this post was submitted on 12 Jul 2023
150 points (96.9% liked)

Comic Strips

18904 readers
1404 users here now

Comic Strips is a community for those who love comic stories.

The rules are simple:

Web of links

founded 2 years ago
MODERATORS
 
top 9 comments
sorted by: hot top controversial new old
[–] senorblackbean@lemmy.world 25 points 2 years ago

My guess:

spoilerAn attacker exploited a SQL injection or buffer overflow flaw in Apache+PHP+MySQL (which they have no idea about), installed a Java based coin miner (gross, I know), and deleted /var/log to cover up their tracks. But it was Col. Kernel that killed MySQL for using up too much memory. Ruby is just there because of some obscure distro dependency nobody uses.

[–] IDatedSuccubi@lemmy.world 9 points 2 years ago (2 children)

Why is Apache running on root?

[–] Speculater@lemmy.world 6 points 2 years ago

Easier to push updates without all the red tape.

[–] lontong@kbin.social 5 points 2 years ago

In some setups where each vhost run as its own user, the main apache process has to run as root.

[–] EpicFailGuy@lemmy.world 8 points 2 years ago

Kernel did ... OoM

[–] Blaze@iusearchlinux.fyi 6 points 2 years ago
[–] ZC3rr0r@lemmy.ca 6 points 2 years ago

My money's on the sysop being guilty of ~~man~~processslaughter or at least gross negligence for not putting enough RAM in the box.

[–] xuxebiko@kbin.social 2 points 2 years ago

The bundler did it.

[–] mlg@lemmy.world 2 points 2 years ago

Injection attack submitted through apache, processed by an outdated PHP, forwarded to fat java who's running a ye olde ass library to do sql input sanitization (it failed lol), and passed onto MySQL via a ruby script, which had a stroke because the request was to write to /var/log because someone was screwing around in sqlmap

Oh and /var/log "accidentally" had 777 perms lmao