Never expose your server IP directly to the internet, vps or baremetal.
I got hacked: My Hetzner server started mining Monero
11–20 of 422 posts
Re: I got hacked: My Hetzner server started mining Monero
#12> Here’s the test. If /tmp/.XIN-unix/javae exists on my host, I’m fucked. If it doesn’t exist, then what I’m seeing is just Docker’s default behavior of showing container processes in the host’s ps output, but they’re actually isolated. /tmp/.XIN-unix/javae & rm /tmp/.XIN-unix/javae This article’s LLM writing style is painful, and it’s full of misinformation (is Puppeteer even involved in the vulnerability?).
Yeah fair, I asked claude to help because honestly this was a little beyond my writing skills. I'm real though. Sorry. Will change
Re: I got hacked: My Hetzner server started mining Monero
#13Never expose your server IP directly to the internet, vps or baremetal.
Is there a way to do that and still be able to access the server?
Re: I got hacked: My Hetzner server started mining Monero
#14This article is very interesting at first but I once again get disappointed after reading clear signs of AI like "Why this matters" and "The moment of truth", and then the whole thing gets tainted with signs all over the place.
Yeah personally I’d much rather read a poorly constructed article with actually interesting content than the same content put into the formulaic AI voice.
Re: I got hacked: My Hetzner server started mining Monero
#15Never expose your server IP directly to the internet, vps or baremetal.
As in "always run a network firewall" or "keep the IP secret"? Because I've had people suggest both and one is silly.
Re: I got hacked: My Hetzner server started mining Monero
#16Re: I got hacked: My Hetzner server started mining Monero
#17> ls -la /tmp/.XIN-unix/javae
Unless ran as root this could return file not found because of missing permissions, and not just because the file doesn't actually exist, right?
> “I don’t use X” doesn’t mean your dependencies don’t use X
That is beyond obvious, and I don't understand how anyone would feel safe from reading about a CVE on a widely used technology when they run dozens of containers on their server. I have docker containers and as soon as I read the article I went and checked because I have no idea what technology most are built with.
> No more Umami. I’m salty. The CVE was disclosed, they patched it, but I’m not running Next.js-based analytics anymore.
Nonsensical reaction.
Re: I got hacked: My Hetzner server started mining Monero
#18> Here’s the test. If /tmp/.XIN-unix/javae exists on my host, I’m fucked. If it doesn’t exist, then what I’m seeing is just Docker’s default behavior of showing container processes in the host’s ps output, but they’re actually isolated. /tmp/.XIN-unix/javae & rm /tmp/.XIN-unix/javae This article’s LLM writing style is painful, and it’s full of misinformation (is Puppeteer even involved in the vulnerability?).
I fixed it, apologies for the misinformation.
Re: I got hacked: My Hetzner server started mining Monero
#19> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?
Either docker or a kernel level exploit. With non-VM containers, you are sharing a kernel.
Re: I got hacked: My Hetzner server started mining Monero
#20> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?
There would be, but a lot of docker containers are misconfigured or unnecessarily privileged, allowing for escape.
Also, if you've been compromised, you may have a rootkit that hides itself from the filesystem, so you can't be sure of a file's existence through a simple `ls` or `stat`.