lp:unhide.rb

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

22. By Johan Walles on 2013-01-17

Fix false positive on kernel threads when run as root

21. By Johan Walles on 2013-01-16

Add test that finds pids by listing all dirs in /proc

20. By Johan Walles on 2013-01-13

Add /proc/1234/status check and a plain Ruby readlink() check

The /proc/1234/status check will print the process name even when running
as a plain user. The name printed isn't the full path to the exe though,
so running as root is still better.

The plain Ruby readlink() check is a complement to the native Libc
readlink() check. They should of course return the same thing, but you
never know.

This change also adds encouragement to run unhide.rb as root to get
better diagnostics if something is found.

19. By Johan Walles on 2013-01-12

Remove trailing whitespace

18. By Johan Walles on 2013-01-12

Add /proc opendir and chdir scanning

17. By Johan Walles on 2013-01-12

Name the Jynx LD Poisoning library on an infected system

What we do is we check /proc/self/maps for paths we can't find or access,
that shouldn't happen.

16. By Johan Walles on 2013-01-12

Add kill(pid,0) PID scanner

15. By Johan Walles on 2013-01-12

Identify processes hidden by the Jynx rootkit

Before this change, processes hidden by Jynx were identified by
PID. Now the path to their binaries are also printed (this
requires you to run unhide.rb as root).

What the change does more precisely is to add a PID scanner that
runs the readlink() function directly from libc. Since Jynx
overrides the readlink() loaded by the dynamic linker, we need to
load it ourselves to make sure we get the right function on an
infected system.

Original bug report here:
http://sourceforge.net/mailarchive/message.php?msg_id=28258660

14. By Johan Walles on 2012-12-10

Fix issues running with Ruby 1.9.

13. By Johan Walles on 2011-07-07

Add a second run where we filter out false positives occuring due to a
race between our detectors and processes starting up / shutting down.

Also, follow the documented behavior of reporting suspicious things on
stderr.