.bash_history shows outgoint e-mail content and Google searches

viking60 · 2014-08-24 22:00:08

I have an Acer Aspire 5250 with Arch Openbox and ZSH.

[thomas@heidi-lap ~]$ inxi -Fz
System:    Host: heidi-lap Kernel: 3.16.1-1-ARCH i686 (32 bit) Desktop: Openbox 3.5.2 Distro: Arch Linux 
Machine:   Mobo: Acer model: Aspire 5250 v: V1.01 Bios: Acer v: V1.01 date: 04/21/2011
CPU:       Dual core AMD C-50 (-MCP-) cache: 1024 KB 
           Clock Speeds: 1: 1000 MHz 2: 1000 MHz
Graphics:  Card: Advanced Micro Devices [AMD/ATI] Wrestler [Radeon HD 6250]
           Display Server: X.Org 1.15.2 driver: radeon Resolution: 1920x1200
           GLX Renderer: N/A GLX Version: N/A
Audio:     Card Advanced Micro Devices [AMD/ATI] SBx00 Azalia (Intel HDA) driver: snd_hda_intel 
           Sound: Advanced Linux Sound Architecture v: k3.16.1-1-ARCH
Network:   Card-1: Qualcomm Atheros AR8152 v2.0 Fast Ethernet driver: atl1c
           IF: eth0 state: down mac: <filter>
           Card-2: Qualcomm Atheros AR9285 Wireless Network Adapter (PCI-Express) driver: ath9k
           IF: wlan0 state: up mac: <filter>
Drives:    HDD Total Size: 320.1GB (35.8% used) ID-1: /dev/sda model: WDC_WD3200BPVT size: 320.1GB
Partition: ID-1: / size: 60G used: 40G (71%) fs: ext4 dev: /dev/sda3 
           ID-2: /boot size: 99M used: 66M (70%) fs: ext2 dev: /dev/sda1 
           ID-3: /home size: 234G used: 68G (31%) fs: ext4 dev: /dev/sda4 
           ID-4: swap-1 size: 0.27GB used: 0.00GB (0%) fs: swap dev: /dev/sda2 
Sensors:   System Temperatures: cpu: 64.0C mobo: N/A gpu: 64.0 
           Fan Speeds (in rpm): cpu: N/A 
Info:      Processes: 156 Uptime: 22 min Memory: 531.8/1745.4MB Client: Shell (bash) inxi: 2.2.1

Today I logged in with my wifes userid and discovered that her:

facebook communication,
outgoing mail,
mail addresses,
mail password
+ Google searches

were shown with a simple <ARROW UP> in the terminal (guake)!

Here is an example:

It seems to be content from months back.

To defend myself against my wife's theory that I have hacked the account and to stop this spying behavior - I need help.

~/bash_history is full of this irrelevant stuff.

How can I stop this? And how can it happen in the first place? I am drawing blanks here

lolilolicon · 2014-08-24 22:47:16

Try watching `ps -eF` for any mention of .bash_history. Try `lsof` on .bash_history. Try `grep` for .bash_history in relevant files.

viking60 · 2014-08-24 23:28:21

Thanks.lolilo......
I don't get any mention from ps -eF and regarding running files, It seems to be facebook related. I tried sending a mail with her account now and it did not turn up in .bash_history.
So maybe that part is fixed somehow. (Which leaves me with; "how did it happen in the first place"...)

I will investigate more when my wife does her stuff - I do not have a facebook account.

emeres · 2014-08-24 23:36:43

That looks scary. I hope you put ~/.bash_history in some safe place for now. You could change the default history file with 'export HISTFILE=/home/$USER/.test_hs' in profile and see if ~/.bash_history gets recreated, ergo if that particular file is targeted.

Edit: Added clarification.

Last edited by emeres (2014-08-24 23:37:54)

viking60 · 2014-08-25 10:54:54

Thanks emeres!
I did create a new history file (and renamed .bash_history to something else) and provided it with a time stamp. After a log out and log in that file was used.
The time stamp will maybe help to identify future incidences:

export HISTTIMEFORMAT="%F %T "

Last edited by viking60 (2014-08-25 11:02:18)

Trilby · 2014-08-25 11:36:42

Was this an isolated incident? If so, would it have been possible that someone accidentally middle-clicked in a terminal?

I've had that happen before - if a swatch of text from a browser either gets selected, or in some other way makes it to the primary selection, then you middle click in the terminal, it all gets pasted. Any newline ends a 'command' - in a vast majority of cases, these are not commands that can do anything (just "command not found"). But they do get dumped into the history, so when you hit the up arrow, you scroll through all the content of that browser page.

viking60 · 2014-08-25 11:51:53

Thanks Trillby!

