.bash_history shows outgoint e-mail content and Google searches

viking60 · 2014-08-31 14:24:22

Yeah lsof /home/wife/.bash_history comes up with a blank. According to the marketing it should produce the application opening the file.

Hmm I did a

lsof -u wife

and came up with something this:

chromium  2781 wife  cwd   unknown                                 /proc/2781/cwd (readlink: Permission denied)
chromium  2781 wife  rtd   unknown                                 /proc/2781/root (readlink: Permission denied)
chromium  2781 wife  txt   unknown                                 /proc/2781/exe (readlink: Permission denied)
chromium  2781 wife NOFD                                           /proc/2781/fd (opendir: Permission denied)
chromium  2786 wife  cwd   unknown                                 /proc/2786/cwd (readlink: Permission denied)
chromium  2786 wife  rtd   unknown                                 /proc/2786/root (readlink: Permission denied)
chromium  2786 wife  txt   unknown                                 /proc/2786/exe (readlink: Permission denied)
chromium  2786 wife NOFD                                           /proc/2786/fd (opendir: Permission denied)
chromium  2790 wife  cwd   unknown                                 /proc/2790/cwd (readlink: Permission denied)
chromium  2790 wife  rtd   unknown                                 /proc/2790/root (readlink: Permission denied)
chromium  2790 wife  txt   unknown                                 /proc/2790/exe (readlink: Permission denied)
chromium  2790 wife NOFD                                           /proc/2790/fd (opendir: Permission denied)
chromium  2798 wife  cwd   unknown                                 /proc/2798/cwd (readlink: Permission denied)
chromium  2798 wife  rtd   unknown                                 /proc/2798/root (readlink: Permission denied)
chromium  2798 wife  txt   unknown                                 /proc/2798/exe (readlink: Permission denied)
chromium  2798 wife NOFD                                           /proc/2798/fd (opendir: Permission denied)
chromium  2869 wife  cwd   unknown                                 /proc/2869/cwd (readlink: Permission denied)
chromium  2869 wife  rtd   unknown                                 /proc/2869/root (readlink: Permission denied)
chromium  2869 wife  txt   unknown                                 /proc/2869/exe (readlink: Permission denied)
chromium  2869 wife NOFD                                           /proc/2869/fd (opendir: Permission denied)
lsof      9443 wife  cwd       DIR        0,3         0          1 /proc

Is that normal?

emeres · 2014-08-31 14:38:26

The problem is executing lsof* or the others at the right time. I do not use chromium, so I would not know.

Additionally you could also try to search for $HISTFILE in /proc with something like this:

find -L /proc/*/fd -exec ls -al {} \;

Then either redirect it to a log or grep after a pipe.

Edit: The repeat function does not go below 1 s for me, so 'watch lsof' with a very small period might work, but I would rather try something using inotify.

Last edited by emeres (2014-08-31 14:40:24)

lolilolicon · 2014-08-31 15:40:13

Just an idea: make your bash a wrapper around the bash binary, and do some logging within it.

To do this, modify PATH in your ~/.bash_profile

PATH=$HOME/bin:$PATH

And then, write $HOME/bin/bash

#!/usr/bin/bash

touch /tmp/bash.log
mkdir -p /tmp/bash
{
  printf -- "==== MARK ====\n"
  printf "%(%T)T PID=$$\n" -1
  printf '%q ' "$@"; echo
  [[ -o history ]] && echo history is set
  [[ -v HISTFILE ]] && echo HISTFILE is set && declare -p HISTFILE
  pstree -gaps $$
} >> /tmp/bash.log

# Use a separate history file for each call
HISTFILE=/tmp/bash/$(ps -p $(ps -p $$ -oppid=) -c -ocmd=)_$(printf "%(%s)T_$$" -1)
exec /usr/bin/bash "$@"

Make sure to chmod +x it.
This should be able to produce some useful info about the process that calls bash, potentially identifying the culprit.
This may fail, if the program calls bash by path -- such as /bin/bash or /bin/sh. So, it would be a better idea to move the real binary /usr/bin/bash to somewhere else, and mv your script to /usr/bin/bash. Modify the path to the binary in the script above.

