{"id":43184,"date":"2026-08-12T16:08:13","date_gmt":"2026-08-12T09:08:13","guid":{"rendered":"https:\/\/interdata.vn\/blog\/?p=43184"},"modified":"2026-08-12T17:04:13","modified_gmt":"2026-08-12T10:04:13","slug":"kiem-tra-loai-bo-rootkit-ustar-va-cryptominer","status":"publish","type":"post","link":"https:\/\/interdata.vn\/blog\/kiem-tra-loai-bo-rootkit-ustar-va-cryptominer\/","title":{"rendered":"H\u01b0\u1edbng D\u1eabn Ki\u1ec3m Tra &#038; Lo\u1ea1i B\u1ecf Rootkit Ustar v\u00e0 Cryptominer Monero Qua Tor"},"content":{"rendered":"<p style=\"text-align: justify;\"><span style=\"font-size: 100%;\"><strong>Ki\u1ec3m tra v\u00e0 lo\u1ea1i b\u1ecf rootkit ustar<\/strong> l\u00e0 vi\u1ec7c c\u1ea7n \u01b0u ti\u00ean khi VPS Ubuntu xu\u1ea5t hi\u1ec7n nh\u1eefng d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng nh\u01b0 CPU t\u0103ng cao, li\u00ean t\u1ee5c ph\u00e1t sinh k\u1ebft n\u1ed1i TCP outbound \u0111\u1ebfn c\u00e1c IP l\u1ea1, trong khi c\u00e1c l\u1ec7nh ki\u1ec3m tra nh\u01b0 ps hay ss l\u1ea1i kh\u00f4ng hi\u1ec3n th\u1ecb ti\u1ebfn tr\u00ecnh \u0111\u00e1ng ng\u1edd. \u0110\u00e2y c\u00f3 th\u1ec3 l\u00e0 d\u1ea5u hi\u1ec7u server \u0111\u00e3 b\u1ecb rootkit LD_PRELOAD che gi\u1ea5u cryptominer Monero ho\u1ea1t \u0111\u1ed9ng th\u00f4ng qua Tor. M\u1ed9t trong nh\u1eefng v\u1ecb tr\u00ed quan tr\u1ecdng c\u1ea7n ki\u1ec3m tra \u0111\u1ea7u ti\u00ean l\u00e0 \/etc\/ld.so.preload. Trong b\u00e0i vi\u1ebft n\u00e0y, <a href=\"\/\"><strong>InterData<\/strong><\/a> s\u1ebd h\u01b0\u1edbng d\u1eabn b\u1ea1n t\u1eebng b\u01b0\u1edbc x\u00e1c \u0111\u1ecbnh d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp, lo\u1ea1i b\u1ecf rootkit v\u00e0 cryptominer, \u0111\u1ed3ng th\u1eddi gia c\u1ed1 l\u1ea1i VPS \u0111\u1ec3 h\u1ea1n ch\u1ebf nguy c\u01a1 t\u00e1i nhi\u1ec5m.<\/span><\/p>\n<div style=\"background-color: #eff6ff; padding: 20px; border: 1.5px solid #BFDBFE; border-radius: 12px; margin-bottom: 40px; box-shadow: 0 8px 20px rgba(37,99,235,0.05);\">\n<p style=\"font-family: 'Be Vietnam Pro', sans-serif; font-weight: bold; font-size: 18px; margin: 0 0 15px; color: #1e3a8a;\">N\u1ed8I DUNG B\u00c0I VI\u1ebeT<\/p>\n<ul style=\"list-style-type: none; padding-left: 0; margin: 0;\">\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section1\">1. D\u1ea5u hi\u1ec7u nh\u1eadn bi\u1ebft VPS \u0111\u00e3 b\u1ecb nhi\u1ec5m rootkit ustar v\u00e0 cryptominer<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section2\">2. Rootkit ustar v\u00e0 miner Monero qua Tor ho\u1ea1t \u0111\u1ed9ng ra sao?<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section3\">3. Quy tr\u00ecnh ki\u1ec3m tra &amp; lo\u1ea1i b\u1ecf rootkit ustar t\u1eebng b\u01b0\u1edbc<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section4\">4. Checklist lo\u1ea1i b\u1ecf rootkit ustar v\u00e0 cryptominer tri\u1ec7t \u0111\u1ec3 (6 m\u1ee5c)<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section5\">5. G\u1ee1 t\u1ea1i ch\u1ed7 hay d\u1ef1ng l\u1ea1i VPS s\u1ea1ch?<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section6\">6. Ph\u00f2ng ng\u1eeba t\u00e1i nhi\u1ec5m v\u00e1 \u0111\u00fang l\u1ed7 h\u1ed5ng g\u1ed1c<\/a><\/li>\n<li style=\"margin-bottom: 10px;\"><a style=\"text-decoration: none; color: #2563eb; font-weight: bold;\" href=\"#section7\">7. C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p (FAQ)<\/a><\/li>\n<\/ul>\n<\/div>\n\n\n<style>\n.interdata-plan-carousel,.interdata-plan-carousel *{box-sizing:border-box}\n.interdata-plan-carousel{--blue:#005bea;--blue-dark:#004dcc;--text:#071832;--muted:#516173;--border:#d8e6fb;--bg:#f3f8ff;--shadow:0 5px 14px rgba(0,62,145,.08);background:var(--bg);padding:14px 56px 18px;position:relative;overflow:hidden;border-radius:20px;}\n.interdata-carousel-heading{color:#f00;font-family:Roboto,sans-serif;font-size:18px;line-height:1.35;font-weight:800;text-align:center;margin:0 0 14px}\n.interdata-plan-viewport{overflow:hidden;width:100%}\n.interdata-plan-track{display:flex;align-items:stretch;gap:12px;overflow:visible;padding:0 0 4px;transform:translate3d(0,0,0);transition:transform .45s ease;will-change:transform;touch-action:pan-y}\n.interdata-plan-card{flex:0 0 calc((100% - 24px)\/3);min-width:0;min-height:0!important;height:auto;background:#fff;border:1px solid var(--border);border-radius:8px;padding:15px 12px 13px;display:flex;flex-direction:column;box-shadow:var(--shadow)}\n.interdata-plan-title{color:var(--blue-dark);font-size:16px;line-height:1.22;font-weight:800;text-align:center;margin:0 0 7px;text-transform:uppercase;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}\n.interdata-plan-price{color:var(--blue-dark);font-size:24px;line-height:1;font-weight:900;text-align:center;margin-bottom:12px;white-space:nowrap;letter-spacing:0}\n.interdata-plan-price span{font-size:10px;font-weight:800;margin-left:2px}\n.interdata-plan-badge{align-self:center;display:inline-flex;align-items:center;justify-content:center;background:#ff3934;color:#fff;border-radius:5px;padding:7px 8px;font-size:9px;line-height:1;font-weight:800;margin-bottom:15px;white-space:nowrap;max-width:100%}\n.interdata-plan-features{list-style:none!important;padding:0!important;margin:0!important}\n.interdata-plan-features li{display:flex;gap:7px;align-items:flex-start;color:var(--text);font-size:12px;line-height:1.35;font-weight:700;text-align:left;margin:0 0 10px!important;padding:0!important}\n.interdata-plan-icon{width:14px;min-width:14px;height:14px;color:#0069ff;margin-top:2px}\n.interdata-plan-icon svg{display:block;width:100%;height:100%;fill:none;stroke:currentColor;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}\n.interdata-plan-spacer{flex:1;min-height:16px}\n.interdata-plan-button{display:flex;align-items:center;justify-content:center;min-height:42px;width:100%;margin-top:auto!important;margin-bottom:0!important;background:var(--blue);color:#fff!important;border-radius:5px;font-size:13px;font-weight:800;text-decoration:none!important;box-shadow:0 7px 14px rgba(0,91,234,.24);transition:transform .2s ease,background .2s ease}\n.interdata-plan-button:hover{background:var(--blue-dark);color:#fff!important;transform:translateY(-1px)}\n.interdata-carousel-arrow{position:absolute;top:50%;z-index:5;width:44px;height:54px;border:2px solid #fff!important;border-radius:999px;background:var(--blue)!important;color:#fff!important;box-shadow:0 8px 22px rgba(0,62,145,.32);display:flex!important;align-items:center;justify-content:center;cursor:pointer;transform:translateY(-35%);transition:background .2s ease,color .2s ease,opacity .2s ease,transform .2s ease}\n.interdata-carousel-arrow:hover{background:var(--blue-dark)!important;color:#fff!important;transform:translateY(-35%) scale(1.04)}\n.interdata-carousel-arrow:disabled{opacity:.78;cursor:not-allowed;background:#8aa6cf!important;color:#fff!important}\n.interdata-carousel-arrow:disabled:hover{background:#8aa6cf!important;color:#fff!important;transform:translateY(-35%)}\n.interdata-carousel-arrow svg{display:none!important}\n.interdata-carousel-arrow:before{content:none!important;display:none!important}\n.interdata-carousel-mark{display:block!important;color:#fff!important;font-family:Arial,Helvetica,sans-serif!important;font-size:38px!important;font-weight:900!important;line-height:1!important;text-align:center!important;pointer-events:none!important;transform:translateY(-2px)}\n.interdata-carousel-prev{left:14px}\n.interdata-carousel-prev .interdata-carousel-mark{margin-left:-2px}\n.interdata-carousel-next{right:14px}\n.interdata-carousel-next .interdata-carousel-mark{margin-right:-2px}\n@media (max-width:800px){.interdata-plan-carousel{padding:12px 44px 16px}.interdata-plan-card{flex-basis:calc((100% - 12px)\/2)}.interdata-carousel-heading{font-size:16px}.interdata-carousel-prev{left:6px}.interdata-carousel-next{right:6px}}\n@media (max-width:480px){.interdata-plan-carousel{padding:12px 38px 16px}.interdata-plan-card{flex-basis:100%}.interdata-plan-price{font-size:23px}.interdata-carousel-arrow{width:34px;height:44px}.interdata-carousel-mark{font-size:32px!important}.interdata-carousel-prev{left:3px}.interdata-carousel-next{right:3px}}\n<\/style>\n\n<div class=\"interdata-plan-carousel\" data-interdata-carousel>\n  <div class=\"interdata-carousel-heading\">Si\u00eau \u01afu \u0110\u00e3i VPS \/ CLOUD SERVER - Ti\u1ebft Ki\u1ec7m \u0110\u1ebfn 70%<\/div>\n\n  <svg width=\"0\" height=\"0\" style=\"position:absolute;visibility:hidden\" aria-hidden=\"true\">\n    <symbol id=\"id-icon-cpu\" viewBox=\"0 0 24 24\"><rect x=\"7\" y=\"7\" width=\"10\" height=\"10\" rx=\"2\"><\/rect><path d=\"M4 9h3M4 15h3M17 9h3M17 15h3M9 4v3M15 4v3M9 17v3M15 17v3\"><\/path><path d=\"M10 10h4v4h-4z\"><\/path><\/symbol>\n    <symbol id=\"id-icon-ram\" viewBox=\"0 0 24 24\"><rect x=\"4\" y=\"8\" width=\"16\" height=\"8\" rx=\"2\"><\/rect><path d=\"M7 16v2M11 16v2M15 16v2M19 16v2M7 11h1M11 11h1M15 11h1\"><\/path><\/symbol>\n    <symbol id=\"id-icon-storage\" viewBox=\"0 0 24 24\"><rect x=\"6\" y=\"3\" width=\"12\" height=\"18\" rx=\"2\"><\/rect><path d=\"M9 7h6\"><\/path><circle cx=\"12\" cy=\"16\" r=\"1.5\"><\/circle><\/symbol>\n    <symbol id=\"id-icon-network\" viewBox=\"0 0 24 24\"><path d=\"M5 12.5a10 10 0 0 1 14 0\"><\/path><path d=\"M8.5 16a5 5 0 0 1 7 0\"><\/path><path d=\"M12 19h.01\"><\/path><\/symbol>\n    <symbol id=\"id-icon-gift\" viewBox=\"0 0 24 24\"><rect x=\"3\" y=\"8\" width=\"18\" height=\"13\" rx=\"2\"><\/rect><path d=\"M12 8v13M3 12h18\"><\/path><path d=\"M7.5 8C6.1 8 5 6.9 5 5.5S6.1 3 7.5 3C10 3 12 8 12 8\"><\/path><path d=\"M16.5 8C17.9 8 19 6.9 19 5.5S17.9 3 16.5 3C14 3 12 8 12 8\"><\/path><\/symbol>\n  <\/svg>\n\n  <button class=\"interdata-carousel-arrow interdata-carousel-prev\" type=\"button\" aria-label=\"Xem 3 g\u00f3i tr\u01b0\u1edbc\" onclick=\"var r=this.closest('[data-interdata-carousel]');if(!r)return false;var t=r.querySelector('.interdata-plan-track'),c=t?t.querySelectorAll('.interdata-plan-card'):[];if(!t||!c.length)return false;var v=window.matchMedia('(max-width:480px)').matches?1:(window.matchMedia('(max-width:800px)').matches?2:3),m=Math.max(0,c.length-Math.min(v,c.length||1)),s=[],i=0;while(i&lt;m){s.push(i);i+=v}if(!s.length||s[s.length-1]!