Exploit in Calibre docker image?

[Markus29]

Ik heb thuis een server draaien met al mijn media, Homeassistant en Nextcloud. Allemaal achter een SWAG reverse proxy.
Ik gebruik daarvoor al ruime tijd naar volle tevredenheid Dockstarter, waarmee je relatief eenvoudig de juiste Docker containers aan kunt vinken en de juiste configuratie in kunt stellen.
Tot mijn schrik zag ik gisteren dat de CPU bezetting sinds 5:00 naar 100% ging. Een vlugge blik met htop leerde mij dat er een miner stond te draaien:


Pogingen om de miner te killen of te throttlen leken niet te werken, er bleven gewoon weer nieuwe processen opduiken. Dus de server maar offline gehaald en de logs geïnspecteerd.

In de bash history was niks te vinden, dus waarschijnlijk is er geen toegang geweest tot de cli (of de hacker heeft z'n eigen commando's gewist)

In de Access.log van SWAG zag ik wel het volgende:

code:

IP_RANGE_1 - - [09/Oct/2025:03:32:04 +0200] "\x17\x03\x03\x03e4C\xEB\xA6\xCD\xFDnL\x93\xC7\x04\xF4\x9C\xEC\x17q=\xFCK\xEC\xD0|^4\xB4\xDDST\x96\xAB\xCFk\xEF\x07\xC3\xB8\xCEWK\xF5\xD8<\xD6\xE6\x8D\xC5\x881\xCD\xE2\xDCp\x9A\x1B\x8E\x85\x1F\x81\xB8-\xF1\xE5;\xD9\x96I`\xB9D\x94\xBF\x19\xEA\x8A`\xF0u\xFA!\xB6L9Ww\x1C\xD0\xB8&\xDBry3\x071\xB3_/\xF1\x0B\xD0\xB5\x1C\x92`\xD2\x97\xEA;\xDA\xF5\xAB\xA9\xC2\xEB\x04(\xDF\x04\xA6\xBE\xF0\x96\xDD\x8D_\xF5\x00\xA8\xC4\xE6\x0C%\xABW\x8Ct\x97M\xBC\xEFG\x1D\xED\xB17\xDF+\xACj \x1E\xF6g\xD7.d\x82\x9A\xEAZ\x5C\x12\xAB\xE1\xAD\xADt\xFAA\x92\x1D3A\xDA\xB1w\xB4\xFD\x14*E\x8A\xE9vG\x1C\xB2\xDF\xF6\x899\x1E\x00\x5C0,D\x86\x14\x9D\xD9PW/R\x94\xBD\xA3@-\x07\xCB\xF9\xAC\xCF\xE5\x98L\xB3'E)\xB5\x9B\xB7\xAC\xE2-\xF6J2\x03fn\xB0\x0C\x01\xB3\xDA\xDC\xE4WK\xB7" 400 150 "-" "-"
IP_RANGE_2 - - [09/Oct/2025:03:33:51 +0200] "\x16\x03\x01\x00{\x01\x00\x00w\x03\x03\xB7B\xE11\xDE\xC0\x80t\xE8\xA3\x1D\xE9\x0F\xFE\xD9\x1C\x19\xB5?\x89<\x18c`\x98\xD9" 400 150 "-" "-"
IP_RANGE_3 - - [09/Oct/2025:03:36:56 +0200] "GET /index.php/204 HTTP/1.1" 204 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/3.34.0"
[REPEATED_NEXTCLOUD_ENTRIES...]
IP_RANGE_4 - - [09/Oct/2025:03:49:46 +0200] "CONNECT httpbin.org:443 HTTP/1.1" 400 150 "-" "-"
IP_RANGE_5 - - [09/Oct/2025:03:51:21 +0200] "MGLNDD_IP_RANGE_3_80" 400 150 "-" "-"
[REPEATED_NEXTCLOUD_ENTRIES...]
IP_RANGE_6 - - [09/Oct/2025:03:53:45 +0200] "GET / HTTP/1.1" 301 162 "-" "bitdiscovery-suggestions"
IP_RANGE_6 - - [09/Oct/2025:03:53:46 +0200] "GET / HTTP/1.1" 502 150 "-" "-"
IP_RANGE_6 - - [09/Oct/2025:03:54:06 +0200] "GET / HTTP/1.1" 502 150 "-" "bitdiscovery-suggestions"
IP_RANGE_4 - - [09/Oct/2025:04:03:31 +0200] "CONNECT httpbin.org:443 HTTP/1.1" 400 150 "-" "-"
[REPEATED_NEXTCLOUD_ENTRIES...]
IP_RANGE_7 - - [09/Oct/2025:04:10:03 +0200] "\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr" 400 150 "-" "-"
IP_RANGE_8 - - [09/Oct/2025:04:11:51 +0200] "GET / HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
IP_RANGE_9 - - [09/Oct/2025:04:16:41 +0200] "GET / HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
IP_RANGE_10 - - [09/Oct/2025:04:26:07 +0200] "GET / HTTP/1.1" 400 650 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36"
IP_RANGE_11 - - [09/Oct/2025:04:28:12 +0200] "GET /.git/refs/remotes/ HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; Android 8.0.0; SM-A910F) AppleWebKit/537.36"
[REPEATED_NEXTCLOUD_ENTRIES...]
IP_RANGE_3 - - [09/Oct/2025:04:57:59 +0200] "POST /api/webhook/REDACTED_WEBHOOK_ID HTTP/1.1" 200 6927 "-" "Home Assistant/2025.8.7-17352 (Android 13; SM-G781B)"
IP_RANGE_3 - - [09/Oct/2025:04:57:59 +0200] "POST /api/webhook/REDACTED_WEBHOOK_ID HTTP/1.1" 200 6927 "-" "Home Assistant/2025.8.7-17352 (Android 13; SM-G781B)"
IP_RANGE_12 - - [09/Oct/2025:05:07:15 +0200] "GET / HTTP/1.1" 200 595 "-" "Mozilla/5.0 (compatible; ModatScanner/1.1; +https://modat.io/)"
IP_RANGE_13 - - [09/Oct/2025:05:11:26 +0200] "\x16\x03\x01\x00\xEA\x01\x00\x00\xE6\x03\x03`f\xA8\x0C\x0E\xFE\xECC\xAE\x1ETQH\xB1\x85\x84y\xEE,N4\xEC$\x85\xAB\x16\x8B+\xDD\xEE\xFB\x7F 4\xC0\xF8\xC9B\xA9d\x13\x8E\xE9\x94\x93\x9D\x04\xC8\x22\x83\xA5\x9E\x9E\xB3\xC9\xD3\xBA\xA8:\x10\xC4\x8DMM \x00&\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x09\xC0\x13\xC0" 400 150 "-" "-"
IP_RANGE_13 - - [09/Oct/2025:05:11:36 +0200] "GET / HTTP/1.1" 400 0 "-" "-"
IP_RANGE_13 - - [09/Oct/2025:05:12:10 +0200] "GET / HTTP/1.1" 400 0 "-" "-"

