Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Anonymous person sent proof of SSH access to our production server

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 246 posts

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#21

Post by dpina »

danesparza wrote: post #3

This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 ) But it comes down to: - Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority. - Prep a new patched server (with a smaller attack surface and updated security credentials) - Postmortem the old box on an isolated network. Try to understand how the attacker g…

Also, wipe clean the existing server after the Postmortem. Even if fairly sure that the server can be cleaned it's never safe to re-use a box which was compromised.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#22

Post by barrystaes »

ryanlol wrote: post #2

>We are a small company and don't have any security experts, etc. Find one.

Well to be fair, one has found them. In parallel to doing damage control as mention before i would certainly contact the party and friendly invite them to share more information in exchange for a token of good faith (discount or a gadget). If you feel good about it, offer a job with reward to fix it.

If unsure about how much a reward should be, keep in mind how expensive it could get without.. often a costly chain-reaction of disasters.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#23

Post by ryanlol »

CiPHPerCoder wrote: post #18
ryanlol wrote: post #2

>We are a small company and don't have any security experts, etc. Find one.

This isn't the most insightful or actionable comment, but it is the correct solution for both the short term problem and many long term problems.

There's not much insightful advice to be given, chances are this guy could've easily traversed to every box on their network and set up a plethora of backdoors.

Without a "security expert" there really is nothing they can do.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#25

Post by riprowan »

ryanlol wrote: post #20
Fuxy wrote: post #12

Earlier quoted context omitted.

Or contact the person if you can and ask them how they got in maybe even offer him a financial reward. Since he contact you Anonymously and is not trying to extort you he's just trying to point the issue out so there's no point in over reacting.

How much would you trust that person? Enough to potentially risk your business on them?

You are already trusting that person enough to risk your business on them, if that server is still up and running after finding the security hole.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#26

Post by barrystaes »

itstripe wrote: post #15

Re-install the server On new re-installed server: 1. Change SSH service port to non-default one. 2. Do not allow root user to remotely connect (change sshd config) 3. Create new user which you will be using for administration to login as root. 4. If possible restrict which IP addresses are allowed to connect via SSH using firewall.

I would worry less about this, and more about where did he find the root password and ip. Change other passwords too, like email.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#27

Post by ryanlol »

riprowan wrote: post #25
ryanlol wrote: post #20

Earlier quoted context omitted.

How much would you trust that person? Enough to potentially risk your business on them?

You are already trusting that person enough to risk your business on them, if that server is still up and running after finding the security hole.

It's not just about that server though, who knows if the other servers were compromised?

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#29

Post by 0xmohit »

You should ensure that (1) password authentication is disabled, (2) existing ssh keys are recycled (if only password authentication was used earlier, generate those [2]).

Subsequently, refer to "Essential Security for Linux Servers" [0] and "7 Security Measures to Protect Your Servers" [1].

[0] https://plusbryan.com/my-first-5-minutes-on-a-server-or-esse...

[1] https://www.digitalocean.com/community/tutorials/7-security-...

[2] https://www.digitalocean.com/community/tutorials/how-to-set-...

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#30

Post by joobus »

dpina wrote: post #21
danesparza wrote: post #3

This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 ) But it comes down to: - Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority. - Prep a new patched server (with a smaller attack surface and updated security credentials) - Postmortem the old box on an isolated network. Try to understand how the attacker g…

Also, wipe clean the existing server after the Postmortem. Even if fairly sure that the server can be cleaned it's never safe to re-use a box which was compromised.

Use one of these: http://www.wnd.com/files/2015/08/hillary-clinton-secret-serv...
Post reply on HN