小编点评

## Attack Summary **1. Hacker compromised Oracle user:** * The Oracle user was compromised due to improper DDNS configuration. * The environment was exposed to the internet, allowing a hacker to gain access to the Oracle instance. * The compromised user had a simple password, making it easily exploited. **2. Attack process:** * The hacker executed a series of scripts to gain control of the Oracle instance. * These scripts were placed in different locations, designed to avoid being detected. * The first script ran a scheduled task every minute, calling an attacker-controlled program. * The second script modified the Oracle environment variable with malicious code. **3. Key takeaways:** * Weak security practices and misconfiguration of DDNS can be exploited. * Simple passwords and poorly written scripts can be easily compromised. * Multiple attack methods were used, highlighting the need for layered security measures. * Proactive monitoring and vulnerability assessments are crucial for securing Oracle environments. **4. Recommendations:** * Implement strong security measures to prevent DDNS and other vulnerabilities. * Use complex passwords and disable root privileges for unnecessary access. * Scan and patch Oracle for known vulnerabilities. * Implement intrusion detection and prevention systems to detect and respond to attacks. * Monitor the environment for suspicious activity and implement immediate response measures.

正文

最近，自己的一个测试环境，遭遇了hacker攻击。
具体是oracle用户被攻破了，原因是该环境通过DDNS连接到了外网，而因为只是测试，没有注意安全防范，设置的口令过于简单。
下面记录下，也作为警醒。

1.发现资源使用异常

CPU告警，使用top去查询资源使用情况发现CPU使用率非常高，达到94%：

[root@db01rac1 ~]# top
top - 22:51:02 up  7:25,  2 users,  load average: 5.52, 5.86, 5.26
Tasks: 353 total,   1 running, 252 sleeping,   0 stopped,   0 zombie
%Cpu(s): 93.4 us,  3.9 sy,  0.0 ni,  0.0 id,  0.0 wa,  1.3 hi,  1.3 si,  0.0 st
KiB Mem : 16389096 total,  3860480 free,  5278820 used,  7249796 buff/cache
KiB Swap:  1048572 total,  1048572 free,        0 used.  5589440 avail Mem 

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU %MEM     TIME+ COMMAND                                                                                                      
 9481 oracle    20   0 2450304   2.3g      4 S 344.4 14.7 114:48.41 -bash    
...

其实，这个环境只分配了4个lcpu，现在这情况基本是把CPU资源全跑满了的。
而这个罪魁祸首就是一个-bash的程序，好家伙，好有迷惑性的一个起名，不仔细判断还以为是正常程序，只是太贪心，把资源吃的这么满很容易被觉察。

2.排查处理

首先就尝试杀掉进程，在自己意料之中的，发现新的进程会再次被启动，很快又会将资源吃满。
进一步排查发现有两个地方被做了手脚：

一是oracle用户的定时任务；
每分钟都会调用该程序启动。

二是oracle用户的环境变量～/.bash_profile 也被写入恶意代码，只要再次登陆oracle用户就会被调用。

值得一提的是，两个攻击的脚本也被放到了两个不同的地方，看起来设计理念是防止一个被发现清理，还有另外的一整套备份不受影响。

还好作为一个有运维经验的人来说，这些都很熟系，很快就能发现蹊跷，一一清理后，观察一段时间，基本OK。
当然，最后关键还是要把弱密码全更改掉，以免轻易被攻破沦陷。

老是看着别人提起被攻击，或是听说某某云服务商的服务器被攻击，但是真关系到自己还是头一次遇到。
之前一直侥幸的以为数据安全离自己还是很远的，这次遭遇的被攻击小插曲也警醒自己引以为戒吧，数据安全始终是一个不可忽视的问题。