What it is
Kinsing takes over Linux servers and container hosts to mine cryptocurrency, using your server's processor and electricity for the attacker's profit. It also installs a hidden library that loads into other programs and hides its files and processes from the normal tools you would use to look for them. That hiding is why a server with Kinsing can't be trusted to check itself.
How it gets in
In the campaigns researchers documented, through Docker's management interface left open to the internet with no login. Later reports also describe it breaking in through server software with known security holes.
Close the door: Never expose the Docker daemon API on a network without TLS client-certificate authentication or SSH; prefer the local Unix socket. Run containers and services without root where possible, which the cited report notes removes the family's preload persistence.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location | /etc/libsystem.so |
| File location | /etc/ld.so.preload |
| File name | kdevtmpfsi |
| File name | kinsing |
| File name | lib_system.so |
| Process name | kdevtmpfsi |
| Process name | kinsing |
| Startup entry | bot |
These commands only look. They change nothing.
Look for the known file locations:
sudo ls -la /etc/ld.so.preload /etc/libsystem.so 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name 'kdevtmpfsi' -o -name 'kinsing' -o -name 'lib_system.so' \) 2>/dev/nullLook for the known process names, and where each one runs from:
for p in $(pgrep -f 'kdevtmpfsi|kinsing'); do echo "$p $(sudo readlink /proc/$p/exe)"; doneList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Check the known startup entries, wherever they are installed:
systemctl list-unit-files --no-pager 2>/dev/null | grep -F -e 'bot'; sudo ls -la /etc/init.d/bot 2>/dev/nullFingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: Kinsing hides itself, so a check run on the infected server can miss it, and finding nothing does not prove the server is clean. The most useful sign is a line you didn't add in /etc/ld.so.preload: the file itself is normal, an unexpected entry in it is not. kdevtmpfsi is named to look like part of the system and bot is a generic name, so neither proves anything alone. Researchers spell the hidden library both /etc/libsystem.so and lib_system.so. These signs come from 2020 to 2021 reports; newer builds may differ.
How to deal with it
Removing it in place isn't safe. Here is what to do instead, in order:
- Don't try to clean it in place. Plan to rebuild the server from a fresh install.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: /etc/ld.so.preload, the library it names, your startup entries and scheduled tasks. If you can, collect them from a rescue disk, because the infected system hides things from you.
- Copy off your data: databases, website files and documents. Don't copy programs, startup entries, scheduled tasks or /etc/ld.so.preload; any of those could bring it back.
- Reinstall from a fresh image, install all updates, then restore only the data you copied and checked.
- From a clean computer, change every password, key and token that was on the server, including container registry and cloud keys, and cancel the old ones.
- Before you reconnect, make sure Docker's management interface can't be reached from the internet without a login. Keep checking for the signs above.
What Minaki Scan does about it
Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- Protect the Docker daemon socket, Docker Inc.
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
- Threat Alert: Kinsing Malware Attacks Targeting Container Environments, Aqua Security (2020-04-03)
- Kinsing: The Malware with Two Faces, CyberArk Labs (2021-03-09)
- Analysis of Kinsing Malware's Use of Rootkit, Trend Micro (2020-11-24)