NAS mining worm
a new customer recently consulted with sine security company, saying that his server often fails to open the website of the card, and the remote connection to the server is extremely slow. Sometimes the Ping value reaches 300-500, and he often switches. After listening to the customer's words,
will generally judge that he has been attacked by CC + DDoS mixed traffic, It's strange to say that there is no traffic attack on the computer room. It's not a traffic attack, but it also causes the server card and website to fail to open. What kind of attack is this? In order to solve the problem of
client server card, we immediately arranged a security engineer to carry out security detection and deployment on his Linux server
{rrrrrrr}
mining Trojan horse is also designed. If the mining process is forced to stop by customers, it will automatically start to continue mining to achieve uninterrupted mining.
careful inspection shows that it is through setting the hourly task plan, remotely downloading shell mining Trojan horse, and then executing, Check whether the current process exists or not. If not, start the Trojan horse to mine
a detailed security inspection was carried out on the client's Linux server. It was found that fortunately, there was no encrypted server data, and the worm was infected with the disease through the security detection and analysis of our security engineers, we found that the server uses Apache Tomcat environment, the open architecture of the platform is JSP + Oracle database, and Apache Tomcat uses the version of 2016, which leads to the serious remote command execution vulnerability of Apache, Through this vulnerability, the intruder can directly invade the server and get the administrator permission of the server,
virus. If the data was encrypted, the loss would be great. The client was a platform, and the client's data was very important. After finding out the mining Trojan horse,
do customers need to know how the server is attacked? Was the Trojan horse uploaded? It can prevent the attack
in the later stage
sine security engineer immediately repairs the Apache vulnerability and clears the Trojan horse. So far, the problem has been solved, the client server
runs stably, and the network station opens normally
in front of meat mountain, you can't use a hammer to destroy it (to destroy it will cause damage to yourself). To defeat meat mountain, you must drop a hammer: Divine hammer. With it, you can destroy the altar without losing blood
after destroying the altar, you will jump out of the command prompt: your world has given Mithril / Mountain Copper / titanium... Every time you smash an altar, new three minerals will be randomly brushed out in the world, and some areas (small areas) will be corroded / bloody at the same time
the rotten place corresponds to the demon altar, and the bloody place corresponds to the bloody altar. In fact, there are two kinds of altars under the ground, one of which has more functions
your company had better buy a set of genuine enterprise anti-virus software and install it into Server 2003, and then you can prepare another anti-virus software. If you can't kill the virus, you can dismantle the hard disk and kill it again. In addition, it is necessary to prepare a clean and non-toxic machine to make a live CD antivirus disk. I used 360 antivirus. It's too useless
but shouldn't the server be killed when employees use storage devices privately? Your management is too lax
linux should not worry about virus attack, just need to antivirus or manually delete the virus file to solve the problem of virus
in fact, the best way is to back up the data from the data server and install the system again. Linux NAS is also the best way to back up the data redo system. After the two systems are well set up again on line
the two machines should be strictly forbidden for employees to use, and only the required network ports should be opened with firewalls
don't forget that the backup data needs to be antivirus once more