10 May
2017
10 May
'17
7:15 p.m.
Does anyone know what the user "debian" is used for in the DIAL distro? I had a node compromised where it appears they guessed the password for the user debian. I note on other un-compromised nodes there is a preexisting user "debian" with a password set. The attacker installed a bitcoin miner, storing their files under /var/tmp/.new chrootkit reported it as possibly being the Mumblehard backdoor. I'd suggest anyone with a DIAL node, at the very least, remove the user "debian"'s password. passwd -d debian Steve, k6kya