==m)s.push(m);var p=parseInt(r.getAttribute('data-inline-page')||'0',10);p=(p-1+s.length)%s.length;r.setAttribute('data-inline-page',p);var g=parseFloat(window.getComputedStyle(t).gap)||12,w=c[0].getBoundingClientRect().width;t.style.transition='transform .45s ease';t.style.transform='translate3d('+(-(w+g)*s[p])+'px,0,0)';return false;\">\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M15 18l-6-6 6-6\"><\/path><\/svg>\n    <span class=\"interdata-carousel-mark\" aria-hidden=\"true\">&#8249;<\/span>\n  <\/button>\n\n  <div class=\"interdata-plan-viewport\">\n    <div class=\"interdata-plan-track\">\n      <!-- 7 card d\u1ef1 ph\u00f2ng: JavaScript s\u1ebd \u0111\u1ed3ng b\u1ed9 l\u1ea1i t\u1eeb API portal khi trang t\u1ea3i. -->\n      <article class=\"interdata-plan-card\" data-plan-pid=\"490\">\n        <h3 class=\"interdata-plan-title\">Premium Base<\/h3>\n        <div class=\"interdata-plan-price\">299.000 \u0111<span>\/3 th\u00e1ng<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>2 vCore Intel Xeon Scalable<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>2 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-value-plans-2026\/best-value-plans-premium-base\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"529\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 1<\/h3>\n        <div class=\"interdata-plan-price\">998.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>2 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>3 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-1\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"530\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 2<\/h3>\n        <div class=\"interdata-plan-price\">2.666.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>5 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>8 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>70 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-2\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"531\">\n        <h3 class=\"interdata-plan-title\">INTER PLATINUM 3<\/h3>\n        <div class=\"interdata-plan-price\">5.888.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>9 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>16 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>140 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/inter-platinum-series-2026\/inter-platinum-3\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"521\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 1<\/h3>\n        <div class=\"interdata-plan-price\">988.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>3 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>3 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>30 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-1\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"522\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 2<\/h3>\n        <div class=\"interdata-plan-price\">2.988.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>4 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>8 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>80 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>300 Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-2\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n\n      <article class=\"interdata-plan-card\" data-plan-pid=\"523\">\n        <h3 class=\"interdata-plan-title\">BD-Cloud 3<\/h3>\n        <div class=\"interdata-plan-price\">5.999.000 \u0111<span>\/n\u0103m<\/span><\/div>\n        <div class=\"interdata-plan-badge\">GIA H\u1ea0N KH\u00d4NG \u0110\u1ed4I GI\u00c1<\/div>\n        <ul class=\"interdata-plan-features\">\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-cpu\"><\/use><\/svg><\/span>8 vCore<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-ram\"><\/use><\/svg><\/span>16 GB RAM<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-storage\"><\/use><\/svg><\/span>140 GB SSD NVMe<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>1 IPv4 Private<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>400 Mbps Network Port<\/li>\n          <li><span class=\"interdata-plan-icon\"><svg><use href=\"#id-icon-network\"><\/use><\/svg><\/span>Unlimited Bandwidth<\/li>\n        <\/ul>\n\n        <a class=\"interdata-plan-button\" href=\"https:\/\/support.interdata.vn\/index.php?rp=\/store\/best-plan-real-cloud\/bd-cloud-3\" target=\"_blank\" rel=\"noopener\">\u0110\u0103ng k\u00fd ngay<\/a>\n      <\/article>\n    <\/div>\n  <\/div>\n\n  <button class=\"interdata-carousel-arrow interdata-carousel-next\" type=\"button\" aria-label=\"Xem 3 g\u00f3i ti\u1ebfp theo\" onclick=\"var r=this.closest('[data-interdata-carousel]');if(!r)return false;var t=r.querySelector('.interdata-plan-track'),c=t?t.querySelectorAll('.interdata-plan-card'):[];if(!t||!c.length)return false;var v=window.matchMedia('(max-width:480px)').matches?1:(window.matchMedia('(max-width:800px)').matches?2:3),m=Math.max(0,c.length-Math.min(v,c.length||1)),s=[],i=0;while(i&lt;m){s.push(i);i+=v}if(!s.length||s[s.length-1]!==m)s.push(m);var p=parseInt(r.getAttribute('data-inline-page')||'0',10);p=(p+1)%s.length;r.setAttribute('data-inline-page',p);var g=parseFloat(window.getComputedStyle(t).gap)||12,w=c[0].getBoundingClientRect().width;t.style.transition='transform .45s ease';t.style.transform='translate3d('+(-(w+g)*s[p])+'px,0,0)';return false;\">\n    <svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M9 18l6-6-6-6\"><\/path><\/svg>\n    <span class=\"interdata-carousel-mark\" aria-hidden=\"true\">&#8250;<\/span>\n  <\/button>\n<\/div>\n\n<script>\n(function(){\n  var API_GROUPS=[\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=89&module',pids:[490]},\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=100&module',pids:[529,530,531]},\n    {url:'https:\/\/support.interdata.vn\/packages.php?gid=97&module',pids:[521,522,523]}\n  ];\n  var PLAN_CYCLES={\n    490:{key:'quarterly',label:'3 th\u00e1ng'},\n    529:{key:'annually',label:'n\u0103m'},\n    530:{key:'annually',label:'n\u0103m'},\n    531:{key:'annually',label:'n\u0103m'},\n    521:{key:'annually',label:'n\u0103m'},\n    522:{key:'annually',label:'n\u0103m'},\n    523:{key:'annually',label:'n\u0103m'}\n  };\n\n  function fetchPlanData(){\n    if(window.interdataPlanApiPromise)return window.interdataPlanApiPromise;\n\n    window.interdataPlanApiPromise=Promise.all(API_GROUPS.map(function(group){\n      return fetch(group.url,{method:'GET',mode:'cors',cache:'no-store'})\n        .then(function(response){\n          if(!response.ok)throw new Error('API '+response.status);\n          return response.json();\n        })\n        .then(function(data){\n          if(!data||data.success!==true||!Array.isArray(data.products))return [];\n          return data.products.filter(function(product){\n            return group.pids.indexOf(Number(product.pid))!==-1;\n          });\n        })\n        .catch(function(error){\n          console.warn('Kh\u00f4ng th\u1ec3 c\u1eadp nh\u1eadt nh\u00f3m g\u00f3i InterData:',group.url,error);\n          return [];\n        });\n    })).then(function(groups){\n      return groups.reduce(function(all,products){return all.concat(products);},[]);\n    });\n\n    return window.interdataPlanApiPromise;\n  }\n\n  function parseDescription(html){\n    var source=String(html||'')\n      .replace(\/<brs*\/?>\/gi,'n')\n      .replace(\/<\/(p|div|li)>\/gi,'n');\n    var holder=document.createElement('div');\n    holder.innerHTML=source;\n    var strong=holder.querySelector('strong');\n    var badge=strong?strong.textContent.trim():'';\n    var lines=(holder.textContent||'').split(\/r?n\/).map(function(line){\n      return line.trim();\n    }).filter(Boolean);\n    if(badge&&lines[0]===badge)lines.shift();\n    return {badge:badge,features:lines};\n  }\n\n  function iconForFeature(feature){\n    if(\/ram\/i.test(feature))return 'id-icon-ram';\n    if(\/ssd|nvme|storage|disk\/i.test(feature))return 'id-icon-storage';\n    if(\/vcore|vcpu|cpu|xeon|amd\/i.test(feature))return 'id-icon-cpu';\n    if(\/ipv4|network|mbps|gbps|bandwidth\/i.test(feature))return 'id-icon-network';\n    return 'id-icon-gift';\n  }\n\n  function createFeatureItem(feature){\n    var item=document.createElement('li');\n    var icon=document.createElement('span');\n    var svg=document.createElementNS('http:\/\/www.w3.org\/2000\/svg','svg');\n    var use=document.createElementNS('http:\/\/www.w3.org\/2000\/svg','use');\n    icon.className='interdata-plan-icon';\n    use.setAttribute('href','#'+iconForFeature(feature));\n    svg.appendChild(use);\n    icon.appendChild(svg);\n    item.appendChild(icon);\n    item.appendChild(document.createTextNode(feature));\n    return item;\n  }\n\n  function updateCardFromApi(root,product){\n    var pid=Number(product.pid);\n    var cycle=PLAN_CYCLES[pid];\n    var card=root.querySelector('[data-plan-pid=\"'+pid+'\"]');\n    if(!card||!cycle)return;\n\n    var title=card.querySelector('.interdata-plan-title');\n    var priceBox=card.querySelector('.interdata-plan-price');\n    var badgeBox=card.querySelector('.interdata-plan-badge');\n    var featureList=card.querySelector('.interdata-plan-features');\n    var button=card.querySelector('.interdata-plan-button');\n    var description=parseDescription(product.description);\n    var pricing=product.pricing&&product.pricing.VND;\n    var price=pricing?Number(pricing[cycle.key]):-1;\n\n    if(title&&product.name)title.textContent=product.name;\n    if(priceBox&&Number.isFinite(price)&&price>=0){\n      priceBox.textContent=Math.round(price).toLocaleString('vi-VN')+' \u0111';\n      