lucapinello

Thanks, resubmitted with the right link

Thanks for looking into this! Yes I had open the port 22 and my password was not safe enough I guess. Or alternatively this hack was due a web app I was running in Flask with some vulnerabilities. Stranger thing: the hack happened back in March 2017 but got activated exactly on Jan 1 2018.

Take a look at the perl scripts (for example go.pl)

The images .gif are in reality php scripts (food.gif and food2.gif)

The scripts modify also the crontab and add:

#* * * * * /home/pi/udevd > /dev/null 2>&1 & #* * * * * /tmp/romerito > /dev/null 2>&1 & #* * * * * /home/pi/kblockd > /dev/null 2>&1 & #* * * * * /var/tmp/tfti > /dev/null 2>&1 &

I was running raspbmc on the raspberry pi.

It seems the scripts were there before and got activated just today.

I know but if I need to use an API to an external server I can also launch a command locally. 7$ is not much but I don't see any real benefit unless you want to capture a subsection of a website.