1

What does it mean when you figure out that you're considered as a target ISCSI device.

I found the process iSCSId in /var/tmp with a conf file. it's trying to create an hourly crontab command under my machine: serverClientName. How to prevent such connection? why I couldn't be notified by this unauthorized and background connection via the protocol iSCSI? by the way we're using java6

where to find the initiators's identity.

this is the content of crontab

May 29 06:34:06 Archive-X**y crontab[24772]: (X**y) BEGIN EDIT (X**y)
May 29 06:35:24 Archive-X**y crontab[24772]: (X**y) END EDIT (X**y)
May 29 06:37:11 Archive-X**y crontab[24804]: (dcm4chee) BEGIN EDIT (dcm4chee)
May 29 06:41:21 Archive-X**y crontab[24804]: (dcm4chee) REPLACE (dcm4chee)
May 29 06:41:21 Archive-X**y crontab[24804]: (dcm4chee) END EDIT (dcm4chee)
May 29 06:41:25 Archive-X**y crontab[24834]: (dcm4chee) BEGIN EDIT (dcm4chee)
May 29 06:42:01 Archive-X**y cron[1270]: (dcm4chee) RELOAD (crontabs/dcm4chee)
May 29 06:42:08 Archive-X**y crontab[24834]: (dcm4chee) END EDIT (dcm4chee)

+++X**y is the name of the dcm4chee server +++

The content of /var/tmp/iscsid_pirate is garbled binary.

This is the content of pirate.conf

X**y@Archive-X**y:/var/tmp$ ls
iscsid_pirate  pirate.conf
X**y@Archive-X**y:/var/tmp$ more pirate.conf

{
    "url" : "stratum+tcp://188.165.254.85:80",
    "user" : "46Z6dQ77i2qAapF4kjLXaaYKCB59eajwaZbmtyyPsxDXWyxPS5nfYoe5t4R7yTgsvT
AxgE8DRwwtKiMxCmM39KCBPfEgL5b",
    "pass" : "x",
    "algo" : "cryptonight",
    "quiet" : true
}
1

What you encounter is NOT an iSCSI hack, but malicious bitcoin miner that place in your system that mask as a iSCSI process (which is not).

Kill the process /var/tmp/iscsid_pirate process, check your crontab. If you don't believe it is malicious, you can run

sha256sum /var/tmp/iscsid_pirate

copy the hash and paste into https://www.virustotal.com/search bar. Due to bitcoin miner abuse, most antivirus flag bitcoin miner as something bad. Don't be surprised that mainstream Windows antivirus flag them even it is a Linux ELF file.

What you should do :

  1. Check your web services for security flaw.(e.g. outdated version, unpatched security updates,etc)
  2. Backup your data
  3. Reinstall and redeploy the server, patch all the security holes before open up to user. (You need no.1 to backup your claims that you have been hacked instead of a rouge admin put the bitcoin miner in your system).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.