var suffix=document.createElement('span');\n      suffix.textContent='\/'+cycle.label;\n      priceBox.appendChild(suffix);\n    }\n    if(badgeBox&&description.badge)badgeBox.textContent=description.badge;\n    if(featureList&&description.features.length){\n      featureList.textContent='';\n      description.features.forEach(function(feature){\n        featureList.appendChild(createFeatureItem(feature));\n      });\n    }\n    if(button&&product.product_url)button.href=product.product_url;\n  }\n\n  function setupInterDataCarousel(root){\n    var track=root.querySelector('.interdata-plan-track');\n    var prev=root.querySelector('.interdata-carousel-prev');\n    var next=root.querySelector('.interdata-carousel-next');\n    if(!track||!prev||!next||track.dataset.ready==='1')return;\n    track.dataset.ready='1';\n    prev.disabled=false;\n    next.disabled=false;\n    var activePage=0;\n    var touchStartX=null;\n\n    function visibleCards(){\n      if(window.matchMedia&&window.matchMedia('(max-width:480px)').matches)return 1;\n      if(window.matchMedia&&window.matchMedia('(max-width:800px)').matches)return 2;\n      return 3;\n    }\n\n    function pageStarts(){\n      var total=track.querySelectorAll('.interdata-plan-card').length;\n      var visible=Math.min(visibleCards(),total||1);\n      var maxStart=Math.max(0,total-visible);\n      var starts=[];\n      var start=0;\n      while(start<maxStart){\n        starts.push(start);\n        start+=visible;\n      }\n      if(!starts.length||starts[starts.length-1]!==maxStart)starts.push(maxStart);\n      return starts;\n    }\n\n    function renderSlide(animate){\n      var cards=track.querySelectorAll('.interdata-plan-card');\n      var starts=pageStarts();\n      if(!cards.length||!starts.length)return;\n      if(activePage>=starts.length)activePage=starts.length-1;\n      if(activePage<0)activePage=0;\n\n      var cardWidth=cards[0].getBoundingClientRect().width;\n      var trackStyle=window.getComputedStyle?window.getComputedStyle(track):null;\n      var gap=trackStyle?parseFloat(trackStyle.columnGap||trackStyle.gap):12;\n      if(!Number.isFinite(gap))gap=12;\n      if(cardWidth<=0)return;\n\n      track.style.transition=animate?'transform .45s ease':'none';\n      track.style.transform='translate3d('+(-(cardWidth+gap)*starts[activePage])+'px,0,0)';\n      prev.setAttribute('aria-disabled',starts.length>1?'false':'true');\n      next.setAttribute('aria-disabled',starts.length>1?'false':'true');\n    }\n\n    function move(direction){\n      var starts=pageStarts();\n      if(starts.length<=1)return;\n      activePage=parseInt(root.getAttribute('data-inline-page')||activePage,10)||0;\n      activePage=(activePage+direction+starts.length)%starts.length;\n      root.setAttribute('data-inline-page',activePage);\n      renderSlide(true);\n    }\n\n    track.addEventListener('touchstart',function(event){\n      touchStartX=event.touches&&event.touches[0]?event.touches[0].clientX:null;\n    },{passive:true});\n    track.addEventListener('touchend',function(event){\n      if(touchStartX===null)return;\n      var endX=event.changedTouches&&event.changedTouches[0]?event.changedTouches[0].clientX:touchStartX;\n      var distance=endX-touchStartX;\n      touchStartX=null;\n      if(Math.abs(distance)>=40)move(distance<0?1:-1);\n    },{passive:true});\n\n    function resetAfterResize(){\n      activePage=0;\n      root.setAttribute('data-inline-page','0');\n      renderSlide(false);\n    }\n\n    window.addEventListener('resize',resetAfterResize);\n    window.addEventListener('load',resetAfterResize);\n    if('ResizeObserver' in window){\n      var resizeObserver=new ResizeObserver(function(){renderSlide(false);});\n      resizeObserver.observe(root);\n    }\n    window.requestAnimationFrame(function(){renderSlide(false);});\n    window.setTimeout(function(){renderSlide(false);},250);\n    window.setTimeout(function(){renderSlide(false);},1000);\n\n    fetchPlanData().then(function(products){\n      products.forEach(function(product){updateCardFromApi(root,product);});\n      renderSlide(false);\n    });\n  }\n\n  function initInterDataCarousels(){\n    document.querySelectorAll('[data-interdata-carousel]').forEach(setupInterDataCarousel);\n  }\n\n  if(document.readyState==='loading'){\n    document.addEventListener('DOMContentLoaded',initInterDataCarousels);\n  }else{\n    initInterDataCarousels();\n  }\n\n  if('MutationObserver' in window){\n    var initQueued=false;\n    new MutationObserver(function(){\n      if(initQueued)return;\n      initQueued=true;\n      window.requestAnimationFrame(function(){\n        initQueued=false;\n        initInterDataCarousels();\n      });\n    }).observe(document.documentElement,{childList:true,subtree:true});\n  }\n})();\n<\/script>\n\n\t<div id=\"gap-1456254871\" class=\"gap-element clearfix\" style=\"display:block; height:auto;\">\n\t\t\n<style>\n#gap-1456254871 {\n  padding-top: 15px;\n}\n<\/style>\n\t<\/div>\n\t\n<p><!-- ===== SECTION 1 ===== --><\/p>\n<h2 id=\"section1\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">D\u1ea5u hi\u1ec7u nh\u1eadn bi\u1ebft VPS \u0111\u00e3 b\u1ecb nhi\u1ec5m rootkit ustar v\u00e0 cryptominer<\/h2>\n<p style=\"text-align: justify;\">N\u1ebfu VPS Ubuntu c\u1ee7a b\u1ea1n c\u00f3 CPU cao li\u00ean t\u1ee5c m\u00e0 kh\u00f4ng r\u00f5 \u1ee9ng d\u1ee5ng n\u00e0o g\u00e2y ra, \u0111\u1ed3ng th\u1eddi xu\u1ea5t hi\u1ec7n nhi\u1ec1u k\u1ebft n\u1ed1i TCP outbound t\u1edbi IP l\u1ea1 (c\u1ed5ng 443, 3333 ho\u1eb7c 9100) nh\u01b0ng <code>ss -tnp<\/code> l\u1ea1i hi\u1ec7n c\u1ed9t Process tr\u1ed1ng d\u00f9 \u0111ang ch\u1ea1y quy\u1ec1n root \u2014 \u0111\u00f3 l\u00e0 d\u1ea5u hi\u1ec7u r\u1ea5t m\u1ea1nh c\u1ee7a rootkit \u1ea9n ti\u1ebfn tr\u00ecnh. Vi\u1ec7c \u0111\u1ea7u ti\u00ean c\u1ea7n l\u00e0m l\u00e0 ki\u1ec3m tra file <code>\/etc\/ld.so.preload<\/code>.<\/p>\n<div style=\"background-color: #fef2f2; border: 1.5px solid #FCA5A5; border-radius: 10px; padding: 18px 20px; margin: 20px 0;\">\n<p style=\"font-weight: bold; color: #991b1b; margin: 0 0 8px;\">\u26a0 C\u1ea3nh b\u00e1o quan tr\u1ecdng<\/p>\n<p style=\"margin: 0; color: #7f1d1d;\">\u0110\u1eebng k\u1ebft lu\u1eadn &#8220;server s\u1ea1ch&#8221; ch\u1ec9 v\u00ec <code>ps aux<\/code> hay <code>ss -tnp<\/code> kh\u00f4ng hi\u1ec7n ti\u1ebfn tr\u00ecnh l\u1ea1. N\u1ebfu rootkit LD_PRELOAD \u0111ang ho\u1ea1t \u0111\u1ed9ng, ch\u00ednh c\u00e1c l\u1ec7nh li\u1ec7t k\u00ea n\u00e0y b\u1ecb \u0111\u00e1nh l\u1eeba \u2014 ch\u00fang g\u1ecdi <code>readdir()<\/code> \u0111\u1ec3 duy\u1ec7t <code>\/proc<\/code>, v\u00e0 h\u00e0m <code>readdir()<\/code> \u0111\u00e3 b\u1ecb hook \u0111\u1ec3 \u1ea9n PID c\u1ee7a miner. M\u00e1y n\u00f3ng, CPU cao, nh\u01b0ng &#8220;tr\u00f4ng s\u1ea1ch&#8221; l\u00e0 tri\u1ec7u ch\u1ee9ng kinh \u0111i\u1ec3n, kh\u00f4ng ph\u1ea3i b\u1eb1ng ch\u1ee9ng an to\u00e0n.<\/p>\n<\/div>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u1ea3ng tri\u1ec7u ch\u1ee9ng &#8211; \u00fd ngh\u0129a &#8211; h\u00e0nh \u0111\u1ed9ng<\/h3>\n<table style=\"width: 100%; border-collapse: collapse; margin: 20px 0; font-size: 14px;\">\n<thead>\n<tr style=\"background-color: #1e3a8a; color: #fff;\">\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">Tri\u1ec7u ch\u1ee9ng<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">\u00dd ngh\u0129a<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">H\u00e0nh \u0111\u1ed9ng<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">CPU 80\u2013100% li\u00ean t\u1ee5c, kh\u00f4ng r\u00f5 \u1ee9ng d\u1ee5ng n\u00e0o<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00f3 ti\u1ebfn tr\u00ecnh ng\u1ea7m chi\u1ebfm t\u00e0i nguy\u00ean (th\u01b0\u1eddng l\u00e0 miner)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ki\u1ec3m tra <code>\/etc\/ld.so.preload<\/code> ngay \u2192 B\u01b0\u1edbc 2<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>ss -tnp<\/code> c\u00f3 k\u1ebft n\u1ed1i outbound nh\u01b0ng c\u1ed9t Process tr\u1ed1ng (d\u00f9 \u0111ang root)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">PID ti\u1ebfn tr\u00ecnh \u0111ang b\u1ecb rootkit \u1ea9n kh\u1ecfi <code>\/proc<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">X\u00e1c nh\u1eadn rootkit LD_PRELOAD \u2192 B\u01b0\u1edbc 2, 3<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>ps aux<\/code> &#8220;tr\u00f4ng s\u1ea1ch&#8221; nh\u01b0ng m\u00e1y v\u1eabn n\u00f3ng\/ch\u1eadm<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>ps<\/code> b\u1ecb hook \u2014 kh\u00f4ng tin \u0111\u01b0\u1ee3c<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">G\u1ee1 <code>ld.so.preload<\/code> r\u1ed3i ch\u1ea1y l\u1ea1i <code>ps<\/code> \u2192 B\u01b0\u1edbc 3<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">K\u1ebft n\u1ed1i ra c\u1ed5ng 3333, 9100 ho\u1eb7c \u0111\u1ecba ch\u1ec9 <code>.onion<\/code><\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Mining pool (Monero th\u01b0\u1eddng d\u00f9ng c\u1ed5ng 3333) ho\u1eb7c k\u1ebft n\u1ed1i qua Tor<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00f4 l\u1eadp \u2192 di\u1ec7t \u2192 B\u01b0\u1edbc 4, 5, checklist kh\u1eafc ph\u1ee5c<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">File <code>\/etc\/ld.so.preload<\/code> ch\u1ee9a \u0111\u01b0\u1eddng d\u1eabn l\u1ea1<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">G\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn b\u1ecb c\u00e0i rootkit userland<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ph\u00e2n t\u00edch lib \u2192 g\u1ee1 preload \u2192 l\u1ed9 PID \u2192 B\u01b0\u1edbc 2, 3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: justify;\">N\u1ebfu b\u1ea1n ch\u01b0a quen v\u1edbi c\u00e1c l\u1ec7nh ki\u1ec3m tra tr\u00ean terminal, h\u00e3y tham kh\u1ea3o <a href=\"https:\/\/interdata.vn\/blog\/cac-cau-lenh-co-ban-trong-linux\/\">c\u00e1c c\u00e2u l\u1ec7nh c\u01a1 b\u1ea3n trong Linux<\/a> tr\u01b0\u1edbc khi b\u1eaft \u0111\u1ea7u. C\u00e1c l\u1ec7nh trong b\u00e0i \u0111\u1ec1u ch\u1ea1y tr\u00ean Ubuntu\/Debian; tr\u00ean CentOS\/RHEL logic t\u01b0\u01a1ng t\u1ef1 nh\u01b0ng \u0111\u01b0\u1eddng d\u1eabn log c\u00f3 th\u1ec3 kh\u00e1c.