From: Testbed Support for GridPP member institutes <[log in to unmask]> On Behalf Of Adrian Coveney - UKRI STFC
Sent: 12 May 2020 16:37
To: [log in to unmask]
Subject: Re: [HPC-SIG] Compromised of accounts across various UK HPC systems

From: Testbed Support for GridPP member institutes <[log in to unmask]> On Behalf Of David Britton
Sent: 12 May 2020 14:18
To: [log in to unmask]
Subject: Fwd: [HPC-SIG] Compromised of accounts across various UK HPC systems

Hi all,

There appears to be some fairly co-ordinated attack of HPC centres accross the UK (and we are aware of some systems in Germany).

These appear to be compromised by gaining access to (unprotected?) SSH keys on systems already compromised and using them to jump onto others.  We've found three accounts affected at UCL, two UCL ones and one MMM Hub one and are working to identify whether they succeeded in escalating to root (as they have done at some other sites). 

It's worth pointing out that not just HPC systems are affected, we found two of the compromised accounts on our central UCL Unix service.

A good sign is logs showing logins from two UP addresses in China, specifically:

202.120.32.231

159.226.161.107