0

We have a centos server with customers running vps containers on it. When we run ps auxwww we see a randomly named process running (consuming a lot of bandwidth). Every time we check it is named differently: hx9hdoh0d, y98y9ydhi, 87t8gt8878 it's name changes.

What is enabling the change of name? It is suspicious that someone would wan't to protect a process like this.

  • 1
    What do you mean by "what is enabling the change of name"? A process can name itself whatever it likes whenever it likes by changing the contents of argv. If it's the same process, you might consider inspecting it by PID instead. – Chris Down Nov 11 '14 at 15:20
  • 1
    Try for instance: perl -e 'while(1) {$0 = ++$i}' & ps; ps – Stéphane Chazelas Nov 11 '14 at 15:30
  • @StéphaneChazelas Please do note for anyone who just blindly copies that: This starts an endless loop on your system and you need to kill the process afterwards! At least it's no forkbomb though… ;) – rugk Apr 13 at 20:30
5

This sets off alarm bells for me.

Check its process ID, and look at ls -l /proc/process_id/ to see e.g. what the executable is (the exe symlink). You could copy what that link points to for analysis. Also check what it's doing with strace -p process_id. If it's connecting to the internet, you may be able to firewall those outgoing connections while analyzing the situation.

If the exe location is somewhere in a temporary directory or somewhere else writeable by e.g. the web server process then it's a fairly sure bet that the system has been compromised. What user is it running as? If it's not root, then perhaps the damage done is limited and you may get away with cleaning up after it; however, I strongly recommend wiping the system, restoring from backup, and finding out how your system was compromised to prevent it happening again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.