Strange core named files on hostbill, I'm hacked ?

[andika]

Hello,

I have noticed strange file names inside hostbill folders. I have 5 core.x files on hostbill home folder, i.e. core.2401, core.6010, etc.  Also 2 files with same name on admin folder. Each file have 32-50mb in size with permission rw (600), Is this normal ? They are filled with binary code. Should I delete them ?

[hbillclient]

Hi,

There are no such files in HB as far as I do know and is quite strange. And since you also say - it is binary code, I would suggest moving those files off the server to a safe location for any analysis later on.

I hope you have backups in place - just in case you are somehow hacked or something.

Thanks.

[andika]

I have moved them to a different folder. Its binary code inside, what could I analyze inside this files ?

[BRJP]

I wonder if these are core dump files that are created on serious errors at a software or hardware level. They would be binary and very large as its a snapshot in time of all information what is going on when an event/error occurs. This is then used for analysis.

Have you had any serious issues that you remember?

[andika]

I wonder if these are core dump files that are created on serious errors at a software or hardware level. They would be binary and very large as its a snapshot in time of all information what is going on when an event/error occurs. This is then used for analysis.

Have you had any serious issues that you remember?

I just got them everyday, looking on google they seem generated by errors.  But generated by who ? By hostbill ?? I' have updated recently php version on server from 5.4 to 5.6. Can this be the cause ? How to dig deeper ? How to read the dump file because binary file shows only non sense binary code.

[tallship]

Quite odd... Core files are usually OS and kernel related dumps, while HostBill is basically just a PHP script, so yes I would tend to concur with @BRJP and I recommend looking at integrating something like:

1.) https://github.com/Tripwire/tripwire-open-source (https://en.wikipedia.org/wiki/Open_Source_Tripwire)

2.) http://aide.sourceforge.net/

3.) http://la-samhna.de/samhain/

4.) http://people.redhat.com/sgrubb/audit/

5.) http://temasoft.com/products/filemonitor/

kfsmd still works well too, although it's rather dated. Here's some additional reading for inotify and kfsmd, etc., that you can follow along with to glean whether this is a tool for your particular situation:

http://unix.stackexchange.com/questions/12247/linux-file-access-monitoring

https://linux-audit.com/monitoring-linux-file-access-changes-and-modifications/

http://inotify.aiken.cz/?section=incron&page=about&lang=en

http://stackoverflow.com/questions/4205815/monitoring-file-and-directory-access-on-linux

https://gist.github.com/mikesmullin/6401258

https://linux-audit.com/monitoring-linux-file-access-changes-and-modifications/

You should already be running something like Samhain and/or OSSEC on your machine anyway.

I hope that helps

[andika]

Quite odd... Core files are usually OS and kernel related dumps, while HostBill is basically just a PHP script, so yes I would tend to concur with @BRJP and I recommend looking at integrating something like:

1.) https://github.com/Tripwire/tripwire-open-source (https://en.wikipedia.org/wiki/Open_Source_Tripwire)

2.) http://aide.sourceforge.net/

3.) http://la-samhna.de/samhain/

4.) http://people.redhat.com/sgrubb/audit/

5.) http://temasoft.com/products/filemonitor/

kfsmd still works well too, although it's rather dated. Here's some additional reading for inotify and kfsmd, etc., that you can follow along with to glean whether this is a tool for your particular situation:

http://unix.stackexchange.com/questions/12247/linux-file-access-monitoring

https://linux-audit.com/monitoring-linux-file-access-changes-and-modifications/

http://inotify.aiken.cz/?section=incron&page=about&lang=en

http://stackoverflow.com/questions/4205815/monitoring-file-and-directory-access-on-linux

https://gist.github.com/mikesmullin/6401258

https://linux-audit.com/monitoring-linux-file-access-changes-and-modifications/

You should already be running something like Samhain and/or OSSEC on your machine anyway.

I hope that helps

Thank you, I will try that.