UNIX Help
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed ForumsOperating SystemsUNIX Help

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old November 29th, 2005, 02:00 PM
dsb dsb is offline
PerlGuy
Dev Shed Novice (500 - 999 posts)
 
Join Date: Jan 2001
Posts: 714 dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level) 
Time spent in forums: 2 Days 15 h 44 m 20 sec
Reputation Power: 36
Send a message via AIM to dsb
No Mode, Zero File size File

Hey all,
I'm not a sysadmin by any stretch, but I am fairly comfortable on Unix. Today I saw a file with a very funky name, a zero filesize, and NO MODE. I cannot change the mode, even though I am logged in as the user that supposedly owns the file. And since it has no mode, I can't access it at all. I'm just curious if anyone has ever seen anything like this before and can explain what it is and where it comes from.

The output from 'ls -l':
Code:
----------   1 user    group           0 Nov 22 19:24 œ+¤ÿ=íp

One coworker theorized that it may have been a fault from some kind of memory I/O since there is a fair amount of C++ development going on on this box.

Thoughts?
__________________
- dsb -
Perl Guy

Last edited by dsb : November 30th, 2005 at 10:11 AM.

Reply With Quote
  #2  
Old November 29th, 2005, 02:08 PM
M.Hirsch M.Hirsch is offline
Contributing User
Dev Shed God 1st Plane (5500 - 5999 posts)
 
Join Date: Oct 2000
Location: Back in the real world.
Posts: 5,969 M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 1 Month 1 Day 22 h 39 m 55 sec
Reputation Power: 184
Is the machine conntected to the internet in any way?
__________________
--
Manuel Hirsch - Linux, FreeBSD, programming, administration articles, tutorials and more.

Reply With Quote
  #3  
Old November 29th, 2005, 02:48 PM
dsb dsb is offline
PerlGuy
Dev Shed Novice (500 - 999 posts)
 
Join Date: Jan 2001
Posts: 714 dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level) 
Time spent in forums: 2 Days 15 h 44 m 20 sec
Reputation Power: 36
Send a message via AIM to dsb
Quote:
Originally Posted by M.Hirsch
Is the machine conntected to the internet in any way?


Yes it is. It's a server.

Reply With Quote
  #4  
Old November 29th, 2005, 02:56 PM
M.Hirsch M.Hirsch is offline
Contributing User
Dev Shed God 1st Plane (5500 - 5999 posts)
 
Join Date: Oct 2000
Location: Back in the real world.
Posts: 5,969 M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 1 Month 1 Day 22 h 39 m 55 sec
Reputation Power: 184
Quote:
Originally Posted by dsb
Yes it is. It's a server.

Sorry to tell you.... - PWNED

i.e. somebody cracked your system and is probably using it for his own purposes now. Check your traffic, you may be hosting p0rn, warez, a spam server, or other stuff like that now...

M.

Reply With Quote
  #5  
Old November 29th, 2005, 03:08 PM
dsb dsb is offline
PerlGuy
Dev Shed Novice (500 - 999 posts)
 
Join Date: Jan 2001
Posts: 714 dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level) 
Time spent in forums: 2 Days 15 h 44 m 20 sec
Reputation Power: 36
Send a message via AIM to dsb
What makes you think that the system is cracked? Can you be a bit more specific?

Reply With Quote
  #6  
Old November 29th, 2005, 03:35 PM
M.Hirsch M.Hirsch is offline
Contributing User
Dev Shed God 1st Plane (5500 - 5999 posts)
 
Join Date: Oct 2000
Location: Back in the real world.
Posts: 5,969 M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level)M.Hirsch User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 1 Month 1 Day 22 h 39 m 55 sec
Reputation Power: 184
Quote:
Originally Posted by dsb
What makes you think that the system is cracked? Can you be a bit more specific?

1. There is very few other conditions that could cause this.
High load is not one of them unless you have got a broken kernel, broken hardware, or something.

2. You can not change the file's mode.
Probably a rootkit is preventing this.
Another possible idea would be a filesystem problem which should be fixed by running "fsck".

3. Sorry, but....
Quote:
Hey all,
I'm not a sysadmin by any stretch, but I am fairly comfortable on Unix.

You came here to ask in a forum instead of asking your sysadmin.
So I assume you don't have one.
Are you administrating this server yourself?
If you don't have a few years of experience in unix administration, running a server connected to the internet calls for crackers...

When was the last time you installed updates? And what did you do to secure/harden the server?
Since you said that you are not an admin, I assume you did neither. Which makes a close to 100% probability for a cracker IMHO.

If this isn't true, then please forgive my overhasty conclusions

M.

Reply With Quote
  #7  
Old November 29th, 2005, 03:52 PM
dsb dsb is offline
PerlGuy
Dev Shed Novice (500 - 999 posts)
 
Join Date: Jan 2001
Posts: 714 dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level)dsb User rank is Sergeant Major (2000 - 5000 Reputation Level) 
Time spent in forums: 2 Days 15 h 44 m 20 sec
Reputation Power: 36
Send a message via AIM to dsb
Those are reasonable conclusions so now worries .

No, I'm not administering the system myself, but I'm not sure who is. I'm looking into that now. THis is a system that I use and I happen to notice this funky file (and another that we WERE able to remove by changing its mode).

I'll take your theories to the admin (when I find him hehehe ). THanks for the tips.

Reply With Quote
Reply

Viewing: Dev Shed ForumsOperating SystemsUNIX Help > No Mode, Zero File size File


Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 2 hosted by Hostway