Hacker News Reader

No, there was no real connection to the logrotate application. The miner that was running simply replaced argv[0] with "logrotate", presumably to look benign if/when the administrator took a look at the list of running processes.

Miners report progress directly to the configured pool.

It's pretty much a set it and forget it mining.

Tripwire can be used, you just need to add your webroot and update it. These tools aren't new, just not often utilized with the new kids on the block

You're right, I found about it afterwards. I wonder why this hosting company didn't provide it (or an equivalent) out of the box.