[Csnd] Cosmo image infected?

[Csnd] Cosmo image infected?

Date	2018-05-10 16:44
From	Richard
Subject	[Csnd] Cosmo image infected?
	A while ago I noticed that one of my RPi's was infected with a process called 'crypto', apparently for mining purposes. I could see that by running the 'top' command. The Pi had the Cosmo image on the SD card. Today I tried several times to re-format and install the Cosmo image again. Just now I started the Pi with no network attached and the crypto process was running. I hope I'm wrong, but it looks like it is on the Cosmo image. Could someone please verify this? Richard Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here

Date	2018-05-10 20:44
From	zappfinger
Subject	Re: [Csnd] Cosmo image infected?
	Apparently (according to the RPi forum) this is the result of the Muldrop.14 virus. So anyone running a Cosmo image, please run top and probably crypto process will show up... -- Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here

Date	2018-05-11 07:13
From	zappfinger
Subject	Re: [Csnd] Cosmo image infected?
	It might be a false alarm. After some discussions on the RPi forum and much googeling it could be that crypto is a normal Linux process... -- Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here

Date	2018-05-11 07:57
From	Victor Lazzarini
Subject	Re: [Csnd] Cosmo image infected?
	There is a libcrypto that is used by OpenSSL. Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland > On 11 May 2018, at 07:13, zappfinger wrote: > > It might be a false alarm. After some discussions on the RPi forum and much > googeling it could be that crypto is a normal Linux process... > > > > -- > Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html > > Csound mailing list > Csound@listserv.heanet.ie > https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND > Send bugs reports to > https://github.com/csound/csound/issues > Discussions of bugs and features can be posted here Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here

Date	2018-05-11 09:07
From	Bernt Isak Wærstad
Subject	Re: [Csnd] Cosmo image infected?
	As far as I can see, crypto is a kernel module where all the cryptographic functions are placed. The COSMO image is based on a fresh Raspbian image where we've installed cosmo repos, compiled csound and a few other modification. Everything is downloaded and installed through either git or apt-get - nothing from insecure location, so I would say Im pretty confident that it's not malware running On Fri, 11 May 2018 at 08:57, Victor Lazzarini <Victor.Lazzarini@mu.ie> wrote: There is a libcrypto that is used by OpenSSL. Victor Lazzarini Dean of Arts, Celtic Studies, and Philosophy Maynooth University Ireland > On 11 May 2018, at 07:13, zappfinger <zappfinger@GMAIL.COM> wrote: > > It might be a false alarm. After some discussions on the RPi forum and much > googeling it could be that crypto is a normal Linux process... > > > > -- > Sent from: http://csound.1045644.n5.nabble.com/Csound-General-f1093014.html > > Csound mailing list > Csound@listserv.heanet.ie > https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND > Send bugs reports to > https://github.com/csound/csound/issues > Discussions of bugs and features can be posted here Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here -- Mvh. Bernt Isak Wærstad Csound mailing list Csound@listserv.heanet.ie https://listserv.heanet.ie/cgi-bin/wa?A0=CSOUND Send bugs reports to https://github.com/csound/csound/issues Discussions of bugs and features can be posted here