[false alarm] chfn binary making connections to DuckDuckGo

[GJones]

So I was messing around with Salix (x86, Xfce) in a VM for penetration testing purposes, and perchance ran 'netstat -apntl'. I saw this:

Code: Select all

tcp    1    0 192.168.0.116:46644    107.21.1.61:443    CLOSE_WAIT    15234/chfn

chfn is used to change user information - name, office, etc. It is a setuid binary. It's also a system utility that should not be making TCP connections to anything.

The IP address there resolves to DuckDuckGo's servers on Amazon AWS. So that itself should be innocuous. But a system binary making outbound connections, not so much.

Further note: I was running Metasploit attacks against the VM, including meterpreter sessions in Firefox via a deliberately installed XPI extension. Also I have the Virtualbox guest utils installed on the VM. Otherwise it's a vanilla Salix install. However, with Metasploit I did not do anything that deliberately changed the chfn binary. My guess is, it comes down to either

a) Metasploit doing something without my say-so, including escalation to root. (Maaaaaybe; seems unlikely as it's maintained by Rapid7 etc.)

b) Virtualbox doing something it shouldn't with the guest extensions. (Seems quite unlikely.)

c) Salix and/or Slackware being tampered with upstream in some way, or possibly a slackbuild being messed with. (I believe the only one I have installed is unhide. Have to check though.)

d) Being instapwned by an ad or something? Dunno.

e) Me being really stupid and missing something obvious...

Anyway, sorry to bring bad news here, assuming that's what it is. Hope you guys can enlighten me as to what this is about.

[GJones]

Update: md5sums are the same for chfn on my laptop and the VM, so that probably rules out direct compromise of my own machines.

Edit: VirusTotal page for the checksum is clean, not that I trust that worth anything at all.

[GJones]

Okay - I can confirm this is a Metasploit thing. When Metasploit remote shell sessions are open, they appear on the target machine to be open to DuckDuckGo IPs... for some reason. Not sure if that's deliberate, as a faux stealth measure and/or demonstration; or something wrong. Probably the former but still investigating.

[ChuangTzu]

Probably should have confirmed all of this prior to posting it. No reason to sound the alarms if there is no fire.