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43187\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/dau-hieu-nhan-biet-VPS-da-bi-nhiem-rootkit-ustar-va-cryptominer.jpg\" alt=\"d\u1ea5u hi\u1ec7u nh\u1eadn bi\u1ebft VPS \u0111\u00e3 b\u1ecb nhi\u1ec5m rootkit ustar v\u00e0 cryptominer\" width=\"700\" height=\"350\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/dau-hieu-nhan-biet-VPS-da-bi-nhiem-rootkit-ustar-va-cryptominer.jpg 1200w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/dau-hieu-nhan-biet-VPS-da-bi-nhiem-rootkit-ustar-va-cryptominer-300x150.jpg 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/dau-hieu-nhan-biet-VPS-da-bi-nhiem-rootkit-ustar-va-cryptominer-1024x512.jpg 1024w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/dau-hieu-nhan-biet-VPS-da-bi-nhiem-rootkit-ustar-va-cryptominer-768x384.jpg 768w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><!-- ===== SECTION 2 ===== --><\/p>\n<h2 id=\"section2\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">Rootkit ustar v\u00e0 miner Monero qua Tor ho\u1ea1t \u0111\u1ed9ng ra sao?<\/h2>\n<p style=\"text-align: justify;\">\u0110\u1ec3 ki\u1ec3m tra &amp; lo\u1ea1i b\u1ecf rootkit ustar, b\u1ea1n c\u1ea7n hi\u1ec3u chu\u1ed7i t\u1ea5n c\u00f4ng c\u1ee7a n\u00f3. D\u01b0\u1edbi \u0111\u00e2y l\u00e0 quy tr\u00ecnh ho\u1ea1t \u0111\u1ed9ng \u0111\u00e3 \u0111\u01b0\u1ee3c quan s\u00e1t tr\u00ean m\u1ed9t ca x\u1eed l\u00fd th\u1eadt (VPS Ubuntu 24.04). C\u00e1c bi\u1ebfn th\u1ec3 kh\u00e1c c\u00f3 th\u1ec3 d\u00f9ng t\u00ean file, port, IP kh\u00e1c \u2014 nh\u01b0ng c\u01a1 ch\u1ebf c\u1ed1t l\u00f5i gi\u1ed1ng nhau.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">Chu\u1ed7i t\u1ea5n c\u00f4ng theo giai \u0111o\u1ea1n<\/h3>\n<ol style=\"line-height: 1.8; margin: 15px 0;\">\n<li><strong>X\u00e2m nh\u1eadp ban \u0111\u1ea7u \u2014 SSH brute-force:<\/strong> K\u1ebb t\u1ea5n c\u00f4ng d\u00f2 m\u1eadt kh\u1ea9u root qua <a href=\"https:\/\/interdata.vn\/blog\/ssh-la-gi\/\">SSH<\/a> (CWE-521 \u2014 m\u1eadt kh\u1ea9u y\u1ebfu). H\u00e0ng ch\u1ee5c ngh\u00ecn l\u1ea7n th\u1eed t\u1eeb nhi\u1ec1u IP, cu\u1ed1i c\u00f9ng \u0111o\u00e1n \u0111\u00fang v\u00e0 \u0111\u0103ng nh\u1eadp th\u00e0nh c\u00f4ng. \u0110\u00e2y l\u00e0 h\u00ecnh th\u1ee9c <a href=\"https:\/\/interdata.vn\/blog\/tan-cong-brute-force-la-gi\/\">t\u1ea5n c\u00f4ng brute force<\/a> ph\u1ed5 bi\u1ebfn nh\u1ea5t tr\u00ean VPS m\u1edf SSH m\u1eb7c \u0111\u1ecbnh.<\/li>\n<li><strong>C\u00e0i persistence \u2014 systemd unit:<\/strong> T\u1ea1o service <code>ustar.service<\/code> v\u1edbi <code>Restart=always<\/code>, \u0111\u1ea3m b\u1ea3o miner t\u1ef1 kh\u1edfi \u0111\u1ed9ng l\u1ea1i n\u1ebfu b\u1ecb kill ho\u1eb7c server reboot. Service n\u00e0y g\u1ecdi dropper \u0111\u1ec3 t\u1ea3i l\u1ea1i binary m\u1ed7i khi ch\u1ea1y.<\/li>\n<li><strong>T\u1ea3i dropper gi\u1ea3 \u1ea3nh:<\/strong> Dropper d\u00f9ng <code>wget<\/code> t\u1ea3i file t\u1eeb C2 server (v\u00ed d\u1ee5 \u0111\u00e3 quan s\u00e1t: <code>75.102.23.196<\/code> tr\u00ean c\u00e1c c\u1ed5ng kh\u00e1c nhau), file \u0111\u1eb7t t\u00ean gi\u1ea3 d\u1ea1ng \u1ea3nh PNG (<code>8no.png<\/code>, <code>k32.png<\/code>\u2026). File th\u1ef1c ch\u1ea5t ch\u1ee9a 2 payload gh\u00e9p n\u1ed1i, t\u00e1ch ra b\u1eb1ng byte offset.<\/li>\n<li><strong>Payload A \u2014 rootkit LD_PRELOAD (~9\u201310 KB):<\/strong> M\u1ed9t shared library nh\u1ecf hook h\u00e0m <code>readdir64()<\/code> b\u1eb1ng <code>dlsym()<\/code>. Khi \u0111\u01b0\u1ee3c ghi v\u00e0o <code>\/etc\/ld.so.preload<\/code>, n\u00f3 t\u1ef1 \u0111\u1ed9ng load v\u00e0o m\u1ecdi ti\u1ebfn tr\u00ecnh m\u1edbi tr\u00ean h\u1ec7 th\u1ed1ng. M\u1ecdi l\u1ec7nh d\u00f9ng <code>readdir()<\/code> \u0111\u1ec3 duy\u1ec7t th\u01b0 m\u1ee5c \u2014 bao g\u1ed3m <code>ps<\/code>, <code>ls<\/code>, <code>find<\/code>, <code>top<\/code> \u2014 \u0111\u1ec1u b\u1ecb ch\u1eb7n, kh\u00f4ng th\u1ea5y PID v\u00e0 file c\u1ee7a miner.<\/li>\n<li><strong>Payload B \u2014 cryptominer Monero (~30 MB):<\/strong> Binary XMRig-class \u0111\u00e0o Monero (XMR), k\u1ebft n\u1ed1i mining pool qua d\u1ecbch v\u1ee5 \u1ea9n Tor (<code>.onion:3333<\/code>). File \u0111\u1eb7t t\u1ea1i <code>\/.ustarN<\/code> (N t\u0103ng d\u1ea7n m\u1ed7i l\u1ea7n t\u1ea3i l\u1ea1i: <code>\/.ustar0<\/code>, <code>\/.ustar1<\/code>\u2026). Cache Tor xu\u1ea5t hi\u1ec7n d\u01b0\u1edbi <code>\/tmp\/.&lt;hash&gt;\/<\/code> ch\u1ee9a <code>guards.json<\/code>, <code>circuit_timeouts.json<\/code>, <code>dir.sqlite3<\/code>.<\/li>\n<\/ol>\n<p style=\"text-align: justify;\"><strong>V\u00ec sao \u0111\u00e0o Monero qua Tor?<\/strong> Monero s\u1eed d\u1ee5ng thu\u1eadt to\u00e1n RandomX \u01b0u ti\u00ean CPU (kh\u00f4ng c\u1ea7n GPU), ph\u00f9 h\u1ee3p t\u00e0i nguy\u00ean VPS. Giao d\u1ecbch Monero m\u1eb7c \u0111\u1ecbnh \u1ea9n danh. K\u1ebft n\u1ed1i pool qua Tor (<code>.onion<\/code>) khi\u1ebfn traffic kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c rule firewall d\u1ef1a tr\u00ean IP \u2014 v\u00ec traffic \u0111i qua m\u1ea1ng Tor relay, kh\u00f4ng k\u1ebft n\u1ed1i th\u1eb3ng t\u1edbi pool.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43188\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/Nguyen-ly-hoat-dong-cua-Rootkit-ustar-va-miner-Monero-qua-Tor.jpg\" alt=\"Nguy\u00ean l\u00fd ho\u1ea1t \u0111\u1ed9ng c\u1ee7a Rootkit ustar v\u00e0 miner Monero qua Tor\" width=\"700\" height=\"350\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/Nguyen-ly-hoat-dong-cua-Rootkit-ustar-va-miner-Monero-qua-Tor.jpg 1200w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/Nguyen-ly-hoat-dong-cua-Rootkit-ustar-va-miner-Monero-qua-Tor-300x150.jpg 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/Nguyen-ly-hoat-dong-cua-Rootkit-ustar-va-miner-Monero-qua-Tor-1024x512.jpg 1024w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/Nguyen-ly-hoat-dong-cua-Rootkit-ustar-va-miner-Monero-qua-Tor-768x384.jpg 768w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">V\u00ec sao <code>ps<\/code> v\u00e0 <code>ss<\/code> b\u1ecb \u0111\u00e1nh l\u1eeba?<\/h3>\n<p style=\"text-align: justify;\">File <code>\/etc\/ld.so.preload<\/code> l\u00e0 c\u01a1 ch\u1ebf h\u1ee3p l\u1ec7 c\u1ee7a Linux dynamic linker (<code>ld.so<\/code>): m\u1ecdi shared library \u0111\u01b0\u1ee3c li\u1ec7t k\u00ea trong file n\u00e0y s\u1ebd \u0111\u01b0\u1ee3c load tr\u01b0\u1edbc t\u1ea5t c\u1ea3 th\u01b0 vi\u1ec7n kh\u00e1c khi m\u1ed9t ch\u01b0\u01a1ng tr\u00ecnh ELF kh\u1edfi ch\u1ea1y. Rootkit l\u1ee3i d\u1ee5ng \u0111i\u1ec1u n\u00e0y \u0111\u1ec3 chen v\u00e0o m\u1ed9t lib hook <code>readdir64()<\/code> \u2014 h\u00e0m m\u00e0 <code>ps<\/code>, <code>ls<\/code>, <code>find<\/code> d\u00f9ng \u0111\u1ec3 li\u1ec7t k\u00ea n\u1ed9i dung th\u01b0 m\u1ee5c <code>\/proc<\/code>. Hook n\u00e0y l\u1ecdc b\u1ecf entry c\u1ee7a PID miner, n\u00ean <code>ps<\/code> kh\u00f4ng bao gi\u1edd &#8220;th\u1ea5y&#8221; ti\u1ebfn tr\u00ecnh \u0111\u00f3.<\/p>\n<p style=\"text-align: justify;\">Tuy nhi\u00ean, c\u00e1c l\u1ec7nh nh\u01b0 <code>stat<\/code>, <code>file<\/code>, <code>cat<\/code>, <code>kill -0<\/code> g\u1ecdi syscall tr\u1ef1c ti\u1ebfp (kh\u00f4ng d\u00f9ng <code>readdir()<\/code>) n\u00ean kh\u00f4ng b\u1ecb hook. \u0110\u00e2y ch\u00ednh l\u00e0 c\u00e1ch \u0111\u1ec3 bypass rootkit v\u00e0 l\u1ed9 ti\u1ebfn tr\u00ecnh \u1ea9n \u2014 s\u1ebd tr\u00ecnh b\u00e0y chi ti\u1ebft \u1edf B\u01b0\u1edbc 3.<\/p>\n<p><!-- BOX CTA #1 \u2014 VPS --><\/p>\n<div style=\"display: flex; flex-wrap: wrap; background-color: #fff; border: 1.5px solid #BFDBFE; box-shadow: 0 8px 20px rgba(37,99,235,0.08); border-radius: 12px; overflow: hidden; margin: 35px 0;\">\n<div style=\"flex: 1; min-width: 250px; background: linear-gradient(135deg, #1E3A8A 0%, #2563EB 100%); display: flex; align-items: center; justify-content: center; padding: 30px; text-align: center;\">\n<div>\n<p style=\"color: #fff; font-size: 34px; font-family: 'Be Vietnam Pro', sans-serif; font-weight: bold; margin: 0; line-height: 1.1;\">Thu\u00ea VPS InterData<\/p>\n<p style=\"color: #dbeafe; font-size: 15px; font-weight: 600; margin-top: 12px;\">Template Ubuntu chu\u1ea9n \u00b7 To\u00e0n quy\u1ec1n root \u00b7 H\u1ed7 tr\u1ee3 k\u1ef9 thu\u1eadt 24\/7<\/p>\n<\/div>\n<\/div>\n<div style=\"flex: 2; padding: 25px; min-width: 300px;\">\n<h3 style=\"font-family: 'Be Vietnam Pro', sans-serif; color: #1e3a8a; margin-top: 0; font-size: 20px;\">Server \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n root? C\u00e2n nh\u1eafc d\u1ef1ng l\u1ea1i s\u1ea1ch.<\/h3>\n<p style=\"text-align: justify; font-size: 15px; margin-bottom: 15px;\">Khi rootkit \u0111\u00e3 chi\u1ebfm t\u1edbi quy\u1ec1n root v\u00e0 c\u00e0i persistence v\u00e0o systemd, c\u00e1ch an to\u00e0n nh\u1ea5t v\u1ec1 l\u00e2u d\u00e0i th\u01b0\u1eddng l\u00e0 d\u1ef1ng l\u1ea1i m\u00f4i tr\u01b0\u1eddng s\u1ea1ch r\u1ed3i gia c\u1ed1 SSH, firewall, Fail2ban ngay t\u1eeb \u0111\u1ea7u. <a href=\"https:\/\/interdata.vn\/blog\/vps-la-gi\/\">VPS<\/a> InterData cung c\u1ea5p template Ubuntu chu\u1ea9n, to\u00e0n quy\u1ec1n root \u0111\u1ec3 b\u1ea1n t\u1ef1 c\u1ea5u h\u00ecnh b\u1ea3o m\u1eadt, k\u00e8m \u0111\u1ed9i h\u1ed7 tr\u1ee3 k\u1ef9 thu\u1eadt 24\/7 s\u1eb5n s\u00e0ng h\u1ed7 tr\u1ee3 khi g\u1eb7p s\u1ef1 c\u1ed1.<\/p>\n<p><a style=\"background: linear-gradient(90deg, #2563EB 0%, #1E3A8A 100%); color: #fff; padding: 12px 25px; text-decoration: none; font-weight: 600; border-radius: 8px; font-size: 15px; display: inline-block; box-shadow: 0 5px 15px rgba(37,99,235,0.3);\" href=\"https:\/\/interdata.vn\/thue-vps\/\" target=\"_blank\" rel=\"noopener\">Xem B\u1ea3ng Gi\u00e1 Thu\u00ea VPS \u27f6<\/a><\/p>\n<\/div>\n<\/div>\n<p><!