Ask HN: Anonymous person sent proof of SSH access to our production server

Anonymous person (under a nickname) sent screenshot as a proof that they managed to gain SSH access to our production server. The screenshot is legit, information displayed in it could not be faked without actual access.

Just a proof, not some ransom request or anything equal.

What would be a smart next step? Other than checking if there are any security updates for all the software in our stack.

We are a small company and don't have any security experts, etc.

Thanks!

This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 )

But it comes down to:

- Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority.

- Prep a new patched server (with a smaller attack surface and updated security credentials)

- Postmortem the old box on an isolated network. Try to understand how the attacker got in. If necessary, get security professionals involved.

Do you have a way to reply to the person? I don't see any harm in thanking them and asking for more details.

But in the meantime I'd have to assume everything is compromised: save a copy or an image of the server for analysis, but take it offline and build a new one. Rotate all passwords and credentials. Assuming you're not doing something strange with SSH, they probably got legitimate credentials from a compromise somewhere else or password reuse or a compromised development machine, etc. There are guides online for doing this: https://support.rackspace.com/how-to/recovering-from-and-dea...

It sucks. Sorry.

I had something similar thing happen several years ago when I was a grad student. Me and a couple friends were putting together some Facebook apps (when they were a new thing), and one guy didn't escape user input correctly. Some teenager from an Eastern European country (I can't remember which anymore) ran a script to figure out that we were vulnerable to SQL injections. He was a nice enough guy and didn't want anything besides some experience "hacking". We patched up the code and told him thank you.

I understand you're running a business which makes it that much more scary. If he's not asking for ransom, you might ask him how he'd fix it. I know it might seem like blackmail, but you might even offer him a "consulting fee". He's probably just someone looking to try new things out and not malevolent.