0

I am getting very slow Internet experience. In vnstat I see

   rx:        4 kbit/s     3 p/s          tx:    94.74 Mbit/s 14072 p/s^C


 eth4  /  traffic statistics

                           rx         |       tx
--------------------------------------+------------------
  bytes                    11.85 MiB  |       30.30 GiB
--------------------------------------+------------------
          max            6.86 Mbit/s  |    94.93 Mbit/s
      average           28.18 kbit/s  |    73.80 Mbit/s
          min               0 kbit/s  |        0 kbit/s
--------------------------------------+------------------
  packets                      17127  |        37761168
--------------------------------------+------------------
          max                584 p/s  |       14108 p/s
      average                  4 p/s  |       10964 p/s
          min                  0 p/s  |           0 p/s
--------------------------------------+------------------
  time                 57.40 minutes

Using nethogs I see,

  PID USER     PROGRAM                                                                                                                                                         DEV        SENT      RECEIVED       
2546  root     su                                                                                                                                                              eth4       0.013       0.072 KB/sec
?     root     192.168.7.100:58888-43.250.83.106:61878                                                                                                                                    0.021       0.025 KB/sec
?     root     192.168.7.100:58888-70.24.39.90:65025                                                                                                                                      0.021       0.025 KB/sec
?     root     192.168.7.100:44145-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:52239-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:15834-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:29433-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:49576-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:36540-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:32289-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:25437-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:10155-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:32125-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:59269-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:57686-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:2747-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:59482-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:58985-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:56246-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:4345-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:10665-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:40676-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:35600-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:12241-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:43541-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:19124-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:1676-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:37809-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:7017-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:14998-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:64834-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:31544-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:17969-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:57675-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:32002-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:1233-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:64445-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:51733-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:38604-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:63299-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:96-115.28.112.60:7575                                                                                                                                        0.168       0.000 KB/sec
?     root     192.168.7.100:28078-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:40611-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:4304-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:43318-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec
?     root     192.168.7.100:8573-115.28.112.60:7575                                                                                                                                      0.168       0.000 KB/sec
?     root     192.168.7.100:51347-115.28.112.60:7575                                                                                                                                     0.168       0.000 KB/sec

It seems someone has run a torrent application and uploading everything from my pc. Not sure though.

How do i know what process is doing this nasty stuff? I need to stop and prevent it from happening in future also.

Am I being pawned?

Update

I have closed all the ports except sshd (22) by my routers firewall. Now I dont see this process. But now nethogs show this weird output.

  PID USER     PROGRAMDEV        SENT      RECEIVED       
?     root     unknown TCP      0.000       0.000 KB/sec
7
  • nethogs should've shown the program name. But anyway, what does netstat -natup shows.
    – Firelord
    Mar 20, 2015 at 10:08
  • netstat doesn't show any pid! Mar 20, 2015 at 10:16
  • The command I mentioned does. I double checked it. It does shows it.
    – Firelord
    Mar 20, 2015 at 10:18
  • @Firelord there is no entry for ip 115.28.112.60 in the output of netstat -natup Mar 20, 2015 at 10:29
  • I'm not sure how nethogs works exactly but doesn't that question mark mean it's a "past" connection? If the process doesn't exist anymore nethogs will show a question mark for it. The lack of 115.28.112.60 in netstat -natup seems to indicate as much. Are you still having weird connections at this moment? Maybe post the netstat -natup-result or/and even the ps aux to see if there is a weird process running you don't recognize.
    – Rik
    Mar 20, 2015 at 12:45

1 Answer 1

0

This seems like it might belong over in Information Security, but here's a start on seeing "how you'd know" and if you're being pwnd.

Some observations:

  • 43.250.83.106 is in Bangladesh (nearby)
  • 70.24.39.90 is in North America (Canada)
  • 115.28.112.60 is AsiaPacific (China), with no inbound traffic
  • Low port numbers (below the ephemeral limit for your OS) are privileged and not usually wanted outbound.
  • Though a portscan could explain the last set (a single source:IP) there's no evidence it's inbound sessions, and RSTs (in response to scans) are around 50 bytes (not 172) anyway.

To establish if it's possible C2 (at the top two addresses) followed by a rapid sequence of ports opened outbound (sending about 172 bytes each, closing with no apparent response) you'd have to reconnect the system and start capturing packets. Don't do that.

If you're going to keep it on / not backup, etc:

  • Review external firewall logs, or capture packets outside the system, to see if it's still trying to reach out. It may also be sending packets into your network. This may be as simple as DNS or ICMP outbound, to avoid revealing C2.
  • At the host itself, you can try several things:
    • First consider your tools are overriden or hooked. For this you can try statically-linked binaries you obtain/make yourself (and have on read-only media), or use busybox
    • "netstat -p" often only works with elevated permissions (you've certainly already elevated while investigating so this doesn't pose additional risk).
    • "lsof -i4" will show processes + IPv4 connections ( -i6 for IPv6 ).
    • Unhide compares /proc with 'ps', tries syscalls, does pid bruteforcing, a reverse thread search, and it can also reveal ports not visible to netstat.
    • ss -ap (processes + sockets)
    • rkhunter, chkrootkit (rootkit checkers)
    • check for anything running in weird places (like tmp folders)
    • check for resident scripts (perl, python, etc)

Other tools:

  • lsmod should show kernel modules
  • auditd (if added by your distro) should give you the ability to monitor for weird system calls and failures.
  • tcpdump (capture network traffic)
  • check your history files per user (include /root and /home/*) such as .bash_history, .lesshst, .mysql_history, etc.
  • check /proc/filesystems and any ck* filesystems you didn't install. Filesystems in userspace (FUSE) might be hiding scratch areas.

Preventing recurrence is a big, complex answer related to what happened. Firewalling (iptables), IDS/IPS (snort), disabling unnecessary services, auditing wget/curl/scripting language accesses, auditing executables dropped in weird places (home folders, temp folders), file integrity monitoring, etc. are a good start. SELinux (AppArmor is similar on other systems) tends to be a lot of work but it's also useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .