这是网络攻击吗?/tmp/tmp.050Scy377O/udf_ro 中存在奇怪的环回文件系统

这是网络攻击吗?/tmp/tmp.050Scy377O/udf_ro 中存在奇怪的环回文件系统

我注意到我的 Linux 机器上安装了一个奇怪的环回文件系统,并对其进行了一些深入研究。对于这里的任何安全专家来说,这看起来像是某种黑客攻击或网络攻击吗?我不知道这是否是询问的合适地方,所以请根据需要/适当地将我引导到其他地方。

我有更多详细信息,但我不想用过多的猜测来过度阐述我的问题。回送安装的映像文件大约为 5.7GB。安装中的文件似乎主要是二进制数据文件,除了 (*)。我运行了 fuser *,目前没有看到任何进程打开了这些文件。

% df | grep loop
Filesystem      1K-blocks       Used Available Use% Mounted on
/dev/loop14       5938680      47998   5890682   1% /tmp/tmp.050Scy377O/udf_ro

% ls -l /tmp/tmp.050Scy377O/                                                                                      total 48509
-rw-r--r-- 1 root root 6081740800 Sep  9 12:46 udf_512_1024_1_0.img
drwxr-xr-x 4 root root       1000 Sep  9 12:46 udf_ro/
drwxr-xr-x 2 root root       4096 Sep  9 12:46 udf_rw/

% ls -l /tmp/tmp.050Scy377O/udf_ro
total 31682
drwxr-xr-x 3 root root      80 Sep  9 12:46 0/
-rw-r--r-- 2 root root 5242879 Sep  9 12:46 1.img
-rw-r--r-- 1 root root 5242879 Sep  9 12:46 CaSe
-rw-r--r-- 1 root root  985084 Sep  9 12:46 american-english
-rw-r--r-- 1 root root 5242879 Sep  9 12:46 cAsE
-rw-r--r-- 2 root root 5242879 Sep  9 12:46 hard
lrwxrwxrwx 1 root root     192 Sep  9 12:46 longsym -> qwertzuiopasdfghjklyxcvbnm1234567890qwertzuiopasdfghjklyxcvbnm1234567890oiewqfiewioqoiqoiurqruewqoiuwoieoiiuewqroreqiufieiuwrnureweriuvceoiroiewqoiricdsalkcndsakfirefoiwqeoircorejwoijfreoijojo
lrwxrwxrwx 1 root root     348 Sep  9 12:46 psym -> /0/1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19/20/21/22/23/24/25/26/27/28/29/30/31/32/33/34/35/36/37/38/39/40/41/42/43/44/45/46/47/48/49/50/51/52/53/54/55/56/57/58/59/60/61/62/63/64/65/66/67/68/69/70/71/72/73/74/75/76/77/78/79/80/81/82/83/84/85/86/87/88/89/90/91/92/93/94/95/96/97/98/99/100/101/102/103/104/105/106/107/108/109/110/111/112/p.img
-rw-r--r-- 1 root root 5242879 Sep  9 12:46 qwertzuiopasdfghjklyxcvbnm1234567890qwertzuiopasdfghjklyxcvbnm1234567890oiewqfiewioqoiqoiurqruewqoiuwoieoiiuewqroreqiufieiuwrnureweriuvceoiroiewqoiricdsalkcndsakfirefoiwqeoircorejwoijfreoijojo
drwxr-xr-x 2 root root     172 Sep  9 12:46 sdir/
lrwxrwxrwx 1 root root       5 Sep  9 12:46 sym -> 1.img
-rw-r--r-- 1 root root 5242879 Sep  9 12:46 ??????????????????????????????????????????????????????????????????
lrwxrwxrwx 1 root root      65 Sep  9 12:46 ?????????????????????????????????????????????????????????????????? -> ?????????????????????????????????????????????????????????????????

(*)注意:文件 american-english 是一本 utf-8 纯文本字典。看起来可疑,可能是字典攻击?

回答请求更多信息:

% snap list
Name                    Version                     Rev    Tracking       Publisher    Notes
acrordrdc               2021.007.20091              62     latest/stable  mmtrt        -
bare                    1.0                         5      latest/stable  canonical**  base
core18                  20220830                    2560   latest/stable  canonical**  base
core20                  20220826                    1623   latest/stable  canonical**  base
gnome-3-28-1804         3.28.0-19-g98f9e67.98f9e67  161    latest/stable  canonical**  -
gnome-3-38-2004         0+git.891e5bc               115    latest/stable  canonical**  -
gtk-common-themes       0.1-81-g442e511             1535   latest/stable  canonical**  -
snapd                   2.56.2                      16292  latest/stable  canonical**  snapd
wine-platform-6-stable  6.0.4                       19     latest/stable  mmtrt        -
wine-platform-runtime   v1.0                        316    latest/stable  mmtrt        -

相关内容