Dit is slechts een selectie, er werd sinds begin oktober al gezocht naar kwetsbaarheden.
Aangezien ik nergens bewijs kon vinden dat de hacker daadwerkelijk toegang had gekregen via de proxy, waren de docker containers de volgende verdachte:

code:

Oct 09 04:00:43 Docker watchtower[786]: time="2025-10-09T04:00:43+02:00" level=info msg="Found new lscr.io/linuxserver/jackett:latest image (90ad38b535ef)"
Oct 09 04:00:55 Docker watchtower[786]: time="2025-10-09T04:00:55+02:00" level=info msg="Found new eclipse-mosquitto:latest image (bd1d569fb062)"
Oct 09 04:01:24 Docker watchtower[786]: time="2025-10-09T04:01:24+02:00" level=info msg="Found new lscr.io/linuxserver/lidarr:latest image (feb69c3671ec)"
Oct 09 04:01:59 Docker watchtower[786]: time="2025-10-09T04:01:59+02:00" level=info msg="Found new lscr.io/linuxserver/calibre:latest image (cd13e4256be2)"
Oct 09 04:02:09 Docker watchtower[786]: time="2025-10-09T04:02:09+02:00" level=info msg="Found new lscr.io/linuxserver/prowlarr:latest image (4142daf406e4)"
Oct 09 04:02:17 Docker watchtower[786]: time="2025-10-09T04:02:17+02:00" level=info msg="Stopping /prowlarr (f60f66ad3145) with SIGTERM"
Oct 09 04:02:21 Docker watchtower[786]: time="2025-10-09T04:02:21+02:00" level=info msg="Stopping /calibre (b67359e9a33f) with SIGTERM"
Oct 09 04:02:21 Docker calibre[786]: Waiting up to 5 seconds for desktop processes to terminate...
Oct 09 04:02:26 Docker calibre[786]: s6-supervise svc-de: warning: finish script lifetime reached maximum value - sending it a SIGKILL
Oct 09 04:02:30 Docker watchtower[786]: time="2025-10-09T04:02:30+02:00" level=info msg="Stopping /lidarr (5aae6811122c) with SIGTERM"
Oct 09 04:02:35 Docker watchtower[786]: time="2025-10-09T04:02:35+02:00" level=info msg="Stopping /mosquitto (ff688c040c88) with SIGTERM"
Oct 09 04:02:36 Docker watchtower[786]: time="2025-10-09T04:02:36+02:00" level=info msg="Stopping /jackett (0c63186e04e2) with SIGTERM"
Oct 09 04:02:40 Docker watchtower[786]: time="2025-10-09T04:02:40+02:00" level=info msg="Creating /jackett"
Oct 09 04:02:41 Docker watchtower[786]: time="2025-10-09T04:02:41+02:00" level=info msg="Creating /mosquitto"
Oct 09 04:02:41 Docker watchtower[786]: time="2025-10-09T04:02:41+02:00" level=info msg="Creating /lidarr"
Oct 09 04:02:42 Docker watchtower[786]: time="2025-10-09T04:02:42+02:00" level=info msg="Creating /calibre"
Oct 09 04:02:42 Docker watchtower[786]: time="2025-10-09T04:02:42+02:00" level=info msg="Creating /prowlarr"
Oct 09 04:02:43 Docker calibre[786]: [migrations] started
Oct 09 04:02:43 Docker calibre[786]: [migrations] no migrations found
Oct 09 04:02:43 Docker watchtower[786]: time="2025-10-09T04:02:43+02:00" level=info msg="Removing image aa67f9c18c82"
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker calibre[786]:       ██╗     ███████╗██╗ ██████╗
Oct 09 04:02:44 Docker calibre[786]:       ██║     ██╔════╝██║██╔═══██╗
Oct 09 04:02:44 Docker calibre[786]:       ██║     ███████╗██║██║   ██║
Oct 09 04:02:44 Docker calibre[786]:       ██║     ╚════██║██║██║   ██║
Oct 09 04:02:44 Docker calibre[786]:       ███████╗███████║██║╚██████╔╝
Oct 09 04:02:44 Docker calibre[786]:       ╚══════╝╚══════╝╚═╝ ╚═════╝
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker calibre[786]:    Brought to you by linuxserver.io
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker calibre[786]: To support LSIO projects visit:
Oct 09 04:02:44 Docker calibre[786]: https://www.linuxserver.io/donate/
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]: GID/UID
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker calibre[786]: User UID:    1000
Oct 09 04:02:44 Docker calibre[786]: User GID:    1000
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]: Linuxserver.io version: v8.12.0-ls362
Oct 09 04:02:44 Docker calibre[786]: Build-date: 2025-10-08T06:50:33+00:00
Oct 09 04:02:44 Docker calibre[786]: ───────────────────────────────────────
Oct 09 04:02:44 Docker calibre[786]:
Oct 09 04:02:44 Docker watchtower[786]: time="2025-10-09T04:02:44+02:00" level=info msg="Removing image 3b548e4de8f5"
Oct 09 04:02:45 Docker watchtower[786]: time="2025-10-09T04:02:45+02:00" level=info msg="Removing image 42292b8c6592"
Oct 09 04:02:45 Docker watchtower[786]: time="2025-10-09T04:02:45+02:00" level=info msg="Removing image 173e4230c45d"
Oct 09 04:02:45 Docker watchtower[786]: time="2025-10-09T04:02:45+02:00" level=info msg="Removing image 3d4e9952b966"
Oct 09 04:02:45 Docker watchtower[786]: time="2025-10-09T04:02:45+02:00" level=info msg="Session done" Failed=0 Scanned=32 Updated=5 notify=no
Oct 09 04:02:46 Docker calibre[786]: [ls.io-init] Creating initial backup of system rc.xml
Oct 09 04:02:47 Docker calibre[786]: [custom-init] No custom files found, skipping...
Oct 09 04:02:47 Docker calibre[786]: _XSERVTransmkdir: ERROR: euid != 0,directory /tmp/.X11-unix will not be created.
Oct 09 04:02:47 Docker calibre[786]: screen 0 shmid 0
Oct 09 04:02:47 Docker calibre[786]: xsettingsd: Loaded 1 setting from /config/.xsettingsd
Oct 09 04:02:47 Docker calibre[786]: [ls.io-init] done.
Oct 09 04:02:51 Docker calibre[786]: The XKEYBOARD keymap compiler (xkbcomp) reports:
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86CameraAccessEnable
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86CameraAccessDisable
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86CameraAccessToggle
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86NextElement
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86PreviousElement
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86AutopilotEngageToggle
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86MarkWaypoint
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86Sos
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86NavChart
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86FishingChart
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86SingleRangeRadar
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86DualRangeRadar
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86RadarOverlay
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86TraditionalSonar
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86ClearvuSonar
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86SidevuSonar
Oct 09 04:02:51 Docker calibre[786]: > Warning:          Could not resolve keysym XF86NavInfo
Oct 09 04:02:51 Docker calibre[786]: Errors from xkbcomp are not fatal to the X server
Oct 09 04:02:51 Docker calibre[786]: xsettingsd: Created window 0x200001 on screen 0 with timestamp 404282787
Oct 09 04:02:51 Docker calibre[786]: xsettingsd: Selection _XSETTINGS_S0 is owned by 0x0
Oct 09 04:02:51 Docker calibre[786]: xsettingsd: Took ownership of selection _XSETTINGS_S0

