4

I am facing a strange problem with avconv which is a tool for processing videos part of libav-tools package.

I am on a local ubuntu server 14.04.1 LTS.

What happens is that the avconv tool is getting corrupted, basically /usr/bin/avconv is getting modified by something.

This is the output the file command gives when the command is not yet corrupted

avconv: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=66393d9b38a75978d8cd1838e7b163dda04df7b9, stripped

When it's corrupted this is the output of file command:

avconv-corrupted-copy-1: ELF 64-bit
avconv-corrupted-copy-2: ELF 64-bit LSB  no file type, SPARC

There is a beanstalkd worker which uses the avconv command.

Sometimes I can see bash fork bombs (:(){ :|: & };:) in bash history.

It looks like this vm is completely compromised. Do you've any suggestions on how to understand the cause of this problem?

Update 11-02-2015: now the same thing happens with beanstalkd:

/usr/bin/beanstalkd: ELF 64-bit LSB  no file type, SPARC

I've reported it on launchpad too.

jithujose
  • 241

1 Answers1

0

The system clearly sounds compromised. The "cause of the problem" is likely either a virus or a rootkit installed using some compromised credentials.

Unless you're a security professional doing post-mortem analysis, the "cause" shouldn't matter. The "solution" is to wipe the VM and restore from a clean backup.

Dan Bonachea
  • 101