Trilby wrote:

Was this an isolated incident? If so, would it have been possible that someone accidentally middle-clicked in a terminal?

No not isolated; the data have a long time span (months) and they are plenty. She does not use the terminal at all (she does not know how to).
I think we can rule out the "accident" factor, but maybe some browser "hickup" that has the same effect?

Last edited by viking60 (2014-08-25 11:53:54)

emeres · 2014-08-25 11:56:25

Trilby wrote:

Was this an isolated incident? If so, would it have been possible that someone accidentally middle-clicked in a terminal?
I've had that happen before - if a swatch of text from a browser either gets selected, or in some other way makes it to the primary selection, then you middle click in the terminal, it all gets pasted. Any newline ends a 'command' - in a vast majority of cases, these are not commands that can do anything (just "command not found"). But they do get dumped into the history, so when you hit the up arrow, you scroll through all the content of that browser page.

Seems plausible, but not really in this case. How could the email address, password and the content of the mail end up in the clipboard at the same time on a default setup? Unless OP's wifes environment parses everything into clipboard, which in itself is suspicious.

Edit: Too slow, OP made the same point more or less.

Last edited by emeres (2014-08-25 11:58:22)

viking60 · 2014-08-29 23:53:02

After having removed the old .bash:history and used another file I do not get mail or forum content. But there are userid's and passwords there. Also there are web addresses. Can the Chromium cache leak to the bash history? Is there an explanation?

182  2014-08-27 17:41:51 ~vg
  183  2014-08-27 17:53:19 bjoernvold.com
  184  2014-08-27 18:15:34 dagbladet.no
  185  2014-08-27 18:24:50 sudo pacman -Syu
etc etc

Last edited by viking60 (2014-08-29 23:54:56)

emeres · 2014-08-30 02:22:07

You could run chromium with strace to see what calls are made. Do you use any extension in chromium? I never used it, so I assume there is something similar to firefox.

viking60 · 2014-08-30 10:45:24

Thanks emeres!
I am all over it What I have managed to establish so far is that this does affect Chromium and also Firefox.

196  2014-08-30 12:05:42 strace chromium
  197  2014-08-30 12:21:03 history
  198  2014-08-30 12:22:07 strace firefox
  199  2014-08-30 12:24:01 history
  200  2014-08-30 12:24:42 sudo reboot
  201  2014-08-30 12:03:49 ~chromium
  202  2014-08-30 12:05:42 ~~~~strace chromium
  203  2014-08-30 12:07:41 ~~~arch/forum
  204  2014-08-30 12:08:50 ~~viking	password (!!!) 
  205  2014-08-30 12:10:55 ~~~~madvise
  206  2014-08-30 12:12:29 ~~~~~~munmap
  207  2014-08-30 12:18:09 ~~futex
  208  2014-08-30 12:18:18 futex
  209  2014-08-30 12:21:03 ~~~~~~munmap
  210  2014-08-30 12:22:07 ~~strace firefox
  211  2014-08-30 12:23:32 ~~~win xp
  212  2014-08-30 12:24:01 ~~strace firefox
  213  2014-08-30 12:24:42 sudo reboot
  214  2014-08-30 12:32:10 history

And the bash history on her user does reveal the web address the userid and the password for login in on forums - that is bad behavior.
In Firefox the search in the search field of a phpbb forum were logged (win xp)
Active extensions in Chromium are:
Adblocker, Privacy badger, Sothink flashdownloader for Chrome (with a facebook logo -I'll have a word with her regarding that one!) and YoWindowWeather.

Digging further....Need to find out how to remove all that clock and time logging from strace.

I am beginning to think reformat and new install here....

Last edited by viking60 (2014-08-30 10:53:47)

emeres · 2014-08-30 10:53:12

You could try to filter the output with 'strace -e trace=file -o /tmp/chromium.log chromium'. Does chromium have the ability to start without add-ons/extensions? If so, do that.

Edit: I would advise determining what causes this. Otherwise you may end up in the same situation after a few months and will be no wiser than now.

Edit2: Since both browsers are affected, this complicates the situation. There is rkhunter and unhide, but since I never really had problems with gnu/linux I barely know them and they might be inappropriate here.
One thing you could try is renaming the binaries or starting the browsers using a symlink so that the processes name changes.

Last edited by emeres (2014-08-30 11:03:32)

viking60 · 2014-08-30 10:54:52

Will do! I have edited above - this affects Firefox too...
Edit:
This only affects her user not my userid. There the history is clean, the difference is that I use ZSH (confused)
Edit 2:
I have checked with rkhunter there are a million warnings since the switching to /usr/bin etc but no apparent detection of rootkits.
I will try to get to the bottom of this - I am really interested in how this can happen....The bug might be between the keyboard and the chair.. or - even worse - somewhere else...

