Linux Machine Compromized/Broken -Power of Observation
Introduction :
In Debugging any issue or any dealing any problem or circumstance two things are important
- Observation — Observation not only at the time of issue but in general times also .
- Combining your general observations and Observations at the time of issue to conclude something .
In this Blog , I will explain the following :
- What was happening on my machine
- How i came to know my machine is broken into — Power of observation
What was happening on my machine
- Load on my machine is going very high
- On top command one process ./kwsapd0 is consuming around 3000% cpu
From here we get to know that kswapd is consuming process , The process kswapd0 is the process that manages virtual memory . So I thought that may be our some process is consuming more RAM and Virtual Memory is being used due to which kswapd process is doing its work but after hours of debugging we found no process is consuming RAM and around 80% RAM was free .
How i came to know my machine is broken into — Power of observation
There were two general observation which i observed and helped my geeting know what was the issue
- 1st is kswapd process looks in top command like [kswapd] not ./kswapd
- Kswapd0 can only consume 100% as it uses only one core in the machine .
From there I got to know that this kswapd0 is something unusual . On further debugging
I found ./.configrc/a/kswapd0 in root users directory .
Contents of this directory was :
$ find .configrc -type f
.configrc/dir2.dir
.configrc/a/kswapd0
.configrc/a/dir.dir
.configrc/a/a
.configrc/a/bash.pid
.configrc/a/run
.configrc/a/stop
.configrc/a/init0
.configrc/a/.procs
.configrc/a/upd
.configrc/cron.d
.configrc/b/sync
.configrc/b/dir.dir
.configrc/b/a
.configrc/b/run
.configrc/b/stop
There was also an entry in cron to run this .
So , From all of this i got to know that my system was compromised .
Yet I was unable to find out how my system was broken into . But in my future Blog i will explain what things one can check if your system is compromised and how it is compromised and what all security we can apply to our system to make it less hackable .
Source : https://hello-worlds.in/2021/04/18/linux-machine-compromized-broken-power-of-observation/
