there is one good reason why this post is attracting so much attention: you managed to record the whole, live session of an intruder on your PC. This is very different from our everyday experience, where we deal with the discovery of the consequences of his actions and try to redress them. Here we see him at work, see him having some problems with establishing the backdoor, retrace his steps, work feverishly (perhaps because he was sitting at your desk, as suggested above, or perhaps, and in my opinion more likely, because he was unable to make his malware run on the system, read below), and try to deploy fully self-contained instruments of control.
This is what security researchers witness daily with their honey traps. For me, this is a very rare chance, and the source of some amusement.
You have definitely been hacked. The evidence for this does not come from the snippet of the
auth.log file you displayed, because this reports an unsuccessful login attempt, occurring over a short time span (two secs). You will notice that the second line states
Failed password, while the third one reports a
pre-auth disconnect: the guy tried and failed.
The evidence comes instead from the content of the two files
http://220.127.116.11:65534/yjz1 which the attacker downloaded onto your system.
The site is currently open to anyone to download them, which I did. I first ran
file on them, which showed:
$ file y*
yjz: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
yjz1: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
Then I brought them onto a 64-bit Debian VM I have; an examination of their content thru the
strings command revealed much that was suspicious (reference to various well-known attacks, to commands to be substituted for, a script that was clearly used to set up a new service, and so on).
I then produced the MD5-hashes of both files, and fed them to Cymru's hash database to see whether they are known agents of malware. While
yjz is not,
yjz1 is, and Cymru reports a probability of detection by anti-virus software of 58%. It also states that this file was last seen some three days ago, so it is reasonably recent.
Running clamscan (part of the
clamav package) on the two files I obtained:
$ clamscan y*
yjz: Linux.Backdoor.Gates FOUND
yjz1: Linux.Trojan.Xorddos FOUND
so we are now certain that standard Linux software can identify it.
What should you do?
Though rather new, neither system is very new, see this Jan. 2015 article on XorDdos, for instance. So most free packages should be able to remove it. You should try:
chkrootkit. I have Googled around, and seen that they claim to be able to spot it. Use them to check on the predecessor's work, but after running these three programs you should be ready to go.
As for the larger question,
what should you do to prevent future infections, Journeyman's answer is a good first step. Just keep in mind that it is an ongoing struggle, one that all of us (including me!) may very well have lost without even knowing it.
At Viktor Toth's (indirect) prompt, I would like to add a few comments. It is certainly true that the intruder encountered some difficulties: he downloads two distinct hacking tools, changes their permissions several times, restarts them several times, and tries many times to disable the firewall. It is easy to guess what is happening: he expects his hacking tools to open a communication channel toward one of his infected pcs (see later), and, when he does not see this new channel spring up on his control GUI, fears his hacking tool is being blocked by the firewall, so he repeats the installation procedure. I agree with Viktor Toth that this particular stage of his operation does not seem to bring the expected fruits, but I would like to encourage you very strongly not to underestimate the extent of the damage inflicted on your pc.
I provide here a partial output of
# chkconfig: 12345 90 90
# description: %s
### BEGIN INIT INFO
# Provides: %s
# Default-Start: 1 2 3 4 5
# Short-Description: %s
### END INIT INFO
case $1 in
sed -i '/\/etc\/cron.hourly\/gcc4.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc4.sh' >> /etc/crontab
GET %s HTTP/1.1
POST %s HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)
This provides evidence of tampering with the services (in
/etc/init.d and in
crontab, with the history file of
mysql, and a couple of files in
proc which are links to
bash (which suggests a custom-made fraudulent version of your shell has been planted). Then the program generates an HTTP request (to a Chinese-speaking site,
which gives substance to David Schwartz's comment above), which may create even more havoc. In the request, binaries (
Content-Type: application/x-www-form-urlencoded) are to be downloaded to the attacked pc (GET) and uploaded to the controlling machine (POST). I could not establish what would be downloaded to the attacked pc, but, given the small size of both
yjz1 (1.1MB and 600kB, repectively), I can venture to surmise that most of the files needed to cloak the rootkit, i.e. the altered versions of
ifconfig,..., would be downloaded this way. And this would explain the attacker's feverish attempts to get this download going.
