3

I was cyber-attacked by someone from China and they managed to install Yam (crypto mining) on my Ubuntu 14.04 server.

I managed to close their ssh access through the public IP. and I have remedied the damage they did. Except for two things that have me confused still.

1- I can not edit /etc/rc.local from root. they have a script in there to adduser 'setup' with root permissions. I cant edit the script although it is owned by root and has the permission. I get permission denied. I can edit other files so the filesystem is not read only.

2- Every time I log in via ssh, I get the welcome message, then "You have mail" followed by a huge number of permission denied errors like this:

    You have mail. 
    find: `/var/log/speech-dispatcher': Permission denied 
    find: `/var/log/samba/cores': Permission denied
    -bash: /var/log/Xorg.1.log.old: Permission denied
    -bash: /var/log/apache2/error.log.43.gz: Permission denied
    -bash: /var/log/apache2/error.log.14.gz: Permission denied
    -bash: /var/log/apache2/access.log.44.gz: Permission denied
    -bash: /var/log/apache2/error.log.13.gz: Permission denied
    -bash: /var/log/apache2/crm65.com-access_log: Permission denied
    -bash: /var/log/apache2/access.log.9.gz: Permission denied
    -bash: /var/log/apache2/error.log.36.gz: Permission denied
    -bash: /var/log/apache2/error.log.16.gz: Permission denied
    -bash: /var/log/apache2/error.log.11.gz: Permission denied
    -bash: /var/log/apache2/testcrm-error.log: Permission denied
    -bash: /var/log/apache2/error.log.46.gz: Permission denied
    -bash: /var/log/apache2/error.log.18.gz: Permission denied
    -bash: /var/log/apache2/access.log.45.gz: Permission denied
    -bash: /var/log/apache2/access.log.34.gz: Permission denied
    -bash: /var/log/apache2/vtigercrm-access.log: Permission denied
.
.

it basically goes through the whole /var/log directory.

I am not sure what is happening there.

ANY help is appreciated!

  • 1
    Related I think I've been hacked, what can I do? and from there How do I deal with a compromised server? over on Server Fault. – PerlDuck Feb 13 at 16:51
  • Just nuke the server from orbit. However they got in is still a vulnerability vector so you need to take the server offline until you can find and patch against how they got in. Also 14.04 dies in under 3 weeks so you need to upgrade to a newer release and given you were hacked I'd go the 'fresh install' route then reload the stuff you need on the server from backups – Thomas Ward Apr 10 at 12:53
  • Thank you @ThomasWard. I know how they got in and was able to stop them. It was through a vulnerability bug in Vtiger CRM. I am in the process of upgrading 14.04. – Sam Apr 11 at 17:31
3

rc.local was set to immutable by the hacker.

Used chattr to change the file attributes and I was able to edit it.

As for the permission denied errors upon login, the hacker inserted lines into the motd scripts to delete log files to hide any trace of his yam program. removing those lines resolved the problem.

I hope that helps anyone with a similar problem. I recommend you edit your ssh/iptables to allow only certain IPs to log in via ssh to avoid such problem, I learned the hard way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.