A malware on GPU server

Overview

A malware on GPU server에 대한 기술 문서입니다.

Summary

• 무엇인가? - A malware on GPU server
• 왜 필요한가? - HPC 및 서버 환경에서 필수 개념
• 언제 사용하는가? - 서버 구성, 성능 튜닝, 문제 해결 시

---

Purpose

이 문서가 존재하는 이유

• Goal: A malware on GPU server에 대한 기술 정보 제공
• Scope: A malware on GPU server의 개념, 사용법, 설정
• Non-goals: 다른 주제로의 확장

---

Key Concepts

Concept	Description	Related
A malware on GPU server	HPC/서버 환경에서 중요한 기술 개념	Linux, Server

---

Detailed Explanation

My team does not realize a malware in our system, we just assumed someone is working hard on the shared GPU system. Because we are not frequently checking host resource due to container or web interface oriented working process. however, it turns out one of Coinminer- Multios.Coinminer.Miner - live in hiding on the system. This page describes how to handle this malware to help someone's time for the similar situation. if you are interrest in more about malware in linux, this wiki page may helpful for better understanding on the background. The malware uses 100% of CPU with very lower priority CPU slice, so other task can work even this malware is running behind.

Because our system is being used by multiple people and running so many processes all the time, we did not realize the malware until we found a strange process like

As the screen show named "/4a9e003a", PID 8304 uses 11195 CPU utilization.

To find the program of that PID, we use systemctl status <pid> then found suspicious service name at /lib/systemd/system/yayayaf48a2a0e.service with vendor preset enabled so that it can start up from the begining of boot.

$systemctl status 8304
● yayayaf48a2a0e.service - Server Service
     Loaded: loaded (/lib/systemd/system/yayayaf48a2a0e.service; enabled; vendor preset: enabled)
     Active: active (running) since Fri 2023-05-26 12:10:33 KST; 3min 33s ago
    Process: 8235 ExecStart=/usr/lib/x86_64-linux-gnu/yayaya39908e0f (code=exited, status=0/SUCCESS)
   Main PID: 8304 (4a9e003a)
      Tasks: 134 (limit: 154406)
     Memory: 60.1M
     CGroup: /system.slice/yayayaf48a2a0e.service
             └─8304 /4a9e003a

To get rid of the malware with following steps.

---

Best Practices

• 최신 버전 사용 권장
• 공식 문서 참고
• 테스트 환경에서 먼저 검증

---

References

• A malware on GPU server

---

Related Pages

• Linux
• Server
• Hardware
• Network

---

Knowledge Graph

Related

→ CUDA → GPU → NVIDIA GPU → NVLink → AMD GPUs → MIG → NVIDIA GPUs → Tensor Core