[cobalt-security] Qubes - hacked

["Gavin Nelmes-Crocker" <cobalt@xxxxxxxxxxxxxxxx>]

Hi

Has anyone else been having problems with Qubes getting hacked?

If you run the latest version of chkrootkit it comes up with infected stuff,
login, and others as well as suggesting a show tee root kit.  The only
visible symptom to the user or sysadmin seems to be that the windows file
sharing server goes off line and won't come back up.

I'm not sure how they get in to start with, we tend to run the qubes a
little behind on the patching as they are not always a help if your Qube
goes down due to a patch error, however at this moment we are patching to
every last patch available on bluelink to try and lock this out.

The only way we can be sure of getting rid of the hack at the moment is to
do a full restore which is a real pain and reminds me to try again at
building an up to date OSRCD for Qubes.

Anyone else seeing the same?

Regards

Gavin