-- ===== SECTION 3 ===== --><\/p>\n<h2 id=\"section3\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">Quy tr\u00ecnh ki\u1ec3m tra &amp; lo\u1ea1i b\u1ecf rootkit ustar t\u1eebng b\u01b0\u1edbc<\/h2>\n<p style=\"text-align: justify;\">Th\u1ef1c hi\u1ec7n c\u00e1c b\u01b0\u1edbc theo \u0111\u00fang th\u1ee9 t\u1ef1 d\u01b0\u1edbi \u0111\u00e2y. M\u1ed7i b\u01b0\u1edbc c\u00f3 l\u1ec7nh copy-paste v\u00e0 ti\u00eau ch\u00ed \u0111\u1ec3 k\u1ebft lu\u1eadn tr\u01b0\u1edbc khi sang b\u01b0\u1edbc ti\u1ebfp. To\u00e0n b\u1ed9 l\u1ec7nh ch\u1ea1y b\u1eb1ng quy\u1ec1n root.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-43190\" src=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/kiem-tra-va-loai-bo-rootkit-ustar.jpg\" alt=\"ki\u1ec3m tra v\u00e0 lo\u1ea1i b\u1ecf rootkit ustar\" width=\"700\" height=\"350\" title=\"\" srcset=\"https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/kiem-tra-va-loai-bo-rootkit-ustar.jpg 1200w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/kiem-tra-va-loai-bo-rootkit-ustar-300x150.jpg 300w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/kiem-tra-va-loai-bo-rootkit-ustar-1024x512.jpg 1024w, https:\/\/interdata.vn\/blog\/wp-content\/uploads\/2026\/08\/kiem-tra-va-loai-bo-rootkit-ustar-768x384.jpg 768w\" sizes=\"auto, (max-width: 700px) 100vw, 700px\" \/><\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u01b0\u1edbc 1: Kh\u1ea3o s\u00e1t nhanh<\/h3>\n<p style=\"text-align: justify;\">Thu th\u1eadp th\u00f4ng tin h\u1ec7 th\u1ed1ng, ki\u1ec3m tra k\u1ebft n\u1ed1i m\u1ea1ng v\u00e0 ti\u1ebfn tr\u00ecnh \u0111ang ng\u1ed1n CPU:<\/p>\n<pre><code>uname -a; cat \/etc\/os-release\r\nss -tnp state established        # \u0111\u1ec3 \u00fd IP l\u1ea1, c\u1ed5ng 3333\/9100, c\u1ed9t Process tr\u1ed1ng d\u00f9 \u0111ang root\r\nps aux --sort=-%cpu | head -30<\/code><\/pre>\n<p style=\"text-align: justify;\"><strong>\u0110\u1ecdc k\u1ebft qu\u1ea3:<\/strong> N\u1ebfu <code>ss -tnp<\/code> hi\u1ec7n nhi\u1ec1u d\u00f2ng k\u1ebft n\u1ed1i outbound m\u00e0 c\u1ed9t Process tr\u1ed1ng d\u00f9 b\u1ea1n \u0111ang ch\u1ea1y quy\u1ec1n root \u2014 \u0111\u00e2y l\u00e0 d\u1ea5u hi\u1ec7u r\u1ea5t m\u1ea1nh r\u1eb1ng PID ti\u1ebfn tr\u00ecnh \u0111ang b\u1ecb \u1ea9n b\u1edfi rootkit. Sang B\u01b0\u1edbc 2 ngay.<\/p>\n<p style=\"text-align: justify;\">N\u1ebfu <code>ps aux<\/code> hi\u1ec7n ti\u1ebfn tr\u00ecnh l\u1ea1 chi\u1ebfm CPU cao (t\u00ean ch\u1ee9a <code>.onion<\/code>, <code>--url<\/code>, <code>--user<\/code>, <code>--pass<\/code>, ho\u1eb7c n\u1eb1m \u1edf \u0111\u01b0\u1eddng d\u1eabn <code>\/.ustar*<\/code>) th\u00ec rootkit c\u00f3 th\u1ec3 ch\u01b0a \u0111\u01b0\u1ee3c c\u00e0i ho\u1eb7c \u0111\u00e3 b\u1ecb g\u1ee1. V\u1eabn ki\u1ec3m tra <code>ld.so.preload<\/code> \u1edf B\u01b0\u1edbc 2 \u0111\u1ec3 ch\u1eafc ch\u1eafn.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u01b0\u1edbc 2: Ki\u1ec3m tra rootkit LD_PRELOAD<\/h3>\n<p style=\"text-align: justify;\">\u0110\u00e2y l\u00e0 b\u01b0\u1edbc then ch\u1ed1t. File <code>\/etc\/ld.so.preload<\/code> tr\u00ean m\u1ed9t server s\u1ea1ch th\u01b0\u1eddng kh\u00f4ng t\u1ed3n t\u1ea1i ho\u1eb7c r\u1ed7ng.<\/p>\n<pre><code>cat \/etc\/ld.so.preload            # c\u00f3 \u0111\u01b0\u1eddng d\u1eabn l\u1ea1 = g\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn d\u00ednh\r\nls -la \/\u0111\u01b0\u1eddng\/d\u1eabn\/b\u1ecb\/nghi         # n\u1ebfu ls b\u00e1o \"No such file\" nh\u01b0ng path l\u1ea1i n\u1eb1m trong ld.so.preload \u2192 m\u00e2u thu\u1eabn = x\u00e1c nh\u1eadn\r\nfile \/\u0111\u01b0\u1eddng\/d\u1eabn\/b\u1ecb\/nghi           # file\/stat lu\u00f4n \u0111\u1ecdc \u0111\u01b0\u1ee3c (kh\u00f4ng b\u1ecb hook)\r\nstrings -n 8 \/\u0111\u01b0\u1eddng\/d\u1eabn\/b\u1ecb\/nghi | grep -iE 'readdir64|proc\/%s\/stat|dlsym'<\/code><\/pre>\n<p style=\"text-align: justify;\"><strong>L\u01b0u \u00fd:<\/strong> Thay <code>\/\u0111\u01b0\u1eddng\/d\u1eabn\/b\u1ecb\/nghi<\/code> b\u1eb1ng \u0111\u01b0\u1eddng d\u1eabn th\u1ef1c t\u1ebf m\u00e0 <code>cat \/etc\/ld.so.preload<\/code> tr\u1ea3 v\u1ec1. V\u00ed d\u1ee5 \u0111\u00e3 quan s\u00e1t: \u0111\u01b0\u1eddng d\u1eabn tr\u1ecf t\u1edbi m\u1ed9t file <code>.so<\/code> n\u1eb1m \u1edf th\u01b0 m\u1ee5c g\u1ed1c.<\/p>\n<p style=\"text-align: justify;\"><strong>\u0110\u1ecdc k\u1ebft qu\u1ea3:<\/strong><\/p>\n<ul style=\"margin: 10px 0 20px 20px;\">\n<li style=\"margin-bottom: 8px;\"><code>cat \/etc\/ld.so.preload<\/code> tr\u1ea3 v\u1ec1 m\u1ed9t \u0111\u01b0\u1eddng d\u1eabn t\u1edbi file <code>.so<\/code> l\u1ea1 \u2192 g\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn b\u1ecb c\u00e0i rootkit.<\/li>\n<li style=\"margin-bottom: 8px;\"><code>ls -la<\/code> b\u00e1o &#8220;No such file&#8221; trong khi <code>file<\/code> v\u1eabn \u0111\u1ecdc \u0111\u01b0\u1ee3c \u2192 m\u00e2u thu\u1eabn n\u00e0y x\u00e1c nh\u1eadn <code>readdir()<\/code> \u0111\u00e3 b\u1ecb hook (v\u00ec <code>ls<\/code> d\u00f9ng <code>readdir<\/code>, c\u00f2n <code>file<\/code> d\u00f9ng syscall tr\u1ef1c ti\u1ebfp).<\/li>\n<li style=\"margin-bottom: 8px;\"><code>strings<\/code> t\u00ecm th\u1ea5y <code>readdir64<\/code>, <code>dlsym<\/code>, ho\u1eb7c <code>proc\/%s\/stat<\/code> \u2192 x\u00e1c nh\u1eadn \u0111\u00e2y l\u00e0 lib rootkit hook li\u1ec7t k\u00ea th\u01b0 m\u1ee5c.<\/li>\n<\/ul>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u01b0\u1edbc 3: L\u1ed9 ti\u1ebfn tr\u00ecnh \u0111\u00e0o coin b\u1ecb \u1ea9n (bypass rootkit)<\/h3>\n<p style=\"text-align: justify;\">Nguy\u00ean l\u00fd: hook ch\u1ec9 \u1ea3nh h\u01b0\u1edfng ti\u1ebfn tr\u00ecnh m\u1edbi sinh ra sau khi <code>ld.so.preload<\/code> \u0111\u01b0\u1ee3c load. G\u1ee1 file preload, r\u1ed3i ch\u1ea1y l\u1ea1i <code>ps<\/code> \u2014 l\u00fac n\u00e0y <code>ps<\/code> m\u1edbi l\u00e0 ti\u1ebfn tr\u00ecnh &#8220;s\u1ea1ch&#8221;, kh\u00f4ng b\u1ecb hook, s\u1ebd th\u1ea5y m\u1ecdi PID k\u1ec3 c\u1ea3 ti\u1ebfn tr\u00ecnh miner tr\u01b0\u1edbc \u0111\u00f3 b\u1ecb \u1ea9n.<\/p>\n<pre><code>mv \/etc\/ld.so.preload \/root\/ld.so.preload.rootkit.bak   # gi\u1eef l\u00e0m b\u1eb1ng ch\u1ee9ng, kh\u00f4ng x\u00f3a h\u1eb3n\r\nps aux --sort=-%cpu | head -50                          # ti\u1ebfn tr\u00ecnh \u1ea9n l\u1ed9 ra<\/code><\/pre>\n<div style=\"background-color: #fffbeb; border: 1.5px solid #FCD34D; border-radius: 10px; padding: 18px 20px; margin: 20px 0;\">\n<p style=\"font-weight: bold; color: #92400e; margin: 0 0 8px;\">\u26a0 B\u1ea3o to\u00e0n b\u1eb1ng ch\u1ee9ng<\/p>\n<p style=\"margin: 0; color: #78350f;\">D\u00f9ng <code>mv<\/code> \u0111\u1ec3 di chuy\u1ec3n ch\u1ee9 kh\u00f4ng <code>rm<\/code>. Gi\u1eef l\u1ea1i file rootkit (<code>ld.so.preload.rootkit.bak<\/code> v\u00e0 file <code>.so<\/code> g\u1ed1c) ph\u1ee5c v\u1ee5 ph\u00e2n t\u00edch sau n\u00e0y ho\u1eb7c b\u00e1o c\u00e1o s\u1ef1 c\u1ed1. Ch\u1ec9 x\u00f3a h\u1eb3n sau khi \u0111\u00e3 sao l\u01b0u b\u1eb1ng ch\u1ee9ng ra ngo\u00e0i server.<\/p>\n<\/div>\n<p style=\"text-align: justify;\"><strong>\u0110\u1ecdc k\u1ebft qu\u1ea3:<\/strong> Sau khi g\u1ee1 preload, <code>ps aux<\/code> s\u1ebd hi\u1ec7n ti\u1ebfn tr\u00ecnh chi\u1ebfm CPU cao \u2014 th\u01b0\u1eddng c\u00f3 argv ch\u1ee9a <code>.onion<\/code>, ho\u1eb7c tham s\u1ed1 miner (<code>--url<\/code>, <code>--user<\/code>, <code>--pass<\/code>), ho\u1eb7c \u0111\u01b0\u1eddng d\u1eabn <code>\/.ustar*<\/code>. Ghi l\u1ea1i PID, \u0111\u01b0\u1eddng d\u1eabn binary, v\u00e0 tham s\u1ed1 d\u00f2ng l\u1ec7nh \u0111\u1ec3 d\u00f9ng trong c\u00e1c b\u01b0\u1edbc ti\u1ebfp.<\/p>\n<p style=\"text-align: justify;\"><strong>C\u00e1ch thay th\u1ebf n\u1ebfu ch\u01b0a d\u00e1m g\u1ee1 preload:<\/strong> D\u00f9ng <code>kill -0 $PID<\/code> (syscall tr\u1ef1c ti\u1ebfp, kh\u00f4ng qua <code>readdir<\/code>) \u0111\u1ec3 brute-force ki\u1ec3m tra PID n\u00e0o \u0111ang t\u1ed3n t\u1ea1i, r\u1ed3i so v\u1edbi danh s\u00e1ch t\u1eeb <code>ps -eo pid<\/code>. PID n\u00e0o <code>kill -0<\/code> tr\u1ea3 v\u1ec1 success nh\u01b0ng kh\u00f4ng c\u00f3 trong <code>ps<\/code> ch\u00ednh l\u00e0 ti\u1ebfn tr\u00ecnh b\u1ecb \u1ea9n. Tuy nhi\u00ean tr\u00ean server b\u1eadn, PID li\u00ean t\u1ee5c \u0111\u1ed5i ch\u1ee7 n\u00ean c\u00e1ch n\u00e0y d\u1ec5 nhi\u1ec5u \u2014 \u01b0u ti\u00ean g\u1ee1 preload.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u01b0\u1edbc 4: Truy t\u00ecm persistence (systemd, cron, rc.local)<\/h3>\n<p style=\"text-align: justify;\">M\u00e3 \u0111\u1ed9c th\u01b0\u1eddng c\u00e0i persistence \u0111\u1ec3 t\u1ef1 kh\u1edfi \u0111\u1ed9ng l\u1ea1i sau khi b\u1ecb kill ho\u1eb7c server reboot. V\u1edbi bi\u1ebfn th\u1ec3 ustar \u0111\u00e3 quan s\u00e1t, persistence ch\u00ednh l\u00e0 systemd unit <code>ustar.service<\/code> c\u00f3 <code>Restart=always<\/code>. B\u1ea1n c\u1ea7n d\u00f9ng <a href=\"https:\/\/interdata.vn\/blog\/quan-ly-dich-vu-vps-voi-systemctl\/\">systemctl \u0111\u1ec3 qu\u1ea3n l\u00fd d\u1ecbch v\u1ee5 VPS<\/a> v\u00e0 r\u00e0 so\u00e1t to\u00e0n b\u1ed9 ngu\u1ed3n persistence kh\u00e1c:<\/p>\n<pre><code>crontab -l -u root; ls -la \/etc\/cron.d \/etc\/cron.daily \/etc\/cron.hourly\r\nsystemctl list-unit-files --state=enabled\r\nsystemctl cat ustar.service          # \u0111\u1ecdc ExecStart; dropper th\u01b0\u1eddng t\u1ef1 t\u1ea3i l\u1ea1i binary n\u1ebfu b\u1ecb x\u00f3a nh\u1edd Restart=always\r\ncat \/etc\/rc.local\r\ngrep -rl 'LD_PRELOAD' \/etc\/profile \/etc\/profile.d\/ \/etc\/environment ~\/.bashrc\r\nfind \/ -xdev -newermt '2026-08-01' -type f -not -path '\/proc\/*' -not -path '\/var\/log\/*'<\/code><\/pre>\n<p style=\"text-align: justify;\"><strong>L\u01b0u \u00fd:<\/strong> Thay <code>ustar.service<\/code> b\u1eb1ng t\u00ean service l\u1ea1 th\u1ef1c t\u1ebf tr\u00ean m\u00e1y b\u1ea1n \u2014 bi\u1ebfn th\u1ec3 kh\u00e1c c\u00f3 th\u1ec3 d\u00f9ng t\u00ean service kh\u00e1c. Thay ng\u00e0y trong <code>-newermt<\/code> b\u1eb1ng th\u1eddi \u0111i\u1ec3m b\u1ea1n nghi ng\u1edd b\u1eaft \u0111\u1ea7u b\u1ecb x\u00e2m nh\u1eadp.