crontab

[Zaraab]

I dont know whats wrong because I have inputted the standard cronjobs in the crontab. But seems like after one or two days, my crontab shows to be empty.


The crontab shows like below
* * * * * /tmp/ast
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
~
"/tmp/crontab.EeReUx" 1L, 19C


And also my cpu load in admin panel of vicidial shows something like 400-100%
What might be wrong please?

[GenXOutsourcing]

You have been HACKED........

A client came to me with the same, their load was very high and the dialer was not working.

There are files all over the place, the /tmp/ast and the /root/.ssh/authorized_keys and even an /etc/initd

Took about 3hrs to find all of it.

[Zaraab]

So vicidial is subjected to a hack?

and what did you find after 3hrs?

[mflorell]

Just about any Internet-facing server can get hacked, and there is no 100% safe way to recover a server from a hack like that other than completely wiping the server and installing everything over again.

The best way to make sure the server is not hacked again is to: use long passwords, implement a strict firewall and keep the software on the server updated.

[GenXOutsourcing]

So vicidial is subjected to a hack?

and what did you find after 3hrs?

It is/was crypto mining.

But as Matt said, the ONLY way to be 100% sure, is to reinstall.

What I did was an emergency for the client, and I am waiting for them to decide when I can reinstall their system. Yes, its working......... is it clean and secure........ i doubt it.

[carpenox]

check out my blog for securing your vicidial server the.cyburhacker.com

[Zaraab]

Just about any Internet-facing server can get hacked, and there is no 100% safe way to recover a server from a hack like that other than completely wiping the server and installing everything over again.

The best way to make sure the server is not hacked again is to: use long passwords, implement a strict firewall and keep the software on the server updated.

hey Mat thank you so much for a headsup!

So basically the server is in oracle cloud and oracle cloud has highly restricted way to SSH access or connect to their servers. Its strictly bound to their VCNI and ssh key matches.

Is there something like a backdoor through which my server has been hacked as because I scratch installed it?

[mflorell]

I have no idea, I'm not familiar with the Oracle cloud at all, and we only use OpenSuSE, so any other distro would have other vulnerabilities that I'm not familiar with.