[Csnd] Cosmo image infected?

classic Classic list List threaded Threaded
5 messages Options
Reply | Threaded
Open this post in threaded view
|

[Csnd] Cosmo image infected?

zappfinger
A while ago I noticed that one of my RPi's was infected with a process
called 'crypto', apparently for mining purposes.
I could see that by running the 'top' command.
The Pi had the Cosmo image on the SD card. Today I tried several times
to re-format and install the Cosmo image again.
Just now I started the Pi with no network attached and the crypto
process was running. I hope I'm wrong, but it looks like it is on the
Cosmo image. Could someone please verify this?


Richard

Csound mailing list
[hidden email]
https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
Send bugs reports to
        https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
Reply | Threaded
Open this post in threaded view
|

Re: [Csnd] Cosmo image infected?

zappfinger
Apparently (according to the RPi forum) this is the result of the Muldrop.14
virus.
So anyone running a Cosmo image, please run top and probably crypto process
will show up...



--
Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html

Csound mailing list
[hidden email]
https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
Send bugs reports to
        https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
Reply | Threaded
Open this post in threaded view
|

Re: [Csnd] Cosmo image infected?

zappfinger
It might be a false alarm. After some discussions on the RPi forum and much
googeling it *could* be that crypto is a normal Linux process...



--
Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html

Csound mailing list
[hidden email]
https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
Send bugs reports to
        https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
Reply | Threaded
Open this post in threaded view
|

Re: [Csnd] Cosmo image infected?

Victor Lazzarini-2
There is a libcrypto that is used by OpenSSL.

Victor Lazzarini
Dean of Arts, Celtic Studies, and Philosophy
Maynooth University
Ireland

> On 11 May 2018, at 07:13, zappfinger <[hidden email]> wrote:
>
> It might be a false alarm. After some discussions on the RPi forum and much
> googeling it *could* be that crypto is a normal Linux process...
>
>
>
> --
> Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html
>
> Csound mailing list
> [hidden email]
> https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
> Send bugs reports to
>        https://github.com/csound/csound/issues
> Discussions of bugs and features can be posted here

Csound mailing list
[hidden email]
https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
Send bugs reports to
        https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here
Reply | Threaded
Open this post in threaded view
|

Re: [Csnd] Cosmo image infected?

Bernt Isak Wærstad
As far as I can see, crypto is a kernel module where all the cryptographic functions are placed.

The COSMO image is based on a fresh Raspbian image where we've installed cosmo repos, compiled csound and a few other modification. Everything is downloaded and installed through either git or apt-get - nothing from insecure location, so I would say Im pretty confident that it's not malware running

On Fri, 11 May 2018 at 08:57, Victor Lazzarini <[hidden email]> wrote:
There is a libcrypto that is used by OpenSSL.

Victor Lazzarini
Dean of Arts, Celtic Studies, and Philosophy
Maynooth University
Ireland

> On 11 May 2018, at 07:13, zappfinger <[hidden email]> wrote:
>
> It might be a false alarm. After some discussions on the RPi forum and much
> googeling it *could* be that crypto is a normal Linux process...
>
>
>
> --
> Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html
>
> Csound mailing list
> [hidden email]
> https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
> Send bugs reports to
>        https://github.com/csound/csound/issues
> Discussions of bugs and features can be posted here

Csound mailing list
[hidden email]
https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND
Send bugs reports to
        https://github.com/csound/csound/issues
Discussions of bugs and features can be posted here


--
Mvh.

Bernt Isak Wærstad


Csound mailing list [hidden email] https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here