kdevtmpfsi MalWare When Deploying to Digital Ocean

[pwdel]

I was attempting to adapt a prototype version of SocialPredict as a production instance just to see what would happen and see if I can hack together a solution to adapt our development version of SocialPredict to prod.

When deploying to a Digital Ocean droplet, I noticed that the CPU was suddenly super high at about 6AM CST this morning after having deployed a test yesterday.

Running top, there was one process, kdevtmpfsi taking up 99% of the CPU.

    PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND                                                                                                                                               
  14378 lxd       20   0  717900 270168      0 S  99.9  27.6 132:48.03 kdevtmpfsi                                                                                                                                            

This is a cryptocurrency mining malware which is associated with redis:

https://www.createit.com/blog/kinsing-malware-kdevtmpfsi-how-to-kill/

That being said, this kdevtmpfsi is typically associated with Redis, which we are not using. While Digital Ocean does make a Redis plugin available, we are not using it. While we are using a Digital Ocean shared server, these shared servers evidently don't use Redis to function.

Also, this high CPU usage didn't emerge right away, it happened after about 18 hours of having been deployed first.

So basically, it seems to be because our nginx is just not configured properly, so the ports exposed our server.

https://www.reddit.com/r/docker/comments/k2lwvd/protect_your_docker_containers_from_kinsing/

[pwdel]

Set up a firewall on Digital Ocrean, documented this on documentation branch. That should allow incoming access of other ports.

[pwdel]

More solutions to do to try to really confidently close out this ticket:

Deleting libsystem.so, /.ICEd-unix, zzz, kinsing files from /tmp is not a permantent solution.. The cron process will rename the files and start again. I was able to remove it permanently by following these steps:

• Remove unnecessary exposed ports [DONE]
• Password protect Redis image (postgres image?)
• Fix docker deamon and other security issues (verify with tools like Docker Bench Security)
• Fix ufw firewall flaws with Docker
• Repull images and rebuild

[pwdel]

I haven't seen this malware pop back up after removing unnecessary ports, so I think this has been solved.