<\/p>\n<p style=\"text-align: justify;\"><strong>Quan tr\u1ecdng:<\/strong> L\u1ec7nh <code>find<\/code> c\u0169ng d\u00f9ng <code>readdir()<\/code> \u2014 n\u00ean n\u1ebfu b\u1ea1n ch\u01b0a g\u1ee1 <code>ld.so.preload<\/code> \u1edf B\u01b0\u1edbc 3, k\u1ebft qu\u1ea3 <code>find<\/code> kh\u00f4ng tin \u0111\u01b0\u1ee3c. Ch\u1ec9 d\u00f9ng <code>find<\/code> \u0111\u1ec3 tham kh\u1ea3o, kh\u00f4ng k\u1ebft lu\u1eadn &#8220;s\u1ea1ch&#8221; d\u1ef1a tr\u00ean n\u00f3.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">B\u01b0\u1edbc 5: X\u00e1c \u0111\u1ecbnh vector x\u00e2m nh\u1eadp<\/h3>\n<p style=\"text-align: justify;\">N\u1ebfu kh\u00f4ng x\u00e1c \u0111\u1ecbnh v\u00e0 v\u00e1 l\u1ed7 h\u1ed5ng g\u1ed1c, m\u00e3 \u0111\u1ed9c s\u1ebd quay l\u1ea1i. Ki\u1ec3m tra log SSH \u0111\u1ec3 x\u00e1c nh\u1eadn brute-force:<\/p>\n<pre><code>grep -a 'Accepted' \/var\/log\/auth.log* | tail -40\r\ngrep -ac 'Failed password' \/var\/log\/auth.log*\r\ngrep -E 'PermitRootLogin|PasswordAuthentication' \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.d\/*.conf\r\nsystemctl is-active fail2ban\r\njournalctl -u ustar.service --no-pager | head -20    # ngu\u1ed3n t\u1ea3i dropper th\u01b0\u1eddng l\u1ed9 \u1edf \u0111\u00e2y<\/code><\/pre>\n<p style=\"text-align: justify;\"><strong>\u0110\u1ecdc k\u1ebft qu\u1ea3:<\/strong> H\u00e0ng ch\u1ee5c ngh\u00ecn <code>Failed password<\/code> k\u1ebft h\u1ee3p v\u1edbi nhi\u1ec1u <code>Accepted password for root<\/code> t\u1eeb c\u00e1c IP d\u00e2n d\u1ee5ng\/di \u0111\u1ed9ng r\u1ea3i r\u00e1c, <code>PermitRootLogin yes<\/code>, kh\u00f4ng c\u00f3 Fail2ban \u2192 k\u1ebft lu\u1eadn vector l\u00e0 SSH brute-force v\u00e0o root (CWE-521 \u2014 m\u1eadt kh\u1ea9u y\u1ebfu). \u0110\u00e2y kh\u00f4ng ph\u1ea3i CVE trong \u1ee9ng d\u1ee5ng c\u1ee5 th\u1ec3 \u2014 \u0111\u01a1n gi\u1ea3n l\u00e0 m\u1eadt kh\u1ea9u root d\u1ec5 \u0111o\u00e1n v\u00e0 SSH \u0111\u1ec3 m\u1edf m\u1eb7c \u0111\u1ecbnh.<\/p>\n<p style=\"text-align: justify;\">Trong log <code>journalctl<\/code> c\u1ee7a service l\u1ea1, b\u1ea1n th\u01b0\u1eddng th\u1ea5y l\u1ec7nh <code>wget<\/code> t\u1ea3i dropper t\u1eeb IP C2. V\u00ed d\u1ee5 \u0111\u00e3 quan s\u00e1t: <code>75.102.23.196<\/code> tr\u00ean nhi\u1ec1u c\u1ed5ng kh\u00e1c nhau, t\u00ean file ki\u1ec3u <code>8no.png<\/code>, <code>k32.png<\/code>. Tr\u00ean m\u00e1y b\u1ea1n, IP v\u00e0 t\u00ean file c\u00f3 th\u1ec3 kh\u00e1c.<\/p>\n<p><!-- ===== SECTION 4 ===== --><\/p>\n<h2 id=\"section4\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">Checklist lo\u1ea1i b\u1ecf rootkit ustar v\u00e0 cryptominer tri\u1ec7t \u0111\u1ec3 (6 m\u1ee5c)<\/h2>\n<p style=\"text-align: justify;\">Sau khi \u0111\u00e3 \u0111i\u1ec1u tra v\u00e0 x\u00e1c nh\u1eadn b\u1ecb nhi\u1ec5m, th\u1ef1c hi\u1ec7n 6 m\u1ee5c sau theo \u0111\u00fang th\u1ee9 t\u1ef1. Th\u1ee9 t\u1ef1 r\u1ea5t quan tr\u1ecdng: di\u1ec7t persistence tr\u01b0\u1edbc khi kill ti\u1ebfn tr\u00ecnh \u2014 n\u1ebfu kh\u00f4ng, service c\u00f3 <code>Restart=always<\/code> s\u1ebd respawn miner ngay l\u1eadp t\u1ee9c.<\/p>\n<table style=\"width: 100%; border-collapse: collapse; margin: 20px 0; font-size: 14px;\">\n<thead>\n<tr style=\"background-color: #1e3a8a; color: #fff;\">\n<th style=\"padding: 12px 15px; text-align: center; border: 1px solid #BFDBFE; width: 5%;\">#<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE; width: 20%;\">H\u1ea1ng m\u1ee5c<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">Chi ti\u1ebft th\u1ef1c hi\u1ec7n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">1<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">C\u00f4 l\u1eadp<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ch\u1eb7n outbound t\u1edbi IP\/domain C2: <code>ufw deny out to 75.102.23.196<\/code> (thay b\u1eb1ng IP th\u1ef1c t\u1ebf tr\u00ean m\u00e1y b\u1ea1n). <strong>KH\u00d4NG<\/strong> default-deny to\u00e0n b\u1ed9 outbound tr\u00ean production \u2014 s\u1ebd g\u00e3y email, license-check, payment gateway. Inbound ch\u1ec9 m\u1edf \u0111\u00fang c\u1ed5ng \u0111ang d\u00f9ng.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">2<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">Di\u1ec7t malware<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>systemctl stop ustar.service &amp;&amp; systemctl disable ustar.service &amp;&amp; systemctl mask ustar.service<\/code> \u2192 <code>kill -9 &lt;PID-miner&gt;<\/code> \u2192 X\u00f3a h\u1ebft file c\u00f9ng h\u1ecd: <code>\/.ustar*<\/code> (k\u1ec3 c\u1ea3 b\u1ea3n c\u0169 <code>\/.ustar0<\/code>, <code>\/.ustar1<\/code>\u2026) \u2192 X\u00f3a <code>\/etc\/ld.so.preload<\/code> (\u0111\u00e3 mv \u1edf B\u01b0\u1edbc 3) \u2192 X\u00f3a th\u01b0 m\u1ee5c cache Tor l\u1ea1 trong <code>\/tmp\/.*<\/code> ch\u1ee9a <code>guards.json<\/code> \u2192 X\u00e1c minh s\u1ea1ch b\u1eb1ng B\u01b0\u1edbc 1\u20133.<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">3<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">\u0110\u1ed5i m\u1eadt kh\u1ea9u root<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Sinh m\u1eadt kh\u1ea9u ng\u1eabu nhi\u00ean m\u1ea1nh (t\u1ed1i thi\u1ec3u 16 k\u00fd t\u1ef1, tr\u1ed9n ch\u1eef hoa\/th\u01b0\u1eddng\/s\u1ed1\/k\u00fd t\u1ef1 \u0111\u1eb7c bi\u1ec7t). D\u00f9ng <code>chpasswd<\/code> ho\u1eb7c <code>passwd root<\/code>. <strong>Verify:<\/strong> m\u1edf m\u1ed9t phi\u00ean SSH test ri\u00eang, \u0111\u0103ng nh\u1eadp b\u1eb1ng m\u1eadt kh\u1ea9u m\u1edbi, x\u00e1c nh\u1eadn th\u00e0nh c\u00f4ng tr\u01b0\u1edbc khi \u0111\u00f3ng phi\u00ean hi\u1ec7n t\u1ea1i.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">4<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">Fail2ban + \u0111\u1ed5i port SSH<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00e0i <a href=\"https:\/\/interdata.vn\/blog\/cai-dat-fail2ban-chong-brute-force-ssh\/\">Fail2ban ch\u1ed1ng brute-force SSH<\/a> (jail sshd, maxretry ~5). M\u1edf port SSH m\u1edbi song song port c\u0169 \u2192 verify v\u00e0o \u0111\u01b0\u1ee3c b\u1eb1ng port m\u1edbi \u2192 m\u1edbi \u0111\u00f3ng port c\u0169. Ubuntu 24.04 d\u00f9ng <code>ssh.socket<\/code> \u2192 nh\u1edb <code>systemctl daemon-reload<\/code> + restart c\u1ea3 socket l\u1eabn service.<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">5<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">Ki\u1ec3m tra authorized_keys<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">V\u1edbi m\u1ecdi user c\u00f3 home directory: <code>cat ~\/.ssh\/authorized_keys<\/code>. \u0110\u1ed1i chi\u1ebfu ng\u00e0y s\u1eeda \u0111\u1ed5i file v\u1edbi th\u1eddi \u0111i\u1ec3m nghi x\u00e2m nh\u1eadp. Key l\u1ea1 = k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 \u0111\u1ec3 backdoor SSH key \u2192 x\u00f3a ngay.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; text-align: center; font-weight: bold;\">6<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">V\u00e1 h\u1ec7 th\u1ed1ng<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><code>apt-get update &amp;&amp; apt-get -y upgrade<\/code>. Ki\u1ec3m tra <code>\/var\/run\/reboot-required<\/code> \u2014 n\u1ebfu c\u00f3, H\u1eceI qu\u1ea3n tr\u1ecb vi\u00ean tr\u01b0\u1edbc khi reboot production. Reboot kh\u00f4ng b\u00e1o tr\u01b0\u1edbc c\u00f3 th\u1ec3 g\u00e2y downtime ngo\u00e0i k\u1ebf ho\u1ea1ch.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"background-color: #fef2f2; border: 1.5px solid #FCA5A5; border-radius: 10px; padding: 18px 20px; margin: 20px 0;\">\n<p style=\"font-weight: bold; color: #991b1b; margin: 0 0 8px;\">\u26a0 Kh\u00f4ng default-deny outbound tr\u00ean production<\/p>\n<p style=\"margin: 0; color: #7f1d1d;\">Ch\u1ea1y <code>iptables -P OUTPUT DROP<\/code> ho\u1eb7c <code>ufw default deny outgoing<\/code> tr\u00ean server production \u0111ang ch\u1ea1y d\u1ecbch v\u1ee5 s\u1ebd l\u1eadp t\u1ee9c c\u1eaft \u0111\u1ee9t email g\u1eedi \u0111i, webhook, payment gateway, license check, apt update v\u00e0 m\u1ecdi k\u1ebft n\u1ed1i outbound kh\u00e1c. Ch\u1ec9 ch\u1eb7n \u0111\u00fang IP\/port C2 \u0111\u00e3 x\u00e1c \u0111\u1ecbnh. N\u1ebfu b\u1ea1n c\u1ea7n <a href=\"https:\/\/interdata.vn\/blog\/huong-dan-tat-mo-port-tren-vps\/\">t\u1eaft\/m\u1edf port tr\u00ean VPS<\/a>, h\u00e3y l\u00e0m t\u1eebng b\u01b0\u1edbc v\u00e0 test k\u1ef9.<\/p>\n<\/div>\n<p><!-- BOX CTA #2 \u2014 CANH ME --><\/p>\n<div style=\"background: linear-gradient(135deg, #EFF6FF 0%, #DBEAFE 100%); border: 1.5px solid #2563EB; border-radius: 12px; padding: 28px; margin: 35px 0; text-align: center;\">\n<p style=\"font-family: 'Be Vietnam Pro', sans-serif; font-size: 22px; font-weight: bold; color: #1e3a8a; margin: 0 0 8px;\">D\u1ef1ng l\u1ea1i VPS s\u1ea1ch? Ki\u1ec3m tra \u01b0u \u0111\u00e3i tr\u01b0\u1edbc khi ch\u1ecdn c\u1ea5u h\u00ecnh<\/p>\n<p style=\"font-size: 15px; color: #4b5563; margin-bottom: 20px;\">N\u1ebfu b\u1ea1n quy\u1ebft \u0111\u1ecbnh d\u1ef1ng l\u1ea1i h\u1ec7 th\u1ed1ng tr\u00ean m\u1ed9t VPS m\u1edbi \u0111\u1ec3 \u0111\u1ea3m b\u1ea3o m\u00f4i tr\u01b0\u1eddng s\u1ea1ch v\u00e0 an to\u00e0n h\u01a1n, \u0111\u1eebng qu\u00ean ki\u1ec3m tra c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh \u01b0u \u0111\u00e3i \u0111ang \u00e1p d\u1ee5ng tr\u01b0\u1edbc khi \u0111\u0103ng k\u00fd.<\/p>\n<p><a style=\"background: #2563EB; color: #fff; padding: 12px 30px; text-decoration: none; font-weight: 600; border-radius: 8px; display: inline-block;\" href=\"https:\/\/interdata.vn\/canhme\/\" target=\"_blank\" rel=\"noopener\">Xem Hot Deals t\u1ea1i InterData \u27f6<\/a><\/p>\n<\/div>\n<p><!-- ===== SECTION 5 ===== --><\/p>\n<h2 id=\"section5\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">N\u00ean g\u1ee1 t\u1ea1i ch\u1ed7 hay d\u1ef1ng l\u1ea1i VPS s\u1ea1ch?