Hi,
I installed knoppix 3.3 2003-11-19 to my disk using knx-hdinstall.
Just after install I ran a file integrity checker to get a base line for the system.
Soon thereafter, I noticed that the checksum (md5, sha1, ...) of ALL of the ELF binaries in /bin changed. This is also true for all of the shared objects in /lib, /lib/lvm-10, /sbin, /usr/X11R6/bin, /usr/X11R6/lib, /usr/bin, and others.
/bin/dd, for example, changed in size from 26772 bytes to 23948 bytes.
file reports the original dd and the new dd as both being stripped, not that file is the final authority, but still it is a clue.
I seriously doubt that this was a rootkit, something in the range of 7000 files changed. A worm or rootkit just wouldn't need to change that many files. Furthermore, this has happened to me one other installs of this version of knoppix.
Does anyone know why this happened? Is there a program that goes through and does some further strip on binaries? Perhaps they need relocatable code when on the CD and once installed that can be removed? -fPIC or some such thing?
Thank you,
Studout
AMD EPYC 7282 CPU Processor 16 Cores 32 Threads 2.8GHZ up to 3.2GHZ 120W no lock
$75.00
Intel - Core i7-12700K Desktop Processor 12 (8P+4E) Cores up to 5.0 GHz Unloc...
$419.99
Intel - Core i9-12900K Desktop Processor 16 (8P+8E) Cores up to 5.2 GHz Unloc...
$619.99
Intel Xeon E5-2697A V4 2.6GHz CPU Processor 16-Core Socket LGA2011 SR2K1
$39.99
Intel Quad Core i3-12100 3.3GHz 12MB LGA1700 12th Gen. CPU Processor SRL62
$45.96
AMD Ryzen 5 4500 6-Core 3.6GHz Socket AM4 65W CPU Desktop Processor
$79.00
Intel Core i9-13900KF Unlocked Desktop Processor - 24 Cores (8P+16E) & 32 Thread
$539.99
Intel Core i9-14900KF Unlocked Desktop Processor
$579.99
AMD Ryzen 7 5800X Processor (4.7GHz, 8 Cores, Socket AM4) Box - 100-100000063WOF
$159.99
AMD Ryzen 7 7700 Processor (5.3 GHz, 8 Cores, Socket AM5) Boxed -...
$259.99