Last edited by lolilolicon (2014-08-31 17:47:26)

ewaller · 2014-08-31 15:48:41

I am convinced you are fighting something running on the browser. That both FF and Chrome are impacted, it smells like one of the thousands of "Searchbar Helper" trojans. Out of curiosity, does that devil's spawn of Flash and Facebook thing show up on both browsers? Also, if it is on both browsers, you could be fighting a plug-in instead of a browser extension. Check that by entering chrome://plugins/ into the address bar of Chrome. Under chrome, you might also load a page, punch F12 to open the developer tools and pull up the sources tab to see what javascript is acting on your page.

viking60 · 2014-08-31 16:09:15

I have discovered something worse; after having physical acces to her lap again.

What I write here and on other forums - on that laptop - is stored on her /home/wife and given the name of the content. there are lots and lots of files marked as backup files.
(so this text will basically be the name of the file).

And the content is also in Parcellite.

Checking out inotify-tools
will try this:

inotifywatch -v -e access -e modify -t 160 -r ~/.bash_history

Edit:
Will get back to you ewalier and loli.... - thanks

Last edited by viking60 (2014-08-31 16:12:52)

progandy · 2014-08-31 17:27:34

If your wife needs that laptop before you find the problem, I suggest you clone that installation onto a new harddisk. Make sure all bad behaviour is running on the clone, too and then reinstall arch on the laptop for your wife to use. Try to find the problem in the cloned installation and use the fresh and clean installation for normal work.

lolilolicon · 2014-08-31 18:23:47

I'd say ewaller is likely right on this one. Perhaps simply copying over the browser profiles/extensions/plugins will replicate this issue?

Last edited by lolilolicon (2014-08-31 19:40:59)

viking60 · 2014-08-31 19:31:41

Will try to copy over the profile to a VM to check, There are no apparent "toolbar helpers"
Meanwhile this is what our discussion looks like in bash history:

 110   discovered something worse after having physical acces to her lap agaiin. What I write here is stored on her /home/wife and given the name of the content. there are lots and lots  of files marked as backup files.
  111  t~ and on other forums - on that laptop -And the conten is also in Parcellite.
  112  t~ and on other forums - on that laptop -And the conten is also in Parcellite.(so this text will basically be the name of the file)
  113  king  out
  114  king  out inotify
  115  will try this:
  116  
  117  .
  118  Edit:
  119  Edit:
  120  Will get back to you ewalier - thanks  and loli....677532facja jeg liker liljer.
  121  lottoreedagffacvgarcv
  122  ~~nano .bash_profile
  123  [24~~cd
  124  ~~nano .bash_profile
  125  ~~
  126  [24~~touch loli.sh
  127  nanno loli.sh
  128  
  129  hmod +x loli.sh
  130  ./loli.sh
  131  ~~history
  132  sudo reboot
  133  history

Some of it from firefox and some from chromium. The problem with the live monitoring is that it does not turn up in the history before a reboot.
It seems to be sufficient to delete her user and create a new one - since my user on that box has non of the problems.

Last edited by viking60 (2014-08-31 19:56:33)

lolilolicon · 2014-08-31 19:48:24

Perhaps the culprit is reading your keyboard input via `read`. It's absolutely a long-running process.

Do you get any suspicious process from this?

pgrep -a -f '\<(ba)?sh\>'

Last edited by lolilolicon (2014-08-31 20:02:25)

viking60 · 2014-08-31 20:25:16

lolilolicon wrote:

Perhaps the culprit is reading your keyboard input via `read`. It's absolutely a long-running process.
Do you get any suspicious process from this?
pgrep -a -f '\<(ba)?sh\>'

Looks pretty normal to me:

[wifei@wife-lap ~]$ pgrep -a -f '\<(ba)?sh\>'
2066 -bash
2565 dbus-launch --sh-syntax --exit-with-session
2650 sh startguake.sh
2853 /bin/bash
2871 -bash
2873 -bash
3979 -bash

Stargugauke is something I made to get it to start properly - it is only a delay:

#! /bin/sh

sleep 15
echo guake started: $(date) >> guake.log
guake

exit 0

Edit:

mv ~/.config/chromium ~/.config/chromium2

Did certainly have no effect the chromium directory was recreated and the keyloging went on...

