I've been hacked - NITIFILTER

12 Oct 2020
nicolas unrelated No Comments

12 October 2020 nicolas

# I’ve been hacked

## Crypto bots are back

This week-end, our server ( VPS @OVH ) has been hacked ( brute force root login ).
I noticed that I was unable to log in through ssh as usual ( using RSA or ED25519 keys ) but need a password.

After successfully logging in, I found out that my authorized_keys file has been change with only one RSA key ( all others have been overwritten ) having the comment mdrfckr.

After a little Googling, I find the following article : Outlaw is Back, a New Crypto-Botnet…

Even if my version was not exactly identical, I did get me on the right path to clean it :

1. Erased the `authorized_keys` file
2. Killed the `rsync` process
3. Looked at the crontab for user root ( `crontab -l` ) – get a bunch of stuff :
   1. `1 1 */2 * * /root/.configrc/a/upd>/dev/null 2>&1
      @reboot /root/.configrc/a/upd>/dev/null 2>&1
      5 8 * * 0 /root/.configrc/b/sync>/dev/null 2>&1
      @reboot /root/.configrc/b/sync>/dev/null 2>&1
      0 0 */3 * * /tmp/.X25-unix/.rsync/c/aptitude>/dev/null 2>&1`
4. Deleted the crontab for user root ( `crontab -d` ). (As you can see, on reboot it will reinstall itself otherwise )
5. Deleted the directory : `rm -fR /root/.configrc` and anything in /tmp that seems suspicious.
6. Find out through `top` that a process was grabbing 99% of the CPU ( mine was named kswapd0 )
7. killed this process
8. did a `find / -name kswapd0` to find where this code was : it was not in /.rsync as in the article but in /root/.configrc so already cleaned ( step 5 )
9. reboot the server.
10. Everything seems OK == according to the link above, this hack is just a crypto bot so I didn’t bother to re install the whole server even it is a best practices

Hopes it will help somebody somewhere 😉

hack
(8 votes, average: 4.38 out of 5)
Loading...

#### voir / ajouter un commentaire

### Articles les plus lus

Q & A, Uncategorized
29 Feb 2016

## Oil change: When should you change the oil?

A regular part of auto maintenance, the oil needs to be changed regularly to keep the vehicle running smoothly and…

No Comments
Q & A
29 Feb 2016

## Oil change: what’s the point?

Changing the oil of a vehicle is considered essential to keeping it in good working condition and to ensuring its…

No Comments
Vrai - faux
17 Feb 2016

## N’abimez plus votre moteur en faisant chauffer la voiture par temps froid !

Les conditions de conduites déplorables de l’hiver sont déjà assez traumatisantes pour votre voiture pour que vous aggraviez les choses.…

48 Comments
Question - réponse
19 Jan 2016

## Huile minérale, huile de synthèse : laquelle choisir ?

L’huile est un élément clé de la durabilité du moteur. Elle a de nombreux rôles, tels qu’assurer la lubrification des…

112 Comments

### Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Δ

En poursuivant votre navigation sur ce site, vous acceptez l’utilisation de Cookies pour vous proposer une navigation plus agréable, des publicités adaptées à vos centres d’intérêts, pour réaliser des statistiques de navigation, et pour faciliter le partage d’information sur les réseaux sociaux. Pour en savoir plus et paramétrer les cookies.Accepter + d'info
Politique de Confidentialité et Cookies

#### Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the ...