由于疫情原因，需要远程在家学习。向日葵这种远程软件总是有延迟，卡卡的。于是爱折腾的我就想起了开源的内网穿透工具 frp
使用内网穿透工具需要一台速度不错的服务器，如果需要买一个云服务器，那我还不如直接开向日葵的会员呢。
但事情巧就巧在我家的网络恰巧又有公网 IP ，于是我就在我自己的电脑上部署了 frps 的服务。
在实验室的电脑里启动 frpc 的客户端，于是就可以通过 3389 端口远程桌面登录了。速度是真的很快。
在我以往的观念里一直都觉得黑客是不会攻击个人电脑的，因为没有勒索的价值。但这次黑客给我上了一课。
有一天我打开电脑，所有的文件都变成这样了。
Due to the pandemic, I needed to study remotely from home. Remote software like Sunlogin always has latency and is laggy. So as someone who loves tinkering, I thought of the open-source intranet penetration tool frp.
Using an intranet penetration tool requires a server with decent speed. If I had to buy a cloud server, I might as well just get a Sunlogin membership.
But as luck would have it, my home network happened to have a public IP, so I deployed the frps service on my own computer.
I started the frpc client on the lab computer, and I could log in via remote desktop through port 3389. It was really fast.
In my past belief, I always thought hackers wouldn’t attack personal computers because there’s no ransom value. But this time, the hackers taught me a lesson.
One day I turned on my computer and all my files had turned into this.
我的桌面也
刚一看到这种情况，我整个人是蒙的，还以为是电脑出了什么 bug 。
为了弄清楚情况，我就百度搜了一下 “.Devos” 是什么文件。
出现了以下两篇文章。
https://zhuanlan.zhihu.com/p/361606330
https://www.grit.com.cn/Ransomware/devos
这个时候我终于知道，我的电脑中病毒了。让我疑惑的是，好端端的电脑怎么会中病毒呢？
回想一下最近我对这台电脑做了什么，一个是开启了 frpc 客户端，一个是挂载了 webdav 做网络硬盘。
由于事件就发生在我挂载网络硬盘的第二天，我就先去检查了一下另一个挂载了相同 webdav 的电脑，一切运行正常。
接下来开始排查是不是 frp 导致的电脑中毒呢？
先百度搜索一下。
搜到了下面这篇博客。
https://blog.csdn.net/ml344739968/article/details/104718259
这篇博客的最后也说了，frp 实际上是不背锅的，是我电脑的登录密码太简单了。
由于这篇博客的标题提到了是用 frp 导致的，我又去 frp 项目下看了一下 issue，就看到了这种发言。
因为我的电脑上是一个多用户的环境，我想尝试登录一下其他账户看一看。
这时我才突然发现，我有一个账户的登录密码竟然是 1234
到现在，我终于明白中毒的根本原因了。
我登录了这个账号，还看到了作案现场。
我看了一下程序的名字，去任务管理器里面把程序停止了。
接下来，看看控制台窗口具体显示的什么东西。
看到他在扫描 IP ，卧槽，我一下更慌了，我的电脑没什么价值，可是别连累局域网的大家啊。😰
赶紧跟两名同学确认了一下，他们的电脑还没事，暂时可以放心了。
事后又去查了一下其他的博客，看到很多和我一样中毒的人。
https://www.jianshu.com/p/d62034ad50ad
又看了看 360 的科普。
这个时候我才意识到，把内网服务暴露在公网是多么的危险。
我想到我的作为服务器的笔记本也是暴露在公网的，并且还开放了所有端口，一切都是向着最不安全的方向设置的。可能是使用甲骨文云留下来的习惯。
我还感觉我家的网络有点卡，不知道是巧了还是我慌了😂
吓得我赶紧拔掉服务器的网线，过了今晚，明早再说吧。
第二天打开服务器，感觉网络有问题，ping 一下 127.0.0.1 吧。
天哪，连这个都 ping 不通了，网上查了一下说是 TCP/IP 协议栈损坏了。
不是说 Linux 是很稳定的操作系统吗？好端端的怎么会内核出问题呢？难道真的被攻击了？我也不确定。
也没有查到修复的办法，我就干脆重装系统了，并且这次设置了最复杂的密码，不用的端口一个也不开，部署的网站都只允许使用 https。我有限的学识里能做的只有这些了。
ssh 我设置了一下密码登录，看了一下宝塔面板。大概也就半个小时，1000 多次失败的登录！
我又一次感受到了公网上有多危险。 😰
赶紧把 ssh 关了。
亲身经历了一次中招，以后就不敢大意了，重新部署服务器之前有在 B站看了几个服务器加固的视频。😂
总结一下，这次中毒的根本原因是我使用了 1234 这种弱密码。
希望大家引以为戒吧。
哎，家里有一个 1050 显卡，先搭个环境跑跑实验吧。
My desktop too
The moment I saw this, my mind went blank. I thought my computer had some kind of bug.