Last edited by viking60 (2014-08-31 20:39:47)

loqs · 2014-08-31 21:26:27

If you just login as the affected user but do not start any programs but just write a line if text to the desktop is that logged?
If that is not logged does it it log a line you write the simplest text editor you have installed?
If you change the shell of the affected account to zsh does that stop the keylogging?
I noticed the affected system is running sshd could sshd have been accessed from the internet?

viking60 · 2014-08-31 22:27:57

Thanks!

loqs wrote:

If you just login as the affected user but do not start any programs but just write a line if text to the desktop is that logged?

No that is not logged.

loqs wrote:

If that is not logged does it it log a line you write the simplest text editor you have installed?

No

loqs wrote:

If you change the shell of the affected account to zsh does that stop the keylogging?

I dunno - I will try that and report back.

loqs wrote:

I noticed the affected system is running sshd could sshd have been accessed from the internet?

Hardly - but it is possible I guess (ISP).

*****
I did copy my wifes ~/.config/chromium directory to a vanilla Arch install in VM and deleted the present ~/.config/chromium (with scp).

Chromium did pop up with her extensions (so her old settings are used) but no spy logging in bash.... which kind of undermines the chromium error theory a bit.

Steef435 · 2014-08-31 22:30:37

Long-shot fired with Trilby's comment as ammunition: are all the lines you see in the histfile ended with a '\n'? In other words, when you searched for "win xp" earlier, did you click on the search button or did you hit the return key? Because perhaps there's just a terminal(I'm looking at you, Guake) getting all keyboard input all the time. At least I find it interesting that it looks to be recorded by lines, and not by keypresses.

Remove the histfile again, and browse for a while without touching the return key. Do the lines you enter end up in the histfile?

EDIT: Dang, I obviously can't absolutely conclude it gets recorded per return key like this. Might still be worth ruling out though.

Last edited by Steef435 (2014-08-31 22:39:05)

lolilolicon · 2014-08-31 22:37:30

viking60 wrote:

lolilolicon wrote:
Perhaps the culprit is reading your keyboard input via `read`. It's absolutely a long-running process.
Do you get any suspicious process from this?
pgrep -a -f '\<(ba)?sh\>'
Looks pretty normal to me: http://bjoernvold.com/forum/images/smil … nfused.gif
[wifei@wife-lap ~]$ pgrep -a -f '\<(ba)?sh\>'
2066 -bash
2565 dbus-launch --sh-syntax --exit-with-session
2650 sh startguake.sh
2853 /bin/bash
2871 -bash
2873 -bash
3979 -bash

You should inspect each one of them, using `ps -Fp $id` and `pstree -gaps $id`. Identify the ones that are running in your terminal first, and look if there is any extra bash process.
You could also monitor with `watch pgrep ...`, then start your browser and see if there is a new bash process being created.

mv ~/.config/chromium ~/.config/chromium2
Did certainly have no effect the chromium directory was recreated and the keyloging went on...

As ewaller said, it's likely an plugin. Do you have any strange system wide plugin installed? Or system wide extensions? Re-read ewaller's post about how to check installed extensions/plugins in chromium.

viking60 · 2014-08-31 23:28:59

Yes ewaliers tip did not reveal any suspicious plugins. And I do use F12 for quake but that part works with right-click too so I am able to check the running javascripts.
So I decided to "cheat" a bit and tooke logs advice and activated zsh. (Great tip logs!)
That removed the behavior -- so my wife can use the account again (for now).

(I know this does not get us to the bottom of this - but it is a result! )

I might activate bash again and investigate further when my wife allows it .
Edit:
No the logging continues after a few reboots so I was too optimistic there checking the next tip on the list....

Last edited by viking60 (2014-08-31 23:40:29)

emeres · 2014-08-31 23:41:30

What is the output of the line below?

pacman -Qkk bash

viking60 wrote:

I might activate bash again and investigate further when my wife allows it .
(There are two kinds of men in the world - those who understand that the wife is always calling the shots - and those who have not understood it...yet.)

I would like to remind you, that you are already writing to us from Valhalla.

Edit: Should you already followed lolilolicons suggestion of wrapping bash, the binary will obviously mismatch.

