3

I was working on my Linux "workstation" (it has no sound and I don't play on it nor watch any movie: it's purely a work-machine, hence I call it my "workstation") and suddenly something very weird happened.

I was browsing, using a temporary user account (one I use only for browsing) and the Iceweasel browser. I came to a website which was obviously trying to install malware (popups with fake windows telling your computer is infected, etc.). I got some issues closing these web-pages and ended up kill -9'ing the browser.

Then the 4th dimension started: the IP changed automatically to some 169.xxx.xxx.xxx (I don't remember exactly) IP. But this should never have happened as that workstation as a static IP that, I thought, was carved in stone.

I immediately unplugged the ethernet cable (and there's no WiFi on that workstation) and queried running processes using "ps auxf"

I found some really weird processes running: "uml network switch" something. Upon reboot (still cable unplugged) I saw a "Starting user mode networking switch" service message. I never installed that and I'm nearly sure this stuff wasn't there beforehand.

I also found some "free desktop" something task running. Never ever installed that either.

I started removing the package related to the UML-thinggy and rebooted (still cable unplugged) and... The "/usr/bin/uml_switch" (something like that) started re-appearing (even tough I checked it wasn't there anymore after deleting the package).

What is going on?

Is this some sort of mega-SNAFU where some automated Debian software update started going ballistic and automagically installing packages I didn't ask for that broke havoc or did I just get hacked?

Does any of you have any idea about what what I just experienced could be?

Next step is, just in case, a clean install from a known good CD/DVD rom of a new system on a blank HD right?

4
  • This should be moved to Superuser. Btw, you're not "hacked"
    – Keiran Holloway
    Aug 7, 2010 at 1:53
  • I've never actually seen a virus/malware for Linux though I know they exist; the IP changing thing just sounds weird more than anything (169.254.x.x is the IPv4 auto-config range; mostly MS only). Wiping is the only way to be sure it's 100% gone. I'm still doubtful you've been hacked.
    – Chris S
    Aug 7, 2010 at 1:58
  • @Chris S: yup, it was a 169.254.x.x style IP for sure. But how comes suddenly this workstation started using some user mode networking switch stuff? I kept doing ifconfig down / ifconfig 192.168.1.33 up and the auto-network thinggy (which I never installed and should never have kicked in) kept resetting the IP to 169.254.x.x. What is going on!?
    – Weezy
    Aug 7, 2010 at 2:02
  • @Chris S: it's the first time in nearly ten years of using Linux daily that I see such a thing :( I'm really deeply confuzzabled by what just happened: I honestly have got no freaking clue as to what just happened. The IP was static. There's no way it should have switched to 169.254.x.x without me changing a setting as root. Something happened, I just don't know what :(
    – Weezy
    Aug 7, 2010 at 2:10

1 Answer 1

1

To be safe, you can always try scanning for rootkits, see the answers to this question on ServerFault regarding scanning your computer for rootkits and malicious software. Check out tools such as chkrootkit or Rootkit Hunter to scan for default files used by rootkits, wrong file permissions for binaries, suspected strings in LKM and KLD modules, hidden files, etc.

By the way, just for your information, when the computer is unable to to reach a DHCP server and the network card is not configured manually, it can use a link-local address. The 169.254/16 network is reserved for this purpose. From Wikipedia:

Another type of private networking uses the link-local address range codified in RFC 5735 and RFC 3927. The utility of these addresses is in self-autoconfiguration by network devices when Dynamic Host Configuration Protocol (DHCP) services are not available and manual configuration by a network administrator is not desirable.

In IPv4, the block 169.254/16 is reserved for this purpose, with the exception of the first and the last /24 subnet in the range. If a host on an IEEE 802 (ethernet) network cannot obtain a network address via DHCP, an address from 169.254.1.0 to 169.254.254.255 may be assigned pseudorandomly. The standard prescribes that address collisions must be handled gracefully. The IPv6 addressing architecture sets aside the block fe80::/10 for IP address autoconfiguration.

1
  • but as I wrote, the IP adress has always been set up statically. I thought this was "carved in stone" and somehow, after months, something happened and overrode my manual/static IP configuration.
    – Weezy
    Aug 7, 2010 at 2:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .