OP's system got compromised.
His system was compromised - hotio's containers are all clean
/s
https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...
Perhaps take a class in sarcasm?
https://github.com/hotio/qbittorrent/pkgs/container/qbittorr...
Based on https://github.com/hotio/base
Should be tracable via GitHub Actions logs for anyone signed on - if it is indeed supply-chain and not a qbittorrent exploit or something else.
Ps. I do have such binary on my machine as well, ps -ef | grep netservlet root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet
Code and CI is all open source.
It looks like the app used weak hard-coded admin credentials back then. Appears to have been fixed in 2023.
> ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet
You all really think that hotio snuck a crypto miner in somehow with all clearly open source code - and not a single person but OP noticed for years?
So we should not deny the possibility of something off here.
According to some messages on Hotio’s Discord server from 2023-11-25, qBitTorrent moved from fixed admin credentials to randomized at initialization. I think MrHotio’s message about that crypto miner was likely a joke about people installing the older vulnerable version and the efficiency of unauthorized people installing xrig on servers with default credentials.
If author was pinned to an old version of the docker image and their server had internet-visible IP, they probably got their server infected because of weak security defaults in the app installed on the image.
OP's system got compromised at some point; the images are clean.
Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system
A bit suspicious, don't you think?
dalmo3•58m ago
thephyber•12m ago
But there’s no evidence presented that it was hotio’s docker image on GCHR which was compromised, and there is reason to believe it might be an older, vulnerable version of qbittorrent in the docker image which was compromised.
The vulnerability: (credit crtasm)
https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...