Wave of supercomputer hacks ye cryptocurrency migodhi

Mune akati wandei makuru emakomputa masumbu ari munzvimbo dzepamusoro-soro muUK, Germany, Switzerland neSpain, kuzivikanwa mitsva yekubira zvivakwa uye kuisirwa malware kune yakavanzika migodhi yeMonero (XMR) cryptocurrency. Ongororo yakadzama yezviitiko haisati yavepo, asi maererano nedata rekutanga, masisitimu akakanganiswa nekuda kwekubiwa kwezvitupa kubva kune masisitimu evatsvaguri vaive nemukana wekuita mabasa mumasumbu (munguva pfupi yapfuura, masumbu mazhinji anopa mukana kune vechitatu-bato vaongorori vanodzidza iyo SARS-CoV-2 coronavirus uye kuita maitiro ekuenzanisira ane chekuita neCCIDID-19 utachiona). Mushure mekuwana mukana kune sumbu mune imwe yenyaya, vapambi vakashandisa kusazvibata. CVE-2019-15666 muLinux kernel kuti uwane midzi yekuwana uye kuisa rootkit.

anomira kunze zviitiko zviviri umo varwisi vakashandisa zvinyorwa zvakatorwa kubva kune vashandisi kubva kuYunivhesiti yeKrakow (Poland), Shanghai Transport University (China) uye Chinese Scientific Network. Zvinyorwa zvakatorwa kubva kune vatori vechikamu muzvirongwa zvekutsvagisa zvepasi rose uye zvakashandiswa kubatanidza kumasumbu kuburikidza neSSH. Izvo chaizvo izvo zvitupa zvakatorwa hazvisati zvanyatsojeka, asi pane mamwe masisitimu (kwete ese) evakabatwa nepassword leak, spoofed SSH executable mafaera akaonekwa.

Somugumisiro, vanorwisa vakakwanisa tora kuwana kuUK-based (University of Edinburgh) cluster acha, iri pachinzvimbo che334 muPamusoro500 makuru makuru makuru. Kutevera kupinda kwakafanana kwaive kuzivikanwa muzvikwata bwUniCluster 2.0 (Karlsruhe Institute of Technology, Germany), ForHLR II (Karlsruhe Institute of Technology, Germany), bwForCluster JUSTUS (Ulm University, Germany), bwForCluster BinAC (University of Tübingen, Germany) uye Hawk (University of Stuttgart, Jerimani).
Ruzivo nezve cluster kuchengetedza zviitiko mu National Supercomputer Center yeSwitzerland (CSCS), Jülich Research Center (31 nzvimbo pamusoro pe500), Yunivhesiti yeMunich (Germany) uye Leibniz Computer Center (9, 85 и 86 nzvimbo dziri muTop500). Mukuwedzera, kubva kune vashandi akagamuchira ruzivo nezve kukanganiswa kwezvivakwa zveHigh Performance Computing Center muBarcelona (Spain) haisati yasimbiswa zviri pamutemo.

Analysis shanduko
akaratidza, kuti mafaera maviri ane hutsinye anogona kuchinjika akadhaunirodwa kumaseva akakanganiswa, iyo iyo suid mudzi mureza wakagadzirirwa: "/etc/fonts/.fonts" uye "/etc/fonts/.low". Yekutanga ibhuotloader yekumhanyisa magomba mirairo ine midzi ropafadzo, uye yechipiri igi yekuchenesa yekubvisa zvisaririra zveanorwisa chiitiko. Nzira dzakasiyana-siyana dzakashandiswa kuvanza zvinhu zvakashata, kusanganisira kuisa rootkit. Diamorphine, yakarongedzerwa semodule yeLinux kernel. Mune imwe nguva, nzira yekuchera migodhi yakatangwa chete usiku, kuitira kuti irege kukwezva kutarisa.

Kana yangobiwa, muenzi anogona kushandiswa kuita mabasa akasiyana siyana, akadai sekuchera Monero (XMR), achimhanyisa proxy (kutaurirana nemamwe mauto emigodhi uye sevha inoronga migodhi), ichimhanyisa microSOCKS-based SOCKS proxy (kugamuchira ekunze. kubatanidza kuburikidza neSSH) uye SSH kutumira (iyo yekutanga nzvimbo yekupinda uchishandisa yakakanganiswa account iyo muturikiri wekero akagadziridzwa kuti atumire kune yemukati network). Kana vachibatanidza kune vakakanganiswa mauto, vapambi vakashandisa mauto ane SOCKS proxies uye kazhinji akabatana kuburikidza neTor kana mamwe masisitimu akakanganisika.

Source: opennet.ru