Last edited by emeres (2014-08-31 23:46:04)

viking60 · 2014-08-31 23:48:25

Yup clearly I understood it to late

pacman -Qkk bash
warning: bash: /etc/bash.bash_logout (Modification time mismatch)
warning: bash: /etc/bash.bashrc (Modification time mismatch)
warning: bash: /etc/bash.bashrc (Size mismatch)
warning: bash: /etc/skel/.bash_logout (Modification time mismatch)
warning: bash: /etc/skel/.bash_profile (Modification time mismatch)
warning: bash: /etc/skel/.bashrc (Modification time mismatch)
bash: 141 total files, 5 altered files

Hmm this is strange - on the desktop the history looks fine, but when I log in with ssh I get ,my posts here in the history (zsh shell) And it is logged in the .histfile.even if it does not show in the when entering the history cmd.
deactivating all plugins...

Edit: added clarification

Last edited by viking60 (2014-09-01 09:07:54)

emeres · 2014-09-01 00:16:20

To get English output from commands please read this.

That was superfluous since zsh is also affected, my bad.

I would look into ~/.config/autostart and anything autostart specific to your wifes WM/DE installation. Since your user is unaffected /etc/xdg/autostart should contain nothing suspicious.

Steef435 made a good point about guake. Do you start it in your account the same way?

Edit: Added clarification.

Last edited by emeres (2014-09-01 00:19:43)

viking60 · 2014-09-01 08:55:12

emeres wrote:

I would look into ~/.config/autostart and anything autostart specific to your wifes WM/DE installation. Since your user is unaffected /etc/xdg/autostart should contain nothing suspicious.
Steef435 made a good point about guake. Do you start it in your account the same way?
Edit: Added clarification.

The environment is Openbox. and the autostart files are
ArchAssistant.desktop docky.desktop guake.desktop sudo.desktop wpa_gui.desktop
The only "special" there is that I start guake with a delay.

wife-lap% cat guake.desktop

[Desktop Entry]
Type=Application
Exec=sh startguake.sh
Hidden=false
X-GNOME-Autostart-enabled=true
Name[nb_NO]=Guake
Name=Guake
Comment[nb_NO]=guake
Comment=guake

@steef435 yes I did mostly hit the return key - checking out both enter and button push

Guake is handled in the same way on both my and my wifes account.

Still checking whether the plugins are my enemy here....no certain conclusion yet since it may take a couple of boots before the "content" turns up in the history file.

You guys have provided me with so many tips (great stuff - thank you) so you need to give me some time to work them off
And I have set the environment back to bash so that we all are on the same page,

Last edited by viking60 (2014-09-01 09:17:01)

viking60 · 2014-09-01 10:25:10

Since plugin de-activation there has been no "spy logging" the plugins activated were:

ChromePDF viewer:
/usr/lib/chromium/libpdf.so

Adobe Flash Player - Versjon: 14.0.0.177
/usr/lib/PepperFlash/libpepflashplayer.so

Chromoting Viewer
"internal-remoting-viewer"

Native Client
/usr/lib/chromium/libppGoogleNaClPluginChrome.so

So far I have re-activated flash without any loggin behavior (so flash plugin seems ok)
Activating Chromoting viewer now.....
...
The logging behavior came back so I deactivated it again .. but the logging behavior continued.

Frustrating...
Cleaning the cache and retrying without Chromoting Viewer

logging behavior goes on with no plugins activated.
- making a new user for my wife works fine so that is a solution to the problem. But it does not explain it.

Last edited by viking60 (2014-09-01 12:56:32)

emeres · 2014-09-01 20:09:35

I would call this a workaround instead. Are there any other clipboard managers on the system? What if you temporarily uninstall/disable parcellite?

Since you wrote, that there is no logging just after logging in and not running anything, maybe that would be a constructive approach to log every application running, something like lolilolicon suggested and noting the current status, then running applications one by one, ergo starting the system by hand as far as it is comfortably possible that is. It will take a lot of time.

As last resort try this: Since if you do not determine what exactly causes this, you probably still are going to reinstall Arch Linux after wiping the relevant partitions clean, I would go through these steps:

create a backup of pacmans database the way you like,-
check the wiki, so that you know what needs to be installed later
determine packages outside of the official repositories
determine unused packages installed as [optional] dependencies and so on
uninstall irrelevant packages in groups, relevant ones one at a time,-
 and check if the logging behaviour continues
log every step and current status of keylogging in a file

I would start with chromium, firefox and parcellite, one by one.