<\/h2>\n<p style=\"text-align: justify;\">\u0110\u00e2y l\u00e0 c\u00e2u h\u1ecfi l\u1edbn nh\u1ea5t sau khi ph\u00e1t hi\u1ec7n b\u1ecb nhi\u1ec5m. C\u00e2u tr\u1ea3 l\u1eddi ph\u1ee5 thu\u1ed9c v\u00e0o m\u1ee9c \u0111\u1ed9 x\u00e2m nh\u1eadp v\u00e0 y\u00eau c\u1ea7u tin c\u1eady c\u1ee7a h\u1ec7 th\u1ed1ng. Kh\u00f4ng c\u00f3 \u0111\u00e1p \u00e1n &#8220;lu\u00f4n \u0111\u00fang&#8221; \u2014 nh\u01b0ng c\u00f3 ti\u00eau ch\u00ed r\u00f5 r\u00e0ng \u0111\u1ec3 quy\u1ebft \u0111\u1ecbnh.<\/p>\n<table style=\"width: 100%; border-collapse: collapse; margin: 20px 0; font-size: 14px;\">\n<thead>\n<tr style=\"background-color: #1e3a8a; color: #fff;\">\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">Ti\u00eau ch\u00ed<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">G\u1ee1 t\u1ea1i ch\u1ed7<\/th>\n<th style=\"padding: 12px 15px; text-align: left; border: 1px solid #BFDBFE;\">D\u1ef1ng l\u1ea1i s\u1ea1ch tr\u00ean VPS m\u1edbi<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">M\u1ee9c \u0111\u1ed9 x\u00e2m nh\u1eadp<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ch\u1ec9 c\u00f3 rootkit userland (LD_PRELOAD) + miner, kh\u00f4ng c\u00f3 kernel module l\u1ea1, kh\u00f4ng c\u00f3 thay \u0111\u1ed5i trong initramfs<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Nghi ng\u1edd kernel rootkit, nhi\u1ec1u binary h\u1ec7 th\u1ed1ng b\u1ecb s\u1eeda, ho\u1eb7c kh\u00f4ng r\u00e0 h\u1ebft \u0111\u01b0\u1ee3c persistence<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">Th\u1eddi gian b\u1ecb chi\u1ebfm<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Ph\u00e1t hi\u1ec7n s\u1edbm (v\u00e0i gi\u1edd \u0111\u1ebfn 1\u20132 ng\u00e0y)<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Kh\u00f4ng r\u00f5 b\u1ecb t\u1eeb khi n\u00e0o, ho\u1eb7c \u0111\u00e3 nhi\u1ec1u tu\u1ea7n<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">D\u1eef li\u1ec7u tr\u00ean server<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00f3 d\u1eef li\u1ec7u kh\u00f3 migrate, ch\u1ea5p nh\u1eadn r\u1ee7i ro c\u00f2n s\u00f3t<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00f3 th\u1ec3 deploy l\u1ea1i t\u1eeb source\/backup<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">Y\u00eau c\u1ea7u tin c\u1eady<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Server dev\/test, kh\u00f4ng x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">Production ch\u1ea1y thanh to\u00e1n, d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng, ho\u1eb7c c\u1ea7n audit trail s\u1ea1ch<\/td>\n<\/tr>\n<tr style=\"background-color: #f8fafc;\">\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0; font-weight: 600;\">K\u1ebft lu\u1eadn<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\">C\u00f3 th\u1ec3 g\u1ee1 n\u1ebfu x\u00e1c nh\u1eadn r\u00e0 h\u1ebft persistence + v\u00e1 SSH + x\u00e1c minh l\u1ea1i s\u1ea1ch b\u1eb1ng B\u01b0\u1edbc 1\u20133<\/td>\n<td style=\"padding: 10px 15px; border: 1px solid #E2E8F0;\"><strong>Khuy\u1ebfn ngh\u1ecb m\u1eb7c \u0111\u1ecbnh<\/strong> khi server \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n root \u2014 an to\u00e0n h\u01a1n so v\u1edbi d\u1ecdn th\u1ee7 c\u00f4ng<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: justify;\">V\u1edbi server \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n root, d\u1ef1ng l\u1ea1i s\u1ea1ch th\u01b0\u1eddng l\u00e0 l\u1ef1a ch\u1ecdn kh\u00f4n ngoan h\u01a1n. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 root c\u00f3 th\u1ec3 \u0111\u00e3 s\u1eeda \u0111\u1ed5i b\u1ea5t k\u1ef3 file n\u00e0o tr\u00ean h\u1ec7 th\u1ed1ng \u2014 k\u1ec3 c\u1ea3 c\u00e1c c\u00f4ng c\u1ee5 b\u1ea1n \u0111ang d\u00f9ng \u0111\u1ec3 ki\u1ec3m tra. N\u1ebfu b\u1ea1n ch\u1ecdn g\u1ee1 t\u1ea1i ch\u1ed7, ph\u1ea3i x\u00e1c minh l\u1ea1i b\u1eb1ng B\u01b0\u1edbc 1\u20133 sau m\u1ed7i thao t\u00e1c g\u1ee1, v\u00e0 ch\u1ea1y th\u00eam <code>rkhunter<\/code> ho\u1eb7c <code>chkrootkit<\/code> \u0111\u1ec3 qu\u00e9t b\u1ed5 sung.<\/p>\n<p><!-- ===== SECTION 6 ===== --><\/p>\n<h2 id=\"section6\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">Ph\u00f2ng ng\u1eeba t\u00e1i nhi\u1ec5m v\u00e1 \u0111\u00fang l\u1ed7 h\u1ed5ng g\u1ed1c sau khi lo\u1ea1i b\u1ecf rootkit ustar<\/h2>\n<p style=\"text-align: justify;\">G\u1ee1 rootkit m\u00e0 kh\u00f4ng v\u00e1 l\u1ed7 h\u1ed5ng g\u1ed1c th\u00ec v\u00e0i ti\u1ebfng ho\u1eb7c v\u00e0i ng\u00e0y sau s\u1ebd b\u1ecb l\u1ea1i. V\u1edbi bi\u1ebfn th\u1ec3 ustar, vector l\u00e0 SSH brute-force v\u00e0o root \u2014 n\u00ean ph\u00f2ng ng\u1eeba t\u1eadp trung v\u00e0o gia c\u1ed1 SSH v\u00e0 gi\u00e1m s\u00e1t.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">T\u1eaft \u0111\u0103ng nh\u1eadp root b\u1eb1ng m\u1eadt kh\u1ea9u, chuy\u1ec3n sang SSH key<\/h3>\n<p style=\"text-align: justify;\">\u0110\u00e2y l\u00e0 bi\u1ec7n ph\u00e1p quan tr\u1ecdng nh\u1ea5t. Tham kh\u1ea3o chi ti\u1ebft trong h\u01b0\u1edbng d\u1eabn <a href=\"https:\/\/interdata.vn\/blog\/cach-bao-mat-ssh-vps\/\">c\u00e1ch b\u1ea3o m\u1eadt SSH cho VPS<\/a>. S\u1eeda file <code>\/etc\/ssh\/sshd_config<\/code>:<\/p>\n<pre><code>PermitRootLogin prohibit-password    # ch\u1ec9 cho root login b\u1eb1ng key, c\u1ea5m m\u1eadt kh\u1ea9u\r\nPasswordAuthentication no            # t\u1eaft x\u00e1c th\u1ef1c m\u1eadt kh\u1ea9u cho t\u1ea5t c\u1ea3 user<\/code><\/pre>\n<p style=\"text-align: justify;\">Tr\u01b0\u1edbc khi restart SSH, h\u00e3y ch\u1eafc ch\u1eafn b\u1ea1n \u0111\u00e3 th\u00eam public key v\u00e0o <code>~\/.ssh\/authorized_keys<\/code> v\u00e0 test \u0111\u0103ng nh\u1eadp b\u1eb1ng key tr\u00ean m\u1ed9t phi\u00ean m\u1edbi. M\u1ea5t key m\u00e0 \u0111\u00e3 t\u1eaft password = kh\u00f3a m\u00ecnh ngo\u00e0i server.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">\u0110\u1ed5i port SSH<\/h3>\n<p style=\"text-align: justify;\">Kh\u00f4ng ph\u1ea3i bi\u1ec7n ph\u00e1p b\u1ea3o m\u1eadt th\u1eadt s\u1ef1 (security through obscurity), nh\u01b0ng gi\u1ea3m \u0111\u00e1ng k\u1ec3 l\u01b0\u1ee3ng bot qu\u00e9t brute-force t\u1ef1 \u0111\u1ed9ng \u2014 ph\u1ea7n l\u1edbn ch\u1ec9 qu\u00e9t port 22. Quy tr\u00ecnh an to\u00e0n: m\u1edf port m\u1edbi song song port c\u0169 \u2192 verify \u0111\u0103ng nh\u1eadp \u0111\u01b0\u1ee3c b\u1eb1ng port m\u1edbi \u2192 m\u1edbi \u0111\u00f3ng port c\u0169.<\/p>\n<div style=\"background-color: #fffbeb; border: 1.5px solid #FCD34D; border-radius: 10px; padding: 18px 20px; margin: 20px 0;\">\n<p style=\"font-weight: bold; color: #92400e; margin: 0 0 8px;\">\u26a0 Test SSH port m\u1edbi tr\u01b0\u1edbc khi \u0111\u00f3ng port c\u0169<\/p>\n<p style=\"margin: 0; color: #78350f;\">N\u1ebfu \u0111\u00f3ng port c\u0169 tr\u01b0\u1edbc khi x\u00e1c nh\u1eadn port m\u1edbi ho\u1ea1t \u0111\u1ed9ng, b\u1ea1n s\u1ebd m\u1ea5t truy c\u1eadp v\u00e0o server. Lu\u00f4n gi\u1eef \u00edt nh\u1ea5t m\u1ed9t phi\u00ean SSH \u0111ang m\u1edf trong su\u1ed1t qu\u00e1 tr\u00ecnh \u0111\u1ed5i port. Tr\u00ean Ubuntu 24.04, SSH d\u00f9ng <code>ssh.socket<\/code> \u2014 nh\u1edb <code>systemctl daemon-reload<\/code> r\u1ed3i restart c\u1ea3 socket l\u1eabn service.<\/p>\n<\/div>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">C\u00e0i Fail2ban<\/h3>\n<p style=\"text-align: justify;\">Fail2ban gi\u00e1m s\u00e1t log SSH v\u00e0 t\u1ef1 \u0111\u1ed9ng ban IP sau m\u1ed9t s\u1ed1 l\u1ea7n \u0111\u0103ng nh\u1eadp sai. C\u1ea5u h\u00ecnh jail sshd v\u1edbi <code>maxretry = 5<\/code> l\u00e0 \u0111i\u1ec3m kh\u1edfi \u0111\u1ea7u h\u1ee3p l\u00fd. H\u01b0\u1edbng d\u1eabn chi ti\u1ebft trong b\u00e0i <a href=\"https:\/\/interdata.vn\/blog\/cai-dat-fail2ban-chong-brute-force-ssh\/\">c\u00e0i \u0111\u1eb7t Fail2ban ch\u1ed1ng brute-force SSH<\/a>.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 20px; font-weight: bold; margin: 30px 0 15px;\">Firewall, backup v\u00e0 gi\u00e1m s\u00e1t<\/h3>\n<p style=\"text-align: justify;\">C\u1ea5u h\u00ecnh UFW ho\u1eb7c iptables ch\u1ec9 m\u1edf \u0111\u00fang port c\u1ea7n thi\u1ebft (SSH port m\u1edbi, HTTP\/HTTPS, port \u1ee9ng d\u1ee5ng). Tham kh\u1ea3o th\u00eam c\u00e1c bi\u1ec7n ph\u00e1p t\u1ed5ng h\u1ee3p trong b\u00e0i <a href=\"https:\/\/interdata.vn\/blog\/bao-mat-vps-linux\/\">b\u1ea3o m\u1eadt VPS Linux<\/a>.<\/p>\n<p style=\"text-align: justify;\">Thi\u1ebft l\u1eadp backup\/snapshot \u0111\u1ecbnh k\u1ef3 \u0111\u1ec3 khi s\u1ef1 c\u1ed1 x\u1ea3y ra, b\u1ea1n c\u00f3 th\u1ec3 kh\u00f4i ph\u1ee5c nhanh thay v\u00ec g\u1ee1 th\u1ee7 c\u00f4ng. \u0110\u00e2y l\u00e0 l\u00fac Cloud Server ph\u00e1t huy gi\u00e1 tr\u1ecb \u2014 snapshot t\u1ee9c th\u00ec, kh\u00f4i ph\u1ee5c trong v\u00e0i ph\u00fat, c\u00f4 l\u1eadp d\u1ecbch v\u1ee5 tr\u00ean c\u00e1c instance ri\u00eang bi\u1ec7t.<\/p>\n<p><!-- BOX CTA #3 \u2014 CLOUD SERVER --><\/p>\n<div style=\"display: flex; flex-wrap: wrap; background-color: #fff; border: 1.5px solid #BFDBFE; box-shadow: 0 8px 20px rgba(37,99,235,0.08); border-radius: 12px; overflow: hidden; margin: 35px 0;\">\n<div style=\"flex: 1; min-width: 250px; background: linear-gradient(135deg, #1E3A8A 0%, #2563EB 100%); display: flex; align-items: center; justify-content: center; padding: 30px; text-align: center;\">\n<div>\n<p style=\"color: #fff; font-size: 34px; font-family: 'Be Vietnam Pro', sans-serif; font-weight: bold; margin: 0; line-height: 1.1;\">Cloud Server InterData<\/p>\n<p style=\"color: #dbeafe; font-size: 15px; font-weight: 600; margin-top: 12px;\">Backup \u0111\u1ecbnh k\u1ef3 \u00b7 Ch\u1ee7 \u0111\u1ed9ng h\u01a1n khi c\u1ea7n kh\u00f4i ph\u1ee5c d\u1eef li\u1ec7u<\/p>\n<\/div>\n<\/div>\n<div style=\"flex: 2; padding: 25px; min-width: 300px;\">\n<h3 style=\"font-family: 'Be Vietnam Pro', sans-serif; color: #1e3a8a; margin-top: 0; font-size: 20px;\">Mu\u1ed1n ch\u1ee7 \u0111\u1ed9ng h\u01a1n khi x\u1ea3y ra s\u1ef1 c\u1ed1 b\u1ea3o m\u1eadt?