Are there any Linux based Viruses ?

Question

I have a NOWS SBE 2.5 Server (I know its no longer supported... update due in August)
Installed 3 years ago and generally just works.
2 weeks ago started getting a problem where the Internet would stop working on the network
Checked all PC's on the network with Virus checker, Replaced Router, Switch Cables, got the ISP to check ADSL line etc...
On friday discovered the problem is caused by the NOWS SBE Server - disconnect and everything works fine
Plug the NOWS back in and within minutes internet dies
Replaced Network card on the server but still the issue.
even pinging the Router from results in massive ping failures
Network tools shows 14Gb+ transmitted on ETH0
Router data flow monitor shows 2000-3000 sessions coming from the server
The Router Draytek 2960 has Danial of Service option which is on (tried it with off too)
Others have suggested a Virus might be responsible - possible ??
How does one find out whats causing this ?

Answer 1

Originally Posted by bhrt60
How does one find out whats causing this ?
1. Verify integrity of binaries with rpm -Va IF you have hacked binaries, you need to decide if the box is viable, or if a rebuild is better. Ensure that binaries like ps, bash, ls, top, netstat, ... are not modified. If they are, you will be re-hooking the root kit every time you do anything.
2.a. Get packet traces of the activity. This can be done via various methods. I usually want to use port mirroring + a laptop with wireshark. This records the traffic clandestinely. Otherwise using wireshark or tshark from the server itself... but that assumes its installed and working. The traces can be checked against netstat output - if they disagree, netstat may have been replaced to conceal the activity.
2.b. Observe and collect details on what binaries or scripts are active on the system using netstat -pant and top ( the press 1Hc ). Process info for a specific process is available in /proc/process_id/... You may need to be connected to the Internet for the external bad guy to activate the scripts. So its a risk to do too much sleuthing while someone may be watching. For the most part this stuff is very automated, so you are usually safe sleuthing while the bad guy is active.
At this point you show know which process is generating the traffic and maintaining the C&C bus. Web logs and so on may show the intruder starting their tools, revealing their location. So its all about identifying the means by which the scripts were dropped off and activated, and systematically blocking / removing them. You may find that the activity stops. or that the scripts re-appear 5 minutes later. These are opportunities to udnerstand how the systems is being exploited.
3. Disconnect the system from the Internet ( block inbound and outbound access ) and clean it up. You need to work backwards through logs to figure out the point of entry. This will typically be a stupid default passwords allowing direct depositing of the scripts, bugs in the web server allowing them to be exploited to drop the scripts, ...
4. Plug the holes, Patch the system, Reboot. Cross fingers.
The thing you don't want to do is attract the interest of the guy on the other end. So no "cute" challenges, the last thing you want is someone to take an interest in your system.
-- Bob