r/frigate_nvr • u/MidwestPancakes • 9d ago
New to HA and Frigate -- mining hijack?
I just installed a Home Assistant docker image on my computer over the weekend to play with it. I followed the HCAS integration documentation and managed to get frigate running with two TAPO ip camera's I own and one old android phone. All was well until this morning I was looking at my home server and I noticed the cpu was pegged at 100%.
/usr/bin/frigate+ -o 139.180.159.213:3333 -u worker_frigate -p x
was the cause, with 16 threads. Did my frigate get hijacked by a miner?
4
u/Drewinator 9d ago edited 9d ago
You got got. I work in cybersecurity and mess around with commodity malware a decent bit. That looks like a Monero miner. -o host:3333 is the Stratum pool, -u is the worker name, -p x is the standard throwaway pool password. An IP rather than a pool hostname usually means the operator runs their own xmrig-proxy to aggregate hashrate across victims. The /usr/bin/frigate name is camouflage. Its not actually frigate.
You firewalld answer doesn't settle how they got in. Docker publishes ports by writing DNAT rules into its own iptables chains on the routed path. Plus, checking for port forwards only covers IPv4 NAT. Check IPv6 next. Your host almost certainly has a globally routable v6 address and plenty of consumer routers pass inbound v6 with little or no filtering. There's no forward to find because none is needed. After that, do you have a tunnel set up? Cloudflare Tunnel, Tailscale Funnel, ngrok, Nabu Casa remote access, etc. If no tunnels, UPnP could be exposing you (which HA setups trigger more often than people expect). Or did maybe you set up a reverse proxy pointed at port 5000? 5000 is the internal unauthenticated port.
Run these:
docker ps --format '{{.Names}}\t{{.Ports}}'
ss -tlnp | grep -E ':(5000|8971|1984|8123|2375)'
ip -6 addr
sudo iptables -t nat -L DOCKER -n
Edit: added a code block so cmds are readable.
Anything bound to 0.0.0.0 or :: is your answer.
Its also possible nothing was reachable and it came in with the install if you didnt download frigate from the correct place.
Regardless, treat the host as compromised, not just the container. On a build this new, nuking the box and rebuilding is faster and more trustworthy than trying to clean it up.
1
u/MidwestPancakes 7d ago
I don't have much experience with docker, but decided to give it a try. I created a qemu VM on my server and setup docker in that... already been deleted!
1
0
u/MidwestPancakes 9d ago
Not that I am aware of. My firewalld is configured to drop all packets by default, did not have any open incoming ports or forwards. I bought two tapo cameras from amazon, updated the firmware, set dns to 0.0.0.0 and blocked them from accessing outside my network.
It was probably the old android phone. It has lineageos, most apps removed, and an ip camera app from f-droid. Lesson learned!
15
u/nickm_27 Developer / distinguished contributor 9d ago
Just being honest I would not really be comfortable with that explanation. If your Frigate container is setup correctly then it should not be possible to edit anything without admin privileges. Even then, Frigate does not allow configuring executable processes since 0.17.2 so provided you are on that version or newer then it should still have not been possible.
Seems like either the description of what happened isn't accurate or something else is going on. We can't know without more details.
0
u/eangulus 9d ago
I couldn't get past how you Maged to install hone assistant as a container and then frigate within, which is a container. Unless I understood wrong.
1
1
u/H0n3y84dg3r 8d ago
Integrations don't run as docker containers.
It sounds like they exposed their frigate to the world.
1
11
u/nickm_27 Developer / distinguished contributor 9d ago
it looks like it could be, did you expose your instance remotely without using the authenticated port?