To figure out what was going on, I searched Baidu for what a “.Devos” file is.
The following two articles came up.
https://zhuanlan.zhihu.com/p/361606330
https://www.grit.com.cn/Ransomware/devos
At this point I finally realized my computer was infected with a virus. What puzzled me was how a perfectly fine computer could get infected.
Let me think about what I’d done to this computer recently: one was enabling the frpc client, and the other was mounting webdav as a network drive.
Since the incident happened the day after I mounted the network drive, I first checked another computer that had mounted the same webdav, and everything was running normally.
Next, let’s investigate whether frp caused the infection.
First, let me search on Baidu.
I found the following blog post.
https://blog.csdn.net/ml344739968/article/details/104718259
At the end of this blog post, it also says that frp is actually not to blame - it’s because my computer’s login password was too simple.
Since the title of this blog post mentioned that it was caused by frp, I went to look at the issues under the frp project and saw this kind of comment.
Since my computer was a multi-user environment, I tried logging into another account to take a look.
It was only then that I suddenly discovered that the login password for one of my accounts was actually 1234
By now, I finally understood the root cause of the infection.
I logged into that account and even saw the scene of the crime.
I looked at the program’s name and stopped it in the Task Manager.
Next, let’s see what exactly the console window was showing.
Seeing it scanning IP addresses, damn, I panicked even more. My computer isn’t worth anything, but please don’t drag everyone on the LAN down with it. 😰
I quickly checked with two classmates, and their computers were still fine, so I could relax for now.
Afterwards I searched other blogs and saw many people infected just like me.
https://www.jianshu.com/p/d62034ad50ad
It was at this moment that I realized how dangerous it is to expose internal network services to the public internet.
I thought of my laptop that serves as a server, which is also exposed to the public internet with all ports open - everything was set up in the least secure direction possible. It might be a habit left over from using Oracle Cloud.
I also felt my home network was a bit laggy; I don’t know if it was a coincidence or if I was just panicking 😂
Scared, I quickly unplugged the server’s network cable. Let it wait until tomorrow morning.
The next day I turned on the server and felt the network was having problems. Let me ping 127.0.0.1.
Oh my god, even this couldn’t be pinged. I looked it up online and it said the TCP/IP protocol stack was corrupted.
Isn’t Linux supposed to be a very stable operating system? How could the kernel have problems out of the blue? Was it really attacked? I’m not sure either.
I couldn’t find a fix either, so I simply reinstalled the system. This time I set the most complex password, didn’t open a single unused port, and only allowed https for the deployed websites. That’s all I could do with my limited knowledge.
I set up password login for ssh and took a look at the BT panel. In about half an hour, there were over 1000 failed login attempts!
Once again I felt how dangerous the public internet is. 😰
I quickly turned off ssh.
Having experienced an infection firsthand, I won’t dare to be careless again. Before redeploying the server, I watched a few server hardening videos on Bilibili. 😂
To summarize, the root cause of this infection was my use of a weak password like 1234.
I hope everyone can learn from my mistake.
Sigh, there’s a 1050 GPU at home. Let me set up an environment and run some experiments first.