Last edited by viking60 (2014-08-30 11:17:22)

emeres · 2014-08-30 12:28:07

Are you using any clipboard managers or virtual keyboards? Is xvkbd or any of the keylog utilities installed? You could try wiping all bash configuration out for your wifes user account, check anything bash reads while starting up, strace can be used for this also. I would doublecheck ~/.profile and /etc/profile.d/, even through it does not happen with zsh.

lolilolicon · 2014-08-31 08:20:38

I was just now skimming over the bash changes and saw this:

v.  The shell saves the command history in any shell for which history is
    enabled and HISTFILE is set, not just interactive shells.

It was introduced in bash-4.3-alpha.

This is highly probably related to your issue.

You should try to nail down which bash process is writing to the HISTFILE all this stuff, and when, and what its parent process is, etc. You could do this by monitoring with lsof and ps for example.

Last edited by lolilolicon (2014-08-31 08:59:56)

emeres · 2014-08-31 10:11:54

@lolilolicon What if it is a builtin comand/function?

viking60 · 2014-08-31 10:16:30

Thanks loli.....
That might be related, but the "history" saved here is any text put in a text field (in a browser). Be it messages on facebook (turning up in the newly set HISTFILE too) or searches in forums and userid and password. This box has been running Arch for years and I am not sure when exactly this started - but it is pretty recent I think.
@emeres
I use parcellite clipboard manager and no virtual keyboards or keylogers that I know of .
There is no ~/.profile cheking out profile.d and researching strace reading bash startup.....

emeres · 2014-08-31 10:21:57

@viking60 disable history in bash altogether, but before you do that could you post your environment with 'env'? It is worth a try what lolilolicon mentions. Reboot afterwards or logout from the vt. Does the same content appear in parcellite?

lolilolicon · 2014-08-31 10:24:14

@emeres it has to be bash after all, and a bash that has gone haywire... either it's a bash bug or some process is calling it in bogus ways...

@viking60 yes it's likely more complicated than bash doing it wrong... something is abusing/bashing bash!

emeres wrote:

@viking60 disable history in bash altogether, but before you do that could you post your environment with 'env'?

If viking60 could identify the bash process that writes to the history file, it's also worth checking those:

[[ -o history ]] && echo history is set
[[ -v HISTFILE ]] && echo HISTFILE is set && declare -p HISTFILE

and pstree output

pstree -gaps $$

It's an interesting problem... let's not simply bury it. I wish I had your wife's computer viking60

Last edited by lolilolicon (2014-08-31 10:36:51)

emeres · 2014-08-31 10:40:42

I suggested that to rule out bash internals, should new content appear despite history being disabled, then we would know it is something from the outside, if not. looking at the internals or anything that could use those would be the next step.

@viking60 since you changed the conventional history file, did ~/.bash_history reappear/have new content?

Edit: Typos.

Edit2: To clarify I am all for it lolilolicon. However I would run an endless loop to check what writes to the history file, since I doubt it is a continuous access.

Last edited by emeres (2014-08-31 10:52:28)

lolilolicon · 2014-08-31 10:55:02

Yes, that's why I said "monitor" -- I meant exactly what you're saying.

viking60 · 2014-08-31 11:11:45

Yes it looks like logging of all Internet activity for one userid. (I'll report back further results later.....)

lolilolicon · 2014-08-31 11:17:37

I don't really know lsof (I don't even have it installed), but from the man page it has a "repeat mode" which is handy. Maybe you could take this time to learn about this powerful tool.

viking60 · 2014-08-31 12:38:44

Yup learning on here I will report back once I am confused at a higher level....

emeres wrote:

@viking60 since you changed the conventional history file, did ~/.bash_history reappear/have new content?

No it did not - the new file simply adopted the bad behavior.

export HISTFILE=/home/wife/.wifehist

env (remote ssh loging)

[wife@wife-lap ~]$ env
XDG_SESSION_ID=c5
TERM=xterm
SHELL=/bin/bash
SSH_CLIENT=10.0.0.19 57848 22
SSH_TTY=/dev/pts/1
USER=wife
MOZ_PLUGIN_PATH=/usr/lib/mozilla/plugins
MAIL=/var/spool/mail/wife
PATH=/usr/lib/nx/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl
NXDIR=/usr/lib/nx
PWD=/home/wife
JAVA_HOME=/usr/lib/jvm/java-default-runtime
EDITOR=/usr/bin/nano
LANG=nb_NO.UTF-8
PS1=[\u@\h \W]\$ 
PS3=> 
HISTCONTROL=ignorespace
SSH_ASKPASS=/usr/lib/seahorse/seahorse-ssh-askpass
PS2=> 
SHLVL=1
PS4=+ 
HOME=/home/wife
LOGNAME=wife
SSH_CONNECTION=10.0.0.19 57848 10.0.0.8 22
PROMPT_COMMAND=echo -ne "\033]0;${USER}@${HOSTNAME%%.*}:${PWD/$HOME/~}\007"
XDG_RUNTIME_DIR=/run/user/1000
DISPLAY=wife-lap:12.0
QT_PLUGIN_PATH=/home/wife/.kde4/lib/kde4/plugins/:/usr/lib/kde4/plugins/
HISTTIMEFORMAT=%F %T 
HISTFILE=/home/wife/.wifehist
_=/usr/bin/env

