Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Anonymous person sent proof of SSH access to our production server

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 246 posts

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#61

Post by ktta »

eeZah7Ux wrote: post #53

Do not trust random HN or serverfault answers. Cleanly shutting down the server can trigger rootkits that might wipe evidence: talk to a professional. Pulling the plug can still remove the ability to observe the behavior of the attacker: talk to a professional. Touching the disks can expose you to the risk of being accused of tampering evidence : talk to a professional.

The irony here is that your comment is a random HN comment from an account less than 10 days old :D

In reality, I think random answers on HN (or any answer/advice anywhere) shouldn't be trusted, but rather taken with a grain of salt and think about whether the answer really helps you.

>Touching the disks can expose you to the risk of being accused of tampering evidence

I don't understand this. What do you say touching the disks is? Like physical touch, or logging in and looking at the logs? I don't think both of those can be attributed to tampering of evidence, like criminal tampering since you use the word 'accused'

On a lighter note, do you always end your sentences with 'talk to a professional'?

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#62

Post by [deleted] »

throwaway0727 wrote: post #60

OP here. Thanks for all the responses. I took action and updated firewall settings (which were too loose), ensured that offsite backups are in place if worse comes to worst, rotated all api keys etc, meanwhile trying to contact the anonymous person. Will rebuild the servers asap as well, super glad that we have properly maintained ansible scripts. Also will try my best to convince the CEO to allocate some money for p…

[deleted]

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#63

Post by welder »

throwaway0727 wrote: post #60

OP here. Thanks for all the responses. I took action and updated firewall settings (which were too loose), ensured that offsite backups are in place if worse comes to worst, rotated all api keys etc, meanwhile trying to contact the anonymous person. Will rebuild the servers asap as well, super glad that we have properly maintained ansible scripts. Also will try my best to convince the CEO to allocate some money for p…

None of these things you've done will remove access for this person.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#64

Post by [deleted] »

obi1kenobi wrote: post #58
laumars wrote: post #43

In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…

Consider setting up 2FA for SSH: https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Multi-F... The rest of that article is very helpful as well!

[deleted]

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#65

Post by dozzie »

dimino wrote: post #55
junke wrote: post #45

Earlier quoted context omitted.

Maybe hire that person?

Hire someone because they exploited a single vulnerability?

I've heard of much worse hiring practices than to base on a single display of competence.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#66

Post by jwarren116 »

In addition to all the really great advice already submitted, I really like using Lynis[0] for scanning my servers to get an idea of obvious vulnerabilities and a baseline for hardening ssh. It's absolutely not a substitute for a security expert, but in about 10 minutes of setup you can get an idea of what action items you need to add to the top of your queue.

[0] https://cisofy.com/lynis/

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#67

Post by rimantas »

dimino wrote: post #55
junke wrote: post #45

Earlier quoted context omitted.

Maybe hire that person?

Hire someone because they exploited a single vulnerability?

God forbid. No hire if they cannot reverse binary tree on the whiteboard using angular react e6.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#68

Post by ascendantlogic »

danesparza wrote: post #3

This has been covered elsewhere (like on serverfault: http://serverfault.com/a/107346/2557 ) But it comes down to: - Take existing server down immediately. I'm assuming it is not on an isolated network -- so this should really be a priority. - Prep a new patched server (with a smaller attack surface and updated security credentials) - Postmortem the old box on an isolated network. Try to understand how the attacker g…

If the box is on AWS, make sure to make an AMI snapshot of it for later postmortem. Also create a security group just for boxes built using that AMI that specifically only allows the minimum amount of access required to do the postmortem.

Re: Ask HN: Anonymous person sent proof of SSH access to our production server

#69

Post by FilterSweep »

ktta wrote: post #61
eeZah7Ux wrote: post #53

Do not trust random HN or serverfault answers. Cleanly shutting down the server can trigger rootkits that might wipe evidence: talk to a professional. Pulling the plug can still remove the ability to observe the behavior of the attacker: talk to a professional. Touching the disks can expose you to the risk of being accused of tampering evidence : talk to a professional.

The irony here is that your comment is a random HN comment from an account less than 10 days old :D In reality, I think random answers on HN (or any answer/advice anywhere) shouldn't be trusted, but rather taken with a grain of salt and think about whether the answer really helps you. >Touching the disks can expose you to the risk of being accused of tampering evidence I don't understand this. What do you say touchin…

> I don't understand this. What do you say touching the disks is? Like physical touch, or logging in and looking at the logs?

Is this sarcasm?

If not, hypothetical situation for you:

OP works at a company that processes card information of customers. A hacker demonstrated gaining unauthorized access to production servers. Hacker pulls a db dump as well as any keys used in encryption of data (some bad practices here, but this is common). Hacker does not tell OP of his additional actions, only demonstrates unauthorized SSH entry.

OP does the logically correct thing of wiping his db servers, and "cleaning" the machine, because, well, mitigation of future damage.

Hacker pissed he/she was not given reward for demonstrating his proof of vulnerability, uses this production data for ill will. A third party audit (which will happen) finds that OP has done a full wipe of the server - logs for who pulled vulnerable information is now unknown.

With no finger to point (the hacker contacted him "anonymously", remember) OP is then implicated.

Post reply on HN