<\/h3>\n<p style=\"text-align: justify; font-size: 15px; margin-bottom: 15px;\">V\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng production, backup \u0111\u1ecbnh k\u1ef3 gi\u00fap b\u1ea1n duy tr\u00ec c\u00e1c b\u1ea3n sao d\u1eef li\u1ec7u c\u1ea7n thi\u1ebft \u0111\u1ec3 ph\u1ee5c v\u1ee5 qu\u00e1 tr\u00ecnh kh\u00f4i ph\u1ee5c khi x\u1ea3y ra s\u1ef1 c\u1ed1, thay v\u00ec ch\u1ec9 ph\u1ee5 thu\u1ed9c v\u00e0o vi\u1ec7c x\u1eed l\u00fd v\u00e0 l\u00e0m s\u1ea1ch tr\u1ef1c ti\u1ebfp tr\u00ean h\u1ec7 th\u1ed1ng \u0111ang v\u1eadn h\u00e0nh.<\/p>\n<p style=\"text-align: justify; font-size: 15px; margin-bottom: 15px;\">Cloud Server InterData h\u1ed7 tr\u1ee3 backup \u0111\u1ecbnh k\u1ef3 v\u00e0 linh ho\u1ea1t n\u00e2ng c\u1ea5p t\u00e0i nguy\u00ean, ph\u00f9 h\u1ee3p v\u1edbi c\u00e1c h\u1ec7 th\u1ed1ng c\u1ea7n \u01b0u ti\u00ean t\u00ednh li\u00ean t\u1ee5c v\u00e0 kh\u1ea3 n\u0103ng ph\u1ee5c h\u1ed3i d\u1eef li\u1ec7u sau s\u1ef1 c\u1ed1.<\/p>\n<p><a style=\"background: linear-gradient(90deg, #2563EB 0%, #1E3A8A 100%); color: #fff; padding: 12px 25px; text-decoration: none; font-weight: 600; border-radius: 8px; font-size: 15px; display: inline-block; box-shadow: 0 5px 15px rgba(37,99,235,0.3);\" href=\"https:\/\/interdata.vn\/cloud-server\/\" target=\"_blank\" rel=\"noopener\">Xem B\u1ea3ng Gi\u00e1 Cloud Server\u27f6<\/a><\/p>\n<\/div>\n<\/div>\n<p><!-- ===== SECTION 7 \u2014 FAQ ===== --><\/p>\n<h2 id=\"section7\" style=\"color: #1e3a8a; font-size: 24px; font-weight: bold; text-align: left; border-left: 5px solid #2563EB; padding-left: 15px; margin: 40px 0 20px; line-height: 1.4;\">C\u00e2u h\u1ecfi th\u01b0\u1eddng g\u1eb7p (FAQ)<\/h2>\n<h3 style=\"color: #1e3a8a; font-size: 18px; font-weight: bold; margin: 25px 0 10px;\">L\u00e0m sao bi\u1ebft VPS c\u00f3 b\u1ecb nhi\u1ec5m rootkit hay kh\u00f4ng?<\/h3>\n<p style=\"text-align: justify;\">Ch\u1ea1y <code>cat \/etc\/ld.so.preload<\/code> \u2014 n\u1ebfu file ch\u1ee9a \u0111\u01b0\u1eddng d\u1eabn t\u1edbi m\u1ed9t shared library l\u1ea1, g\u1ea7n nh\u01b0 ch\u1eafc ch\u1eafn b\u1ecb c\u00e0i rootkit userland. K\u1ebft h\u1ee3p ki\u1ec3m tra: CPU cao kh\u00f4ng r\u00f5 nguy\u00ean nh\u00e2n, <code>ss -tnp<\/code> c\u00f3 k\u1ebft n\u1ed1i outbound nh\u01b0ng c\u1ed9t Process tr\u1ed1ng d\u00f9 \u0111ang root. \u0110\u1eebng ch\u1ec9 d\u1ef1a v\u00e0o <code>ps<\/code> \u2014 n\u00f3 c\u00f3 th\u1ec3 \u0111\u00e3 b\u1ecb hook.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 18px; font-weight: bold; margin: 25px 0 10px;\">V\u00ec sao <code>ps<\/code> v\u00e0 <code>ss<\/code> kh\u00f4ng th\u1ea5y ti\u1ebfn tr\u00ecnh \u0111\u00e0o coin?<\/h3>\n<p style=\"text-align: justify;\">Rootkit LD_PRELOAD hook h\u00e0m <code>readdir64()<\/code> \u2014 h\u00e0m m\u00e0 <code>ps<\/code>, <code>ls<\/code>, <code>find<\/code> d\u00f9ng \u0111\u1ec3 li\u1ec7t k\u00ea n\u1ed9i dung <code>\/proc<\/code>. Hook n\u00e0y l\u1ecdc b\u1ecf entry PID c\u1ee7a miner, n\u00ean c\u00e1c l\u1ec7nh n\u00e0y &#8220;kh\u00f4ng th\u1ea5y&#8221; ti\u1ebfn tr\u00ecnh \u0111\u00f3. G\u1ee1 file <code>\/etc\/ld.so.preload<\/code> r\u1ed3i ch\u1ea1y l\u1ea1i <code>ps<\/code> s\u1ebd th\u1ea5y miner l\u1ed9 ra ngay.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 18px; font-weight: bold; margin: 25px 0 10px;\">Rootkit ustar v\u00e0 <code>\/etc\/ld.so.preload<\/code> l\u00e0 g\u00ec?<\/h3>\n<p style=\"text-align: justify;\"><code>\/etc\/ld.so.preload<\/code> l\u00e0 file c\u1ea5u h\u00ecnh c\u1ee7a Linux dynamic linker \u2014 m\u1ecdi th\u01b0 vi\u1ec7n \u0111\u01b0\u1ee3c li\u1ec7t k\u00ea trong \u0111\u00f3 s\u1ebd load tr\u01b0\u1edbc t\u1ea5t c\u1ea3 th\u01b0 vi\u1ec7n kh\u00e1c khi ch\u01b0\u01a1ng tr\u00ecnh ELF kh\u1edfi ch\u1ea1y. Rootkit ustar l\u1ee3i d\u1ee5ng c\u01a1 ch\u1ebf n\u00e0y \u0111\u1ec3 ghi m\u1ed9t lib hook <code>readdir64()<\/code> v\u00e0o file \u0111\u00f3, \u1ea9n ti\u1ebfn tr\u00ecnh miner v\u00e0 c\u00e1c file li\u00ean quan (<code>\/.ustar*<\/code>) kh\u1ecfi m\u1ecdi c\u00f4ng c\u1ee5 li\u1ec7t k\u00ea th\u01b0 m\u1ee5c.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 18px; font-weight: bold; margin: 25px 0 10px;\">G\u1ee1 rootkit xong c\u00f3 b\u1ecb \u0111\u00e0o coin l\u1ea1i kh\u00f4ng?<\/h3>\n<p style=\"text-align: justify;\">C\u00f3 \u2014 n\u1ebfu b\u1ea1n kh\u00f4ng v\u00e1 l\u1ed7 h\u1ed5ng g\u1ed1c. Trong h\u1ea7u h\u1ebft c\u00e1c ca, vector l\u00e0 SSH brute-force v\u00e0o root do m\u1eadt kh\u1ea9u y\u1ebfu. G\u1ee1 miner m\u00e0 v\u1eabn \u0111\u1ec3 <code>PermitRootLogin yes<\/code> + m\u1eadt kh\u1ea9u y\u1ebfu + kh\u00f4ng Fail2ban th\u00ec k\u1ebb t\u1ea5n c\u00f4ng s\u1ebd quay l\u1ea1i trong v\u00e0i gi\u1edd. Ph\u1ea3i t\u1eaft \u0111\u0103ng nh\u1eadp root b\u1eb1ng m\u1eadt kh\u1ea9u, chuy\u1ec3n sang SSH key, \u0111\u1ed5i port, c\u00e0i Fail2ban.<\/p>\n<h3 style=\"color: #1e3a8a; font-size: 18px; font-weight: bold; margin: 25px 0 10px;\">B\u1ecb chi\u1ebfm quy\u1ec1n root r\u1ed3i, c\u00f3 b\u1eaft bu\u1ed9c c\u00e0i l\u1ea1i VPS kh\u00f4ng?<\/h3>\n<p style=\"text-align: justify;\">Kh\u00f4ng b\u1eaft bu\u1ed9c, nh\u01b0ng khuy\u1ebfn ngh\u1ecb. K\u1ebb t\u1ea5n c\u00f4ng c\u00f3 root c\u00f3 th\u1ec3 s\u1eeda b\u1ea5t k\u1ef3 file n\u00e0o \u2014 k\u1ec3 c\u1ea3 c\u00f4ng c\u1ee5 ki\u1ec3m tra. N\u1ebfu ch\u1ec9 l\u00e0 rootkit userland (LD_PRELOAD) + miner, ph\u00e1t hi\u1ec7n s\u1edbm, r\u00e0 h\u1ebft persistence v\u00e0 v\u00e1 SSH, th\u00ec g\u1ee1 t\u1ea1i ch\u1ed7 c\u00f3 th\u1ec3 ch\u1ea5p nh\u1eadn \u0111\u01b0\u1ee3c. V\u1edbi production x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m ho\u1eb7c kh\u00f4ng r\u00f5 b\u1ecb t\u1eeb khi n\u00e0o, d\u1ef1ng l\u1ea1i s\u1ea1ch an to\u00e0n h\u01a1n.<\/p>\n<p><!-- ===== K\u1ebeT B\u00c0I ===== --><\/p>\n<div style=\"border-top: 2px dashed #BFDBFE; margin-top: 50px; padding-top: 30px;\">\n<h3 style=\"font-family: 'Be Vietnam Pro', sans-serif; color: #1e3a8a; font-size: 22px; font-weight: bold; margin-bottom: 15px;\">X\u1eed l\u00fd xong \u2014 ti\u1ebfp theo l\u00e0 g\u00ec?<\/h3>\n<p style=\"text-align: justify;\">Quy tr\u00ecnh ki\u1ec3m tra &amp; lo\u1ea1i b\u1ecf rootkit ustar g\u00f3i g\u1ecdn trong ba nguy\u00ean t\u1eafc: ki\u1ec3m tra <code>\/etc\/ld.so.preload<\/code> tr\u01b0\u1edbc m\u1ecdi th\u1ee9 \u2014 v\u00ec kh\u00f4ng g\u1ee1 preload th\u00ec m\u1ecdi l\u1ec7nh ki\u1ec3m tra \u0111\u1ec1u b\u1ecb \u0111\u00e1nh l\u1eeba; di\u1ec7t persistence (stop \u2192 disable \u2192 mask service) tr\u01b0\u1edbc khi kill ti\u1ebfn tr\u00ecnh \u2014 v\u00ec <code>Restart=always<\/code> s\u1ebd respawn miner ngay; v\u00e0 v\u00e1 SSH (t\u1eaft root login b\u1eb1ng m\u1eadt kh\u1ea9u, \u0111\u1ed5i port, Fail2ban) \u0111\u1ec3 \u0111\u00f3ng c\u1eeda v\u00e0o g\u1ed1c. B\u1ecf qua b\u1ea5t k\u1ef3 b\u01b0\u1edbc n\u00e0o trong ba b\u01b0\u1edbc n\u00e0y, m\u00e3 \u0111\u1ed9c s\u1ebd quay l\u1ea1i.<\/p>\n<p style=\"text-align: justify;\">N\u1ebfu b\u1ea1n \u0111\u00e3 g\u1ee1 s\u1ea1ch v\u00e0 x\u00e1c minh server \u1ed5n \u2014 h\u00e3y l\u1eadp k\u1ebf ho\u1ea1ch backup\/snapshot \u0111\u1ecbnh k\u1ef3 ngay t\u1eeb b\u00e2y gi\u1edd, \u0111\u1ec3 l\u1ea7n sau (n\u1ebfu c\u00f3) kh\u00f4ng ph\u1ea3i g\u1ee1 th\u1ee7 c\u00f4ng m\u00e0 ch\u1ec9 c\u1ea7n kh\u00f4i ph\u1ee5c t\u1eeb b\u1ea3n s\u1ea1ch. V\u00e0 n\u1ebfu m\u1ee9c \u0111\u1ed9 x\u00e2m nh\u1eadp v\u01b0\u1ee3t qu\u00e1 kh\u1ea3 n\u0103ng d\u1ecdn th\u1ee7 c\u00f4ng, d\u1ef1ng l\u1ea1i tr\u00ean n\u1ec1n h\u1ea1 t\u1ea7ng s\u1ea1ch l\u00e0 quy\u1ebft \u0111\u1ecbnh \u0111\u00fang.<\/p>\n<\/div>\n<p style=\"text-align: justify; font-size: 13px; font-style: italic; color: #6b7280; margin-top: 30px; border-top: 1px solid #E5E7EB; padding-top: 15px;\"><span style=\"font-size: 100%;\"><em>N\u1ed9i dung mang t\u00ednh tham kh\u1ea3o cho m\u1ee5c \u0111\u00edch ph\u00f2ng th\u1ee7 v\u00e0 \u1ee9ng c\u1ee9u s\u1ef1 c\u1ed1. T\u00ean file, port, t\u00ean service v\u00e0 h\u00e0nh vi m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 kh\u00e1c gi\u1eefa c\u00e1c bi\u1ebfn th\u1ec3, phi\u00ean b\u1ea3n h\u1ec7 \u0111i\u1ec1u h\u00e0nh v\u00e0 m\u00f4i tr\u01b0\u1eddng th\u1ef1c t\u1ebf. V\u1edbi m\u00e1y \u0111\u00e3 b\u1ecb chi\u1ebfm quy\u1ec1n root, d\u1ef1ng l\u1ea1i s\u1ea1ch t\u1eeb ngu\u1ed3n tin c\u1eady th\u01b0\u1eddng an to\u00e0n h\u01a1n d\u1ecdn th\u1ee7 c\u00f4ng. H\u00e3y sao l\u01b0u b\u1eb1ng ch\u1ee9ng, ki\u1ec3m th\u1eed tr\u00ean m\u00f4i tr\u01b0\u1eddng t\u00e1ch bi\u1ec7t v\u00e0 c\u00e2n nh\u1eafc nh\u1edd chuy\u00ean gia an to\u00e0n th\u00f4ng tin tr\u01b0\u1edbc khi \u00e1p d\u1ee5ng cho production.<\/em><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ki\u1ec3m tra v\u00e0 lo\u1ea1i b\u1ecf rootkit ustar l\u00e0 vi\u1ec7c c\u1ea7n \u01b0u ti\u00ean khi VPS Ubuntu xu\u1ea5t hi\u1ec7n nh\u1eefng d\u1ea5u hi\u1ec7u b\u1ea5t th\u01b0\u1eddng nh\u01b0 CPU t\u0103ng cao, li\u00ean t\u1ee5c ph\u00e1t sinh k\u1ebft n\u1ed1i TCP outbound \u0111\u1ebfn c\u00e1c IP l\u1ea1, trong khi c\u00e1c l\u1ec7nh ki\u1ec3m tra nh\u01b0 ps hay ss l\u1ea1i kh\u00f4ng hi\u1ec3n th\u1ecb ti\u1ebfn tr\u00ecnh \u0111\u00e1ng<\/p>\n","protected":false},"author":2,"featured_media":43186,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[83],"tags":[],"class_list":["post-43184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bao-mat-an-ninh-mang"],"_links":{"self":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/comments?post=43184"}],"version-history":[{"count":5,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43184\/revisions"}],"predecessor-version":[{"id":43193,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/posts\/43184\/revisions\/43193"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media\/43186"}],"wp:attachment":[{"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/media?parent=43184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/categories?post=43184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/interdata.vn\/blog\/wp-json\/wp\/v2\/tags?post=43184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}