an attacker has been able to overwrite /usr/bin/host - in which case you can't trust the system. The ownership files on this are that it can only be written by root - which means they probably have own your box (and you don't). Sorry, but best practice dictates a reinstall of the box.