There is no certainty that the above exhausts all possibilities: we certainly lack part of the transcript (between lines 457 and 481) and we do not see a logout; furthermore, especially worrisome are lines 495-497,
cd /tmp; ./yd_cd/make
which refer to a file we did not see downloaded, and which might be a compilation: if so, it means the attacker has (finally?) understood what the problem with his executables was, and is trying to fix it, in which case the attacked pc has gone for good. [In fact, the two versions of the malware which the attacker downloaded onto the hacked machine (and I onto my 64bit Debian VM) are for an unsuitable architecture, x86, while the name alone of the hacked-into pc gives away the fact that he was dealing with an arm architecture].
The reason why I wrote this edit is to urge you as strongly as possible either to comb your system with a professional instrument, or to re-install from scratch.
And, by the way, should this prove useful to anyone, this is the list of of the 331 IP addresses to which
yjz tries to connect. This list is so large (and probably destined to become larger still) that I believe this is the reason for tampering with
mysql. The list provided by the other backdoor is identical, which, I presume, is the reason for leaving such an important piece of information out in the open (I think the attacker did not wish to make the effort to store them in kernel format, so he put the whole list in a clear-text file, which is probably read-in by all of his backdoors, for whichever OS):
The following code
echo 0 > out
while read i; do
whois $i | grep -m 1 -i country >> out
done < filename
cat out | grep -i cn | wc -l
on the above list shows that 302 out of a total 331 addresses are in mainland China, the remaining ones are in Hong Kong, Mongolia, Taiwan. This adds further support to David Schwartz's contention that this is mostly a Chinese bot ring.
At @vaid's request (the author of the OP, read his comment below), I will add a comment about how to strengthen security of a basic Linux system (for a system providing many services, this is a far more complex topic).
vaid states he did the following:
Reinstall the system
changed root password to a 16 character long password with mixed lower- and uppercase letters and characters and digits.
Changed the username to a 6 mixed character long username and applied the same password as used for root
changed SSH port to something above 5000
turned off SSH root login.
This is fine (except I use a port above 10,000 since many useful programs use the ports below 10,000). But I cannot emphasize enough the need to use cryptographic keys for ssh login, instead of passwords. I will give you a personal example. On one of my VPSes, I was uncertain whether to change the ssh port; I left it at 22, but used crypto keys for authentication. I had hundreds of break-in attempts per day, none succeeded. When, tired to check daily that no one had succeeded, I eventually switched the port to something above 10,000, break-in attempts went to zero. Mind you, it is not that hackers are stupid (they are not!), they just hunt down easier prey.
It is easy to activate a crypto key with RSA as a signature algorithm, see comment below by Jan Hudec (thanks!):
cd; mkdir .ssh; chmod 700 .ssh; cd .ssh; ssh-keygen -t rsa (then hit <kbd>ENTER>/kbd> three times); cat id_rsa.pub >> authorized_keys; chmod 600 *
Now all you have to do is to copy the file
id_rsa to the machine from which you want to connect (in a directory
chmod'ed to 700), then issue the command
ssh -p YourChosenNonStandardPort -i ~/.ssh/id_rsa me@RemoteMachine
When you are sure that this works, edit on the server (=the machine you want to connect to) the file
/etc/ssh/sshd_config, and change the line
and restart the
ssh service (
service ssh restart or
systemctl restart ssh, or something like this, depending on distro).
This will withstand a lot. In fact, there are currently no known exploits against the current versions of
openssh v2, and of RSA as employed by
Lastly, in order to really bolt down your machine, you will need to configure the firewall (netfilter/iptables) as follows:
iptables -A INPUT -p tcp --dport YourChosenNonStandardPort -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
This, 1) allows ssh connections from both LAN and WAN, 2) allows all input which was originated by your requests (for instance, when you load a Web page), 3) drops everything else on the input, 4) allows everything on the output, and 5-6) allows everything on the loopback interface.
As your needs grow, and more ports need to be opened, you may do so by adding, at the top of the list, rules like:
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
to allow for instance people to access your Web browser.