1

After hitting some performance issues with one of our servers, I observed a Tomcat8 process called "Silence" using 100% continuously. I tried to find information about it on Google, but searching for Tomcat and Silence doesn't show any meaningful results.

Here is what I've got in top:

PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+ COMMAND                                                                                                                                     
7362 tomcat8   20   0  239956   6688   1344 S 99.7  0.2   1679:33 Silence

Can someone help me understand what this "Silence" process is and how to fix this problem? Of course there is nothing called "Silence" in our project, so I guess it is something Tomcat related.

Improve this question
4
  • 1
    I would suggest that if you don't know what this process is (Tomcat 8 does not come with a binary of that name as far as I can tell) and the server is only supposed to run software that is known to you, it would be prudent to at least suspect that the server is compromised. See serverfault.com/questions/218005/…
    – Kusalananda ♦
    Commented Feb 15, 2018 at 6:38
  • Try running ls -l /proc/7632/exe as root to see what that process might be executing, or ls -l /proc/7632/fd to identify any files it has open. If any of those are marked <filename> (deleted), you can still use these links under /proc/<process ID> to extract their content, as long as the process is still running and holding those files open. Like @Kusalananda, I suspect you've been hit by a coinminer or some other exploit that has got in through your Tomcat8.
    – telcoM
    Commented Feb 15, 2018 at 6:41
  • Also possibly related: unix.stackexchange.com/questions/395284/…
    – Kusalananda ♦
    Commented Feb 15, 2018 at 6:43
  • Have you tried to find the file and see what it is before coming here?
    – Rui F Ribeiro
    Commented Feb 15, 2018 at 8:43

1 Answer 1

Reset to default
1

It turns out there was a file in /tmp/ called "Silence", plus another one called "BoomBoom". Further investigation revealed that it was a crypto currency miner malware, probably injected through a tomcat/apache/apache-commons-collections deserialization vulnerability. Thank you for the tips.

Improve this answer
2
  • Have a look at your tomcat setup, they are a using a current vulnerability
    – Rui F Ribeiro
    Commented Feb 16, 2018 at 9:23
  • 2
    Take the server offline immediately, and follow the steps in the linked posts. Don't try to "recover" by simply removing the malware, you don't know what else is installed or modified. That system is not yours any more.
    – Kusalananda ♦
    Commented Feb 16, 2018 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .