Nathan Osman

Wow, my last message in here was 720 days ago. :O

Hi, people.

If this isn't the most ingenious...

😂

twitter.com/PPathole/status/1202222191187644417?s=19

And here I thought it was bad that so many places were still using XP...

> "COVID-19 Response: New Jersey Urgently Needs COBOL Programmers (Yes, You Read That Correctly)"

Well this is sad: josephsteinberg.com/…

How is everyone here holding up?

Greetings.

This was both fun and horrifying.

userinyerface.com/game.html

@EliahKagan This isn't fun anymore. :(

It doesn't even have systemd. :O

# uname -a
Linux [host] 3.13.0-79-generic #123-Ubuntu SMP Fri Feb 19 14:27:58 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

But also:

# uptime
 15:45:43 up 654 days,  6:22,  1 user,  load average: 0.00, 0.09, 0.12

So I'm doing some investigating for a client on an old box and made an interesting discovery:

It's recent enough that it is likely related.

lkml.org/lkml/2019/8/1/78

I did find an email in the LKML that refers to my issue...

@Seth At, gotcha. This is very curious. :P

@Fabby I think 19.10 is using a 5.3 kernel as well.

@Seth But then... why does Trusty boot on it, but not Xenial or anything later until 19.10? Lol.

So I think I'll try downloading the 19.10 desktop ISO now.

But I did manage to get the 19.10 mini-CD to boot.

I'm thinking the hardware is newer than the software. :P

It's a brand new Ryzen-based laptop.

Oh it's not old hardware.

I wish the kernel panic display had a pager. :P

If I disable splash and quiet, I get a kernel panic but most of it is cut off.

Very strange... 🤔

I can only boot Trusty on this laptop — anything later fails.

(the executable that I found running on the system)

And here's VirusTotal's report on the file: virustotal.com/gui/file/…

The IP address is from Spain.

Hmm...

# last
postgres pts/6        37.230.69.190    Tue Dec  3 12:30 - 12:30  (00:00)
postgres pts/5        37.230.69.190    Tue Dec  3 12:29 - 22:23  (09:53)
postgres pts/6        37.230.69.190    Sun Dec  1 14:21 - 22:34 (1+08:13)
postgres pts/5        37.230.69.190    Sun Dec  1 14:12 - 22:35 (1+08:22)
postgres pts/5        37.230.69.190    Sun Dec  1 09:49 - 13:54  (04:05)

wtmp begins Sun Dec  1 09:49:03 2019

Right.

I'm going to dump the files he left on the machine somewhere for analysis.

Ah, okay. Good.

Oh, for important machines, password login isn't even an option.

@Videonauth True, but the hacker didn't have root in the guest so he was extremely limited anyway.

It wouldn't have taken me any time if I had bothered to create a snapshot. :P

It will take me 15-20 minutes at most.

All I have to do is reinstall the OS.

Right. I mean, in my case, it's not a big deal. It's a virtual machine I don't use for anything important - just testing things.

And as soon as they did (according to ~/.bash_history), they downloaded their miner and started mining.

So, they were able to log into that account.