Oct 09 04:02:51 Docker calibre[786]: 19
Oct 09 04:02:52 Docker calibre[786]: 20
Oct 09 04:02:54 Docker calibre[786]: dbus-daemon[282]: [system] Activating service name='org.freedesktop.login1' requested by ':1.26' (uid=0 pid=383 comm="su") (using servicehelper)
Oct 09 04:02:54 Docker calibre[786]: dbus-daemon[282]: [system] Activated service 'org.freedesktop.login1' failed: Failed to execute program org.freedesktop.login1: Permission denied
Oct 09 04:02:54 Docker calibre[786]: dbus-daemon[282]: [system] Activating service name='org.freedesktop.login1' requested by ':1.27' (uid=0 pid=395 comm="su") (using servicehelper)
Oct 09 04:02:54 Docker calibre[786]: dbus-daemon[282]: [system] Activated service 'org.freedesktop.login1' failed: Failed to execute program org.freedesktop.login1: Permission denied
Oct 09 04:02:55 Docker calibre[786]: INFO:data_websocket:pcmflux library found. Audio capture is available.
Oct 09 04:02:55 Docker calibre[786]: INFO:data_websocket:pixelflux library found. Striped encoding modes available.
Oct 09 04:02:56 Docker calibre[786]: INFO:root:Expected C js_config_t size (from ctypes): 1354 bytes
Oct 09 04:02:57 Docker calibre[786]: INFO:main:Upload directory ensured: /config/Desktop
Oct 09 04:02:57 Docker calibre[786]: INFO:main:Starting Selkies (WebSocket Mode) with settings: {'audio_enabled': (True, False), 'microphone_enabled': (True, False), 'gamepad_enabled': (True, False), 'clipboard_enabled': (True, False), 'command_enabled': (True, False), 'file_transfers': ['upload', 'download'], 'encoder': 'x264enc', 'framerate': (8, 120), 'h264_crf': (5, 50), 'jpeg_quality': (1, 100), 'h264_fullcolor': (False, False), 'h264_streaming_mode': (False, False), 'use_cpu': (False, False), 'use_paint_over_quality': (True, False), 'paint_over_jpeg_quality': (1, 100), 'h264_paintover_crf': (5, 50), 'h264_paintover_burst_frames': (1, 30), 'second_screen': (True, False), 'audio_bitrate': '320000', 'is_manual_resolution_mode': (False, False), 'manual_width': 0, 'manual_height': 0, 'scaling_dpi': '96', 'enable_binary_clipboard': (False, False), 'use_browser_cursors': (False, False), 'use_css_scaling': (False, False), 'ui_title': 'Selkies', 'ui_show_logo': (True, False), 'ui_show_core_buttons': (True, False), 'ui_show_sidebar': (True, False), 'ui_sidebar_show_video_settings': (True, False), 'ui_sidebar_show_screen_settings': (True, False), 'ui_sidebar_show_audio_settings': (True, False), 'ui_sidebar_show_stats': (True, False), 'ui_sidebar_show_clipboard': (True, False), 'ui_sidebar_show_files': (True, False), 'ui_sidebar_show_apps': (True, False), 'ui_sidebar_show_sharing': (True, False), 'ui_sidebar_show_gamepads': (True, False), 'ui_sidebar_show_fullscreen': (True, False), 'ui_sidebar_show_gaming_mode': (True, False), 'ui_sidebar_show_trackpad': (True, False), 'ui_sidebar_show_keyboard_button': (True, False), 'ui_sidebar_show_soft_buttons': (True, False), 'port': 8082, 'dri_node': '', 'audio_device_name': 'output.monitor', 'watermark_path': '', 'watermark_location': -1, 'debug': (False, False), 'enable_sharing': (True, False), 'enable_collab': (True, False), 'enable_shared': (True, False), 'enable_player2': (True, False), 'enable_player3': (True, False), 'enable_player4': (True, False)}
Oct 09 04:02:57 Docker calibre[786]: INFO:main:Initial Encoder: x264enc, Framerate: 60
Oct 09 04:02:57 Docker calibre[786]: INFO:main:SelkiesStreamingApp initialized: encoder=x264enc, display=1024x768
Oct 09 04:02:57 Docker calibre[786]: INFO:main:All main components initialized. Running server...
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:System DPI detected as ~96. Cursor size cap set to 32x32px.
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Resetting keyboard modifiers.
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Clipboard monitor running (binary mode: False)
