-2

Yesterday I asked a question here: Anyone know about /private/var/keybags/backup_keys_cache.db

Today after corresponding with my friend via email about this, I found another suspicious file:

AbiFathirs-iPad:~ root# ls /private/var/mobile/ -al
total 10256
drwxr-xr-x   7 mobile mobile      340 Feb 19 07:15 ./
drwxr-xr-x  30 root   wheel      1156 Feb 18 23:52 ../
-rw-------   1 mobile mobile     3738 Feb 19 07:15 .bash_history
-r--r--r--   1 mobile mobile       10 Oct  6 10:31 .forward
drwx------   2 mobile mobile      170 Feb 16 17:34 .ssh/
drwxr-xr-x 252 mobile mobile     8568 Feb 19 00:40 Applications/
drwxr-xr-x   3 root   mobile      102 Jan 26 15:26 Documents/
drwxr-xr-x  43 mobile mobile     1496 Feb 18 23:22 Library/
drwxr-x---  17 mobile mobile      612 Feb  1 11:30 Media/
-rw-r-----   1 root   mobile 10485760 Feb 19 07:15 log.0000000001

I transfer the log file above into my ubuntu machine, then try to see the content of the file:

➜  Downloads  hd log.0000000001
00000000  00 00 00 00 1c 00 00 00  7e 04 55 18 88 09 04 00  |........~.U.....|
00000010  0d 00 00 00 00 00 a0 00  00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00a00000

My friend suggest me to check the log. When I go to log folder in my iPad, I found another suspicious file:

AbiFathirs-iPad:~ root# ls -al /private/var/log
total 448
drwxr-xr-x  7 root wheel    340 Jan 26 14:02 ./
drwxr-xr-x 30 root wheel   1156 Feb 18 23:52 ../
drwxr-xr-x  2 root wheel   3264 Feb 19 00:04 DiagnosticMessages/
drwxr-xr-x  2 root wheel    102 Jan 26 14:42 apt/
drwxr-xr-x  2 root wheel    102 Nov  3 09:47 asl/
-rw-r-----  1 root admin      0 Oct  6 10:31 kernel.log
-rw-r--r--  1 root wheel      0 Nov 19 00:00 notifyd.log
drwxr-xr-x  2 root wheel     68 Nov  3 11:01 ppp/
-rwx------  1 root wheel 457536 Jan 26 14:01 racoon.log*
drwxr-xr-x  2 root wheel     68 Nov  3 10:18 sa/

After transfer it to my ubuntu machine:

➜  Downloads  file racoon.log
racoon.log: Mach-O executable acorn

I want to know if those files is also exist in other jailbroken iDevice or not?

Anyone know or experience the similar case in your jailbroken iDevice?

Update 20 Feb 2012

According to brittag in modmyi forum, and bot47 below, racoon.log is a normal file that exist in jailbroken iPad 2.

What left now is the process that wrote /private/var/keybags/backup_keys_cache.db is still unknown and might be still active in my iPad.

Improve this question
1
  • As you opened another question specifically targeting this file, would you consider finishing this one accepting an answer?
    – bot47
    Commented Feb 23, 2012 at 7:28

1 Answer 1

Reset to default
1

racoon.log belongs to the iOS IPSec VPN client: See here
I have no clue about the other file, but keep in mind that there is currently no iOS malware in the wild.

Don't get me wrong, but digging in the iOS file tree will show up a lot of such "suspicious" files.

Improve this answer
3
  • I mark that file as suspicious because of the location is in /var/log and the file is executable despite the name is ended with .log
    – Donny Kurnia
    Commented Feb 19, 2012 at 10:04
  • is the IPSec VPN client installed by default in every iDevice, or cydia installed it? I want to know of the file also exist in any other jailbroken iDevice
    – Donny Kurnia
    Commented Feb 19, 2012 at 10:06
  • On iPad2, jailbroken: racoon.log exists even though no IPSec account is configured (but PPTP). On iPod4, jailbroken: racoon.log does not exist even though an IPSec account is configured (but not PPTP).
    – bot47
    Commented Feb 19, 2012 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .