2.7.2 hacked? Chinese characters/code in TONS of files. Persists even after fresh installs.
-
Looking for confirmation whether or not I should be concerned about these files (a few screenshots attached) and if so -- what to do!
Running pfSense 2.7.2 on a Protectli Vault (6 port) with coreboot. SSH is not enabled (and has not been enabled through two fresh install attempts). Terrapin patch was installed just to be safe and pfSense/Protectli was rebooted.
Yesterday I noticed that dozens of source code files from the 'Edit File' section of the pfSense GUI are loaded with Chinese characters / illegible code. The more I click around, the more files I find. This was a totally random discovery by even going to the 'Edit File' section on the GUI but now I'm very concerned about possible MTM attack.
After this discovery I downloaded a fresh version of pfSense CE 2.7.2 directly from pfSense's website, used Balena Etcher to flash a new USB stick, and reinstalled pfSense on my Protectli Vault. After that install, the Chinese character code files were still there.
Then I completely reinstalled coreboot on my Protectli Vault by using Protectli's flashli tool and performing yet another fresh install of pfSense CE 2.7.2. The files are still there.
These files are not normal, right? What are some immediate steps I can take to secure my network?
-
@cheezycat
.gz files are compressed with gzip so need to be uncompressed to read. If they are even text..rnd is a seed for a random number generator and is not text.
similar with /entropy: https://lists.freebsd.org/pipermail/freebsd-questions/2008-December/188827.html
-
@SteveITS Hey, thanks for the reply! That's a big relief. With all of the cybersecurity threats and CVEs we hear about these days, I guess my paranoia is in overdrive.
-
@cheezycat said in 2.7.2 hacked? Chinese characters/code in TONS of files. Persists even after fresh installs.:
These files are not normal, right?
If further doubt : Throw "what is entropy ?" into Google and take the first page proposed : It was https://en.wikipedia.org/wiki/Entropy for me.
[ joke ahead ]
Knowing this, it's time for drastic measures :
@cheezycat said in 2.7.2 hacked? Chinese characters/code in TONS of files. Persists even after fresh installs.:
What are some immediate steps I can take to secure my network?
because you have probably several zip files on your PC or phone : take it down, and reformat it straight away, as you will find the same hieroglyphs in there everywhere. Even worse, all these files like DDL, EXE etc etc are all very suspect !
[ end joke ]
Keep this one on a post-it nearby : the only imminent danger is close : it's the admin himself ^^
Still, I'm curious. For all the files you can 'see', why did you chose entropy ? Or .rnd ? What / who told you to do so ? With what goal ?
