我注意到我的 Linux 机器上安装了一个奇怪的环回文件系统,并对其进行了一些深入研究。对于这里的任何安全专家来说,这看起来像是某种黑客攻击或网络攻击吗?我不知道这是否是询问的合适地方,所以请根据需要/适当地将我引导到其他地方。
我有更多详细信息,但我不想用过多的猜测来过度阐述我的问题。回送安装的映像文件大约为 5.7GB。安装中的文件似乎主要是二进制数据文件,除了 (*)。我运行了 fuser *,目前没有看到任何进程打开了这些文件。
% df | grep loop
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/loop14 5938680 47998 5890682 1% /tmp/tmp.050Scy377O/udf_ro
% ls -l /tmp/tmp.050Scy377O/ total 48509
-rw-r--r-- 1 root root 6081740800 Sep 9 12:46 udf_512_1024_1_0.img
drwxr-xr-x 4 root root 1000 Sep 9 12:46 udf_ro/
drwxr-xr-x 2 root root 4096 Sep 9 12:46 udf_rw/
% ls -l /tmp/tmp.050Scy377O/udf_ro
total 31682
drwxr-xr-x 3 root root 80 Sep 9 12:46 0/
-rw-r--r-- 2 root root 5242879 Sep 9 12:46 1.img
-rw-r--r-- 1 root root 5242879 Sep 9 12:46 CaSe
-rw-r--r-- 1 root root 985084 Sep 9 12:46 american-english
-rw-r--r-- 1 root root 5242879 Sep 9 12:46 cAsE
-rw-r--r-- 2 root root 5242879 Sep 9 12:46 hard
lrwxrwxrwx 1 root root 192 Sep 9 12:46 longsym -> qwertzuiopasdfghjklyxcvbnm1234567890qwertzuiopasdfghjklyxcvbnm1234567890oiewqfiewioqoiqoiurqruewqoiuwoieoiiuewqroreqiufieiuwrnureweriuvceoiroiewqoiricdsalkcndsakfirefoiwqeoircorejwoijfreoijojo
lrwxrwxrwx 1 root root 348 Sep 9 12:46 psym -> /0/1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19/20/21/22/23/24/25/26/27/28/29/30/31/32/33/34/35/36/37/38/39/40/41/42/43/44/45/46/47/48/49/50/51/52/53/54/55/56/57/58/59/60/61/62/63/64/65/66/67/68/69/70/71/72/73/74/75/76/77/78/79/80/81/82/83/84/85/86/87/88/89/90/91/92/93/94/95/96/97/98/99/100/101/102/103/104/105/106/107/108/109/110/111/112/p.img
-rw-r--r-- 1 root root 5242879 Sep 9 12:46 qwertzuiopasdfghjklyxcvbnm1234567890qwertzuiopasdfghjklyxcvbnm1234567890oiewqfiewioqoiqoiurqruewqoiuwoieoiiuewqroreqiufieiuwrnureweriuvceoiroiewqoiricdsalkcndsakfirefoiwqeoircorejwoijfreoijojo
drwxr-xr-x 2 root root 172 Sep 9 12:46 sdir/
lrwxrwxrwx 1 root root 5 Sep 9 12:46 sym -> 1.img
-rw-r--r-- 1 root root 5242879 Sep 9 12:46 ??????????????????????????????????????????????????????????????????
lrwxrwxrwx 1 root root 65 Sep 9 12:46 ?????????????????????????????????????????????????????????????????? -> ?????????????????????????????????????????????????????????????????
(*)注意:文件 american-english 是一本 utf-8 纯文本字典。看起来可疑,可能是字典攻击?
回答请求更多信息:
% snap list
Name Version Rev Tracking Publisher Notes
acrordrdc 2021.007.20091 62 latest/stable mmtrt -
bare 1.0 5 latest/stable canonical** base
core18 20220830 2560 latest/stable canonical** base
core20 20220826 1623 latest/stable canonical** base
gnome-3-28-1804 3.28.0-19-g98f9e67.98f9e67 161 latest/stable canonical** -
gnome-3-38-2004 0+git.891e5bc 115 latest/stable canonical** -
gtk-common-themes 0.1-81-g442e511 1535 latest/stable canonical** -
snapd 2.56.2 16292 latest/stable canonical** snapd
wine-platform-6-stable 6.0.4 19 latest/stable mmtrt -
wine-platform-runtime v1.0 316 latest/stable mmtrt -