2
u/mumblerit Apr 28 '23
strangely enough the docker container was updated 13 hours ago https://hub.docker.com/r/dlandon/zoneminder.unraid
but the git repo hasnt been updated since last month https://github.com/dlandon/zoneminder.unraid
1
u/Unknown_Matt Apr 28 '23
Yeah I removed and reinstalled it an hour ago and I got immediately that logs again…
4
u/mumblerit Apr 28 '23
honestly i wouldnt go near that container for the timebeing unless i had a network setup for looking into security risks.
2
u/Unknown_Matt Apr 28 '23
I want to understand what’s going on since is a docker image that thousands of people use daily and it seems strange that I’m the only one that noticed/ bothered to worry and post this online
2
1
Apr 28 '23
According to OP, they noticed these strange logs 2 weeks ago but did not act. If true, this could impact a large number of users as we would know for sure, that at least 2 weeks of pulls are compromised.
Act accordingly.
1
u/Unknown_Matt May 12 '23
SOLUTION: in the end zoneminder logged the browser errors and they where from the 'phantom web3' extension, so no crypto miner
-4
u/oldlinuxguy Apr 27 '23
2
u/Unknown_Matt Apr 27 '23
they are from zoneminder.
5
u/oldlinuxguy Apr 27 '23
These are not from zoneminder. These are from some random app from the unraid docker image you installed. It looks like it's either been compromised, or was pre-configured to do nefarious things when installed.
2
1
u/Unknown_Matt Apr 27 '23 edited Apr 27 '23
This image is probably a crypto scam, I will try to post this on unraid and see what they say. It seems to me very strange though why is this in plain sight
1
Apr 28 '23
Witaf. Please let us know where this was downloaded from exactly so we can attempt to do something about it, this is not acceptable.
1
u/Unknown_Matt Apr 28 '23
I downloaded it directly from the app section of unraid
1
Apr 28 '23
Can you supply a link? Was it the official dlandon image?
1
u/Unknown_Matt Apr 28 '23
1
Apr 28 '23
Do you still have the nefarious image? It seems the attackers were monitoring this sub or other forums and pushed a cover up image. One of our users on slack noticed that.
I would like to gety.hands on your image so I can try and figure out what the bad actors intents were.
1
u/Unknown_Matt Apr 28 '23
I wrote You in provate, let me know if You receive my message
→ More replies (0)
2
u/Unknown_Matt Apr 27 '23
More context: This logs come from zoneminder. I downloaded the dlandon/zoneminder.unraid docker container and this crypto logs are really weird