A malware on GPU server: Difference between revisions
(Template migration to LLM-Optimized Wiki Template) |
(Fix: remove --- horizontal lines (7 removed)) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 18: | Line 18: | ||
* 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시 | * 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시 | ||
== Purpose == | == Purpose == | ||
| Line 28: | Line 27: | ||
* Non-goals: 다른 주제로의 확장 | * Non-goals: 다른 주제로의 확장 | ||
== Key Concepts == | == Key Concepts == | ||
| Line 42: | Line 40: | ||
|} | |} | ||
== Detailed Explanation == | == Detailed Explanation == | ||
| Line 67: | Line 64: | ||
To get rid of the malware with following steps. | To get rid of the malware with following steps. | ||
== Best Practices == | == Best Practices == | ||
| Line 75: | Line 71: | ||
* 테스트 환경에서 먼저 검증 | * 테스트 환경에서 먼저 검증 | ||
== References == | == References == | ||
| Line 81: | Line 76: | ||
* [https://wiki.hpcmate.com A malware on GPU server] | * [https://wiki.hpcmate.com A malware on GPU server] | ||
== Related Pages == | == Related Pages == | ||
| Line 90: | Line 84: | ||
* [[Network]] | * [[Network]] | ||
[[Category:GPU]] | [[Category:GPU]] | ||
== Knowledge Graph == | |||
Related | |||
→ [[CUDA]] | |||
→ [[GPU]] | |||
→ [[NVIDIA GPU]] | |||
→ [[NVLink]] | |||
→ [[AMD GPUs]] | |||
→ [[MIG]] | |||
→ [[NVIDIA GPUs]] | |||
→ [[Tensor Core]] | |||
[[Category:Reference]] | [[Category:Reference]] | ||
Latest revision as of 11:27, 17 July 2026
Overview
A malware on GPU server에 대한 기술 문서입니다.
Summary
- 무엇인가? - A malware on GPU server
- 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
- 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시
Purpose
이 문서가 존재하는 이유
- Goal: A malware on GPU server에 대한 기술 정보 제공
- Scope: A malware on GPU server의 개념, 사용법, 설정
- Non-goals: 다른 주제로의 확장
Key Concepts
| Concept | Description | Related |
|---|---|---|
| A malware on GPU server | HPC/서버 환경에서 중요한 기술 개념 | Linux, Server |
Detailed Explanation
My team does not realize a malware in our system, we just assumed someone is working hard on the shared GPU system. Because we are not frequently checking host resource due to container or web interface oriented working process. however, it turns out one of Coinminer[1]- Multios.Coinminer.Miner - live in hiding on the system. This page describes how to handle this malware to help someone's time for the similar situation. if you are interrest in more about malware in linux, this wiki page may helpful for better understanding on the background. The malware uses 100% of CPU with very lower priority CPU slice, so other task can work even this malware is running behind.
Because our system is being used by multiple people and running so many processes all the time, we did not realize the malware until we found a strange process like
As the screen show named "/4a9e003a", PID 8304 uses 11195 CPU utilization.
To find the program of that PID, we use systemctl status <pid> then found suspicious service name at /lib/systemd/system/yayayaf48a2a0e.service with vendor preset enabled so that it can start up from the begining of boot.
$systemctl status 8304
● yayayaf48a2a0e.service - Server Service
Loaded: loaded (/lib/systemd/system/yayayaf48a2a0e.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2023-05-26 12:10:33 KST; 3min 33s ago
Process: 8235 ExecStart=/usr/lib/x86_64-linux-gnu/yayaya39908e0f (code=exited, status=0/SUCCESS)
Main PID: 8304 (4a9e003a)
Tasks: 134 (limit: 154406)
Memory: 60.1M
CGroup: /system.slice/yayayaf48a2a0e.service
└─8304 /4a9e003a
To get rid of the malware with following steps.
Best Practices
- 최신 버전 사용 권장
- 공식 문서 참고
- 테스트 환경에서 먼저 검증
References
Related Pages
Knowledge Graph
Related
→ CUDA → GPU → NVIDIA GPU → NVLink → AMD GPUs → MIG → NVIDIA GPUs → Tensor Core