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Found XFIXES version 4.0
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:starting cursor monitor
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:watching for cursor changes
Oct 09 04:02:57 Docker calibre[786]: WARNING:data_websocket:Cannot broadcast cursor data: no clients connected or server not ready.
Oct 09 04:02:57 Docker calibre[786]: INFO:data_websocket:Data WebSocket Server listening on port 8082
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Initializing 4 persistent gamepad instances...
Oct 09 04:02:57 Docker calibre[786]: INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js0): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js0.sock, EVDEV socket: /tmp/selkies_event1000.sock. Using fixed config: Microsoft X-Box 360 pad
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Initialized and started persistent gamepad instance for index 0 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js0.sock, EVDEV: /tmp/selkies_event1000.sock).
Oct 09 04:02:57 Docker calibre[786]: INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js1): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js1.sock, EVDEV socket: /tmp/selkies_event1001.sock. Using fixed config: Microsoft X-Box 360 pad
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Initialized and started persistent gamepad instance for index 1 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js1.sock, EVDEV: /tmp/selkies_event1001.sock).
Oct 09 04:02:57 Docker calibre[786]: INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js2): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js2.sock, EVDEV socket: /tmp/selkies_event1002.sock. Using fixed config: Microsoft X-Box 360 pad
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Initialized and started persistent gamepad instance for index 2 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js2.sock, EVDEV: /tmp/selkies_event1002.sock).
Oct 09 04:02:57 Docker calibre[786]: INFO:root:Packed js_config payload for 'Microsoft X-Box 360 pad' (js3): len=1360 bytes. Name='Microsoft X-Box 360 pad', Vendor=0x045e, Product=0x028e, Version=0x0100, Reported Buttons=11 (Array capacity: 512), Reported Axes=8 (Array capacity: 64)
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad configured. JS socket: /tmp/selkies_js3.sock, EVDEV socket: /tmp/selkies_event1003.sock. Using fixed config: Microsoft X-Box 360 pad
Oct 09 04:02:57 Docker calibre[786]: INFO:webrtc_input:Initialized and started persistent gamepad instance for index 3 (Name: 'Microsoft X-Box 360 pad', JS: /tmp/selkies_js3.sock, EVDEV: /tmp/selkies_event1003.sock).
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad /tmp/selkies_js0.sock: Event processor started.
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js0.sock
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad /tmp/selkies_js1.sock: Event processor started.
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js1.sock
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad /tmp/selkies_js2.sock: Event processor started.
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js2.sock
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:Gamepad /tmp/selkies_js3.sock: Event processor started.
Oct 09 04:02:57 Docker calibre[786]: INFO:selkies_gamepad:JS interposer server listening on /tmp/selkies_js3.sock
Oct 09 04:02:58 Docker calibre[786]: INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1000.sock
Oct 09 04:02:58 Docker calibre[786]: INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1001.sock
Oct 09 04:02:58 Docker calibre[786]: INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1002.sock
Oct 09 04:02:58 Docker calibre[786]: INFO:selkies_gamepad:EVDEV interposer server listening on /tmp/selkies_event1003.sock
Oct 09 04:17:58 Docker calibre[786]: WARNING:webrtc_input:Error reading clipboard with xclip:

