Cryptojacking attack via Redis container

[sondoha]

Info:

• Docker version ($ docker --version):
• Laradock commit ($ git rev-parse HEAD):
• System info (Mac, PC, Linux):
• System info disto/version:

Issue:

Hello,

I've been using Laradock for a while. It was great!

But just realized that Redis Docker container had been attacked. All 16 CPU cores were up to 100%.

Use htop command, I see something like this:

xmrig-notls -o pinto.mamointernet.icu:4444 -u ver1 -p ver1 --max-cpu-usage 100 --donate-level 1 -B

Has anyone faced this issue? And how did you deal with it?

PS: The same issue has been reported here:

https://medium.com/threat-intel/cryptojacking-coin-mining-cybercrime-234895bec6e1
https://gitter.im/tiangolo/fastapi?at=5d89d0b78521b34d91803d83

---

Expected behavior:

---

Reproduce:

---

Relevant Code:

// place a code sample here

[lanphan]

Hi,
I think you should secure your network more by configuring firewall / gateway / proxy more secure (allow 80, 443 ports out only, for ex).
In case you have more secure configuration for Redis, please help share with us.
Thanks.

[BernardoMG]

Hi,
I'm facing the same issue on an ec2 instance. @sondoha any tip on how to remove trojan?

[sondoha]

It is still happening to me. Even if I banned the Redis port from public.

So I use queue driver sync instead of redis. Sure it is for development only, I do not have any solution for production atm.

[BernardoMG]

Yes, banning Redis port isn't enough @sondoha.

We manage to fix it by:

1. Launching a new instance with the most recent Redis version;
2. Clean weird crontab entries (immediately after previous step);
3. Delete networkservice if exists

This instance looks good, no weird process consuming CPU 🙂

[stale]

Hi 👋 this issue has been automatically marked as stale 📌 because it has not had recent activity 😴. It will be closed if no further activity occurs. Thank you for your contributions ❤️.

[stale]

Hi again 👋 we would like to inform you that this issue has been automatically closed 🔒 because it had not recent activity during the stale period. We really really appreciate your contributions, and looking forward for more in the future 🎈.