random LXC processnames sending DDoS

[encore]

Hi,

we are facing issues with some hacked CTs.
We already had that issue with openvz6 and openvz7 earlier when we used SolusVM.
These process looking like this from node view:
http://prntscr.com/k2s1mp

When we strace these processes from inside the container, we see that it clones itself every second into /usr/bin/ with random process names.
These processes often send much outbound traffic, so seems like these are infected servers used in a botnet or something like this.
Did you ever hear about that issue? Strace:
http://prntscr.com/k2s2cc

Once the process was killed, it duplicates itself within some seconds.

Any idea to protect those containers or even handle that issue directly from the node?

Thank you

 

[mailinglists]

A killed process can not duplicate itself, because it stopped running.
The only solution I personally see is, that you invest your time, and find the attack vector for your containers and patch it.

 

[kotakomputer]

You will spent all day/week for fighting such infected CT. The best way is move your data/app then recreate CT, better use VM.
After create VPS: install AV, Anti root kit and Firewall then restore again your data/app.

 

[mailinglists]

What if the backdoor or security issue is already within the data / solution, that will be moved?
It probably is, and installing new CT and moving data to new one, will probably bring the problems with.