Het lijkt er op dat watchtower een update binnen haalde en de geupdate docker container daarna gelijk een exploit draaide om op afstand toegang te krijgen en mijn clipboard uit te lezen. Er bleek binnen de container inderdaad een .config directory te zijn waar een scriptje stond dat xmrig downloade, verbinding maakt met een pool (pool.supportxmr.com) en in een loop nieuwe miner processen start.

Nu rest mij nog de vraag, was de docker image zelf de schuldige, of kon deze .config directory op een andere manier open staan? Vanzelfsprekend heb ik de calibre container verwijderd, is de rest van de server nog wel safe?

[grasmanek94]

Ik heb hier niet genoeg verstand van om inhoudelijk op in te gaan.

Wat ik wel kan zeggen, ik denk dat je probleem bespreken op https://github.com/linuxserver/docker-calibre/issues meer experts zal aantrekken, alhoewel Tweakers forum ook een prima platform is hoor.

Dezelfde webrtc_input error zie ik wel hier voorbij komen: https://ci-tests.linuxser...webcord/latest/index.html
(view container logs) dus zal mogelijk iets generieks zijn, en niet een aanval op uitlezen van het clipboard.
Er is nog een andere link.

xmrig is natuurlijk wel een miner, overduidelijk. Wel apart dat de naam van de binary niet is aangepast om het te proberen te verbergen ofzo.. of juist expres? Maar ja als je zelf geen miner aan hebt gedaan dan zal er inderdaad mogelijk ergens een exploit zijn, al dan niet bij een update in linuxserver.io zelf die mogelijk gecompromiteerd is.

Wat ik aan de webrtc error opmerk is dat deze beide van linuxserver.io builds/tests zijn, en ook nog eens recent (september en oktober), dus misschien is het wel een gehackte poging tot data exfiltratie - of een normale update van apps die nu zo'n warning veroorzaken.

Draaide de miner op de host of onder een docker container?

[ Voor 16% gewijzigd door grasmanek94 op 10-10-2025 13:04 ]

[Raynman]

De discussie lijkt wat ontspoord te zijn (geen zin om het helemaal te lezen), maar misschien relevant: Container image potentially compromised with crypto miner #167

[Markus29]

Raynman schreef op vrijdag 10 oktober 2025 @ 13:10:
De discussie lijkt wat ontspoord te zijn (geen zin om het helemaal te lezen), maar misschien relevant: Container image potentially compromised with crypto miner #167

Daar werd inderdaad hetzelfde besproken. In een PSA zeiden ze ook dat er via de web interface een terminal geopend kan worden met een root account zonder password. Ik had wel een http authenticatie achter SWAG ingesteld, maar dat was blijkbaar te zwak. Vanuit Dockstarter werden ook nog aanvullende beveiligingsinstellingen uitgezet (--security-opt seccomp=unconfined). Ik ga de container voorlopig maar alleen lokaal draaien.

[kodak]

De vraag of je systeem nog veilig genoeg is hangt af van wat de criminelen aan rechten hadden en daarmee gedaan hebben. Daar ga je waarschijnlijk niet zomaar zekerheid over krijgen, zeker als de crimineel root rechten kon krijgen. Dus kun je beter een nieuw systeem opbouwen en alleen veilige backups en gevens terug zetten als je die hebt. Anders hoef je niet verbaasd te zijn als je later nog meer problemen blijkt te hebben, ook al draai je het vanaf nu zonder reverse proxy. En aangezien er geen zekerheid is of de ontwikkelaars de software wel veilig ontwikkelen is het ook verstandig eens goed te bedenken of je wel automatisch updates wil installeren.