More likely than not he/she is probably reading this thread.... his nickname might even be on HN, ha!
Ask HN: Anonymous person sent proof of SSH access to our production server
141–150 of 246 posts
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#142Earlier quoted context omitted.
True but I'm working from the angle that If the breach happened via some other means then they'd need some way to remotely execute code to enable SSH, create valid login credentials, and disable the firewall; in which case they already have a more convenient shell access so gaining access to SSH becomes redundant. However it's possible that the attacker's screenshot was of a remote shell initiated via some other mean…
Best not to ask why downvoted. Those people's responses will rarely teach you anything. The kind that would will usually reply instead of downvote. Plus, a few already explained to me it's common for a post to get hit with a few negative votes followed by corrective action as other, open-minded people show up. Happens all the time with mine.
True. I've scratched my head over why some of your posts I've seen have been down voted.
Probably doesn't help I've been working long hours this week so a little on edge to begin with.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#143Earlier quoted context omitted.
If you're going to offer a reward, I suggest making it conditional on revealing how they got in. (This also assumes you're able to contact the person who sent the e-mail.)
> making it conditional on revealing how they got in Do you mean obligatory ? If you really mean conditional, could you elaborate why?
You agree with your parent comment. Making A conditional on B means B is required (though, depending on exact semantics, not necessarily sufficient) for A. A requires at least B.
So: B would be obligatory, given A.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#144In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…
You assume the breach happened over SSH. This is valuable information to securing SSH, but it's entirely possible the original breach happened over some other service, and there were some other steps involved in the breach before the SSH screenshot was taken.
Would this be something like the ability to execute arbitrary code and obtain a passwd file or something like that?
I'm curious how to go from obtaining X info/access to an SSH session.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#145In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…
You assume the breach happened over SSH. This is valuable information to securing SSH, but it's entirely possible the original breach happened over some other service, and there were some other steps involved in the breach before the SSH screenshot was taken.
Would this be something like the ability to execute arbitrary code and obtain a passwd file or something like that?
I'm curious how to go from obtaining X info/access to an SSH session.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#146In terms of hardening against SSH attacks, the principles are quite simple. Your business case might mean that some of the following cannot be applied, but there's plenty of measures below that you can use to harden SSH. 1. firewall - only allow SSH connections from trusted static IPs 2. Use SSH keys then disable password logins. Lots of guides online to create keys, so I'll just cover the 2nd point: as root or sudo,…
One extra tip (if you aren't confident in the above process, and are performing it over SSH, and don't have physical access to the server):
Test the new access before closing the current session! If you made a mistake in any of the steps you will still be able to fix it. If you close the SSH session before testing, and then find that you made a mistake (e.g. forgot to `chmod 600` the private SSH key or something similar) you're stuck!
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#147In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
Unfortunately, it's the later - no details of exploit, just a proof. If this comes to ransom, rather than unethical/unexperienced gray hat thing, are there any good steps to take? Or hiring an expert consultancy is probably the only good option here?
I can't comment on the correct approach in that case, I'm under qualified. I would urge you to make sure you have good backups in a location that can't be compromised (as in, you won't wake up tomorrow to fine them all deleted). If your system already supports this, all the better. Keep in mind the worst case scenario here is that every production server is wiped, which is essentially close to the situation of a natural disaster at the site they are housed. If you don't have a plan on how to deal with a situation like this (disaster recovery/business continuity plans), such as redeploying to the cloud or to a different cloud, or a different datacenter, then that's a thought for the future (and the present if you have time).
I assume a professional computer security firm could help, but I don't know enough about the incentives at play to know whether that's good in practice (if they often deal with situations like this and not just hardening/forensics, I assume they would have good advice). I have no idea what that costs, and whether your business can afford it.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#148In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
Didn't you read the LastPass thread? If the hacker can take down your company, you have to offer them a reward equal to the value of your company.
Not really. The hacker wants to get the most money from you possible, but also an amount that you are realistically able to provide otherwise he/she gets nothing. The maximum amount a company can realistically pay is probably much less than the total value of the company.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#149In addition to the wonderful technical advice already here for how to deal with the server, there is the question for how to deal with the anonymous person. If the proof contained the method of exploit I suggest something along the lines of: "Thank you for bringing this problem to our attention! We are taking steps to resolve the problem now, but would like to reward you for your work. If you let us know how you woul…
Please listen to this advise. Having the proof or maybe only some hints is very important. That might sound far etched but this anonymous person could very well be an insider employee trying to blackmail your company for personal reasons.
Re: Ask HN: Anonymous person sent proof of SSH access to our production server
#150Others have covered on possible ways you can tackle the situation , hopefully you will get through this.
since you have stated that you don't have a dedicated sysadmin , its better to use a platform like Heroku to host your app.
I am not suggesting that it will make your website/app inherently secure, but at least it removes a lot of pain points.