Edit: Write much emeres?

Last edited by emeres (2014-09-01 20:10:22)

viking60 · 2014-09-02 10:31:40

Thanks emeres -
I think we can rule out parcellite too now.

I did un-check save history - and the logging went on (reboot needed every time). Then I removed it with right-click and did a search in the browser (search text: damned keyloging 1 2 3 etc.) - and it was logged in history after reboot.
The I removed it by de-installing it and did a search - It was logged.
Did another search and rebooted - and it was logged.

So I guess it is not parcellite.

lolilolicon · 2014-09-02 10:45:41

@viking60, you need to change your strategy. All I see you're doing is skin-deep guess work. See, you know what file it is writing to, you know what program it calls to do so (bash), and you know when it comes into effect (after starting browser)... you just need to dig a bit deeper. Monitor the file, monitor the processes, it shouldn't be hard to find out!

viking60 · 2014-09-02 10:48:40

Sounds good - but strictly speaking it comes to effect after reboot - not after starting browser. That means that I must monitor the boot process - right?
(I have to agree that the guesswork will take to long though)

Last edited by viking60 (2014-09-02 11:03:19)

lolilolicon · 2014-09-02 11:09:40

What do you mean by it comes to effect after reboot? What's the difference between the two boots? (Don't tell me one is the left and the other is the right.) Or do you mean it comes into effect after bootup, even before the browser is started?

Arch Linux

#26 2014-08-31 14:24:22

Re: .bash_history shows outgoint e-mail content and Google searches

#27 2014-08-31 14:38:26

Re: .bash_history shows outgoint e-mail content and Google searches

#28 2014-08-31 15:40:13

Re: .bash_history shows outgoint e-mail content and Google searches

#29 2014-08-31 15:48:41

Re: .bash_history shows outgoint e-mail content and Google searches

#30 2014-08-31 16:09:15

Re: .bash_history shows outgoint e-mail content and Google searches

#31 2014-08-31 17:27:34

Re: .bash_history shows outgoint e-mail content and Google searches

#32 2014-08-31 18:23:47

Re: .bash_history shows outgoint e-mail content and Google searches

#33 2014-08-31 19:31:41

Re: .bash_history shows outgoint e-mail content and Google searches

#34 2014-08-31 19:48:24

Re: .bash_history shows outgoint e-mail content and Google searches

#35 2014-08-31 20:25:16

Re: .bash_history shows outgoint e-mail content and Google searches

#36 2014-08-31 21:26:27

Re: .bash_history shows outgoint e-mail content and Google searches

#37 2014-08-31 22:27:57

Re: .bash_history shows outgoint e-mail content and Google searches

#38 2014-08-31 22:30:37

Re: .bash_history shows outgoint e-mail content and Google searches

#39 2014-08-31 22:37:30

Re: .bash_history shows outgoint e-mail content and Google searches

#40 2014-08-31 23:28:59

Re: .bash_history shows outgoint e-mail content and Google searches

#41 2014-08-31 23:41:30

Re: .bash_history shows outgoint e-mail content and Google searches

#42 2014-08-31 23:48:25

Re: .bash_history shows outgoint e-mail content and Google searches

#43 2014-09-01 00:16:20

Re: .bash_history shows outgoint e-mail content and Google searches

#44 2014-09-01 08:55:12

Re: .bash_history shows outgoint e-mail content and Google searches

#45 2014-09-01 10:25:10

Re: .bash_history shows outgoint e-mail content and Google searches

#46 2014-09-01 20:09:35

Re: .bash_history shows outgoint e-mail content and Google searches

#47 2014-09-02 10:31:40

Re: .bash_history shows outgoint e-mail content and Google searches

#48 2014-09-02 10:45:41

Re: .bash_history shows outgoint e-mail content and Google searches

#49 2014-09-02 10:48:40

Re: .bash_history shows outgoint e-mail content and Google searches

#50 2014-09-02 11:09:40

Re: .bash_history shows outgoint e-mail content and Google searches

Board footer