Post

Is my NodeJS container supposed to be running netcat? 😅 I usually wake up sipping coffee, not choking on it seeing my cloud usage, but I made the most of the situation by doing some amateur forensics. #selfhosting has its ups and downs...

Patrick

@mossymaker.com

Had to sift through some metrics, but eventually found the outlier, a NextJS container using 2 vCPU and 3GB ram. Once I got to a shell, the problem was pretty clear: in addition to the expected Node processes, there was a process running from /tmp/.libsystem/node and—uh oh! Netcat.

17/1/26, 7:40 am0 reposts2 likes

Patrick

@mossymaker.com

17 Jan

Netcat (nc) is a utility for making network connections, but is also used—as in this case—to establish remote access by malicious actors. It's convenient for that, too, because it's already present on most Linux systems.

Patrick

@mossymaker.com

17 Jan

I tried to inspect its available /proc/<pid> info, but either got nothing back or permission denied. Not sure what was up with that, but I'm sure I have more to learn there. Netstat showed a connection to we.love.servers.at.ioflood.net—super legit looking. I suspect C2, but I left it alone.

Patrick

@mossymaker.com

18 Jan

Looked into the /proc issue a bit: seems like with recent #react2shell exploit activity, bind mounts have been used to hide malicious process info. attack.mitre.org/techniques/T...

attack.mitre.orgHide Artifacts: Bind Mounts, Sub-technique T1564.013 - Enterprise | MITRE ATT&CK®

Patrick

@mossymaker.com

17 Jan

Circling back to the poorly obfuscated "node" process, the file linked to in the process command line was configuration for SupportXMR, a monero crypto miner. 🙄

Patrick

@mossymaker.com

17 Jan

As more of the services we rely on do awful things, some of us are inclined to selfhost out of spite, but as this incident shows, there are risks. This was isolated, but could have been much worse. It's easy to miss an image update that patches a CVE, or not have time to set up alerting.