Removed all "HISTfiles" from .bashrc and restarterted bash with source ~/.bashrc . Then I searched for something on the Startpage search field (those searches have popped up in the history so far). Then I rebooted and did some terminal stuff and searching - so far the internet content has not popped up. and a new .bash_history was created.
I cannot be sure until further terminal work and browsing is done and the box has been rebooted (- I'll bet the internet activity will be back then but my wife is using the lap now....)

Doing the lsof and ps stuff now....
But first I did this because lolil..... said so:

[wife@wifei-lap ~]$ source .bashrc
history is set
HISTFILE is set
declare -- HISTFILE="/home/wife/.bash_history"
[wife@wife-lap ~]$ pstree -gaps $$
systemd,1,1
  └─sshd,1814,1814 -D
      └─sshd,1869,1869 
          └─sshd,2096,1869  
              └─bash,2111,2111
                  └─pstree,6151,6151 -gaps 2111

Last edited by viking60 (2014-08-31 13:58:13)

emeres · 2014-08-31 14:05:19

I am afraid lsof, ps, and fuser will not catch the culprit that easily, since the file needs to be accessed for a specific period of time to be registered by those programs, at least that is what I witnessed. Echoing a new line to $HISTFILE is not a problem, remains undetected, at least in most cases. Maybe something using inotify, as last resort a systemd service, could be helpful here, although it may seem like an overkill. There are some simpler applications like inotify-tools.

Arch Linux

#1 2014-08-24 22:00:08

.bash_history shows outgoint e-mail content and Google searches

#2 2014-08-24 22:47:16

Re: .bash_history shows outgoint e-mail content and Google searches

#3 2014-08-24 23:28:21

Re: .bash_history shows outgoint e-mail content and Google searches

#4 2014-08-24 23:36:43

Re: .bash_history shows outgoint e-mail content and Google searches

#5 2014-08-25 10:54:54

Re: .bash_history shows outgoint e-mail content and Google searches

#6 2014-08-25 11:36:42

Re: .bash_history shows outgoint e-mail content and Google searches

#7 2014-08-25 11:51:53

Re: .bash_history shows outgoint e-mail content and Google searches

#8 2014-08-25 11:56:25

Re: .bash_history shows outgoint e-mail content and Google searches

#9 2014-08-29 23:53:02

Re: .bash_history shows outgoint e-mail content and Google searches

#10 2014-08-30 02:22:07

Re: .bash_history shows outgoint e-mail content and Google searches

#11 2014-08-30 10:45:24

Re: .bash_history shows outgoint e-mail content and Google searches

#12 2014-08-30 10:53:12

Re: .bash_history shows outgoint e-mail content and Google searches

#13 2014-08-30 10:54:52

Re: .bash_history shows outgoint e-mail content and Google searches

#14 2014-08-30 12:28:07

Re: .bash_history shows outgoint e-mail content and Google searches

#15 2014-08-31 08:20:38

Re: .bash_history shows outgoint e-mail content and Google searches

#16 2014-08-31 10:11:54

Re: .bash_history shows outgoint e-mail content and Google searches

#17 2014-08-31 10:16:30

Re: .bash_history shows outgoint e-mail content and Google searches

#18 2014-08-31 10:21:57

Re: .bash_history shows outgoint e-mail content and Google searches

#19 2014-08-31 10:24:14

Re: .bash_history shows outgoint e-mail content and Google searches

#20 2014-08-31 10:40:42

Re: .bash_history shows outgoint e-mail content and Google searches

#21 2014-08-31 10:55:02

Re: .bash_history shows outgoint e-mail content and Google searches

#22 2014-08-31 11:11:45

Re: .bash_history shows outgoint e-mail content and Google searches

#23 2014-08-31 11:17:37

Re: .bash_history shows outgoint e-mail content and Google searches

#24 2014-08-31 12:38:44

Re: .bash_history shows outgoint e-mail content and Google searches

#25 2014-08-31 14:05:19

Re: .bash_history shows outgoint e-mail content and Google searches

Board footer