I got hacked: My Hetzner server started mining Monero • Hacker News Board

Re: I got hacked: My Hetzner server started mining Monero

#41

Post by jakelsaunders94 » Wed, Dec 17, 2025, 10:08 PM UTC

seafoamteal wrote: post #24

jakelsaunders94 wrote: post #12

Earlier quoted context omitted.

Yeah fair, I asked claude to help because honestly this was a little beyond my writing skills. I'm real though. Sorry. Will change

Hi Jake! Cool article, and it's something I'll keep in mind when I start giving my self-hosted setup a remodel soon. That said, I have to agree with the parent comment and say that the LLM writing style dulled what would otherwise have been a lovely sysadmin detective work article and didn't make me want to explore your site further. I'm glad you're up to writing more of your own posts, though! I'm right there with y…

Thanks for the encouragement! I find it difficult to write articles beyond simply stating a series of facts.

I tried handwriting https://blog.jakesaunders.dev/schemaless-search-in-postgres/ bit I thought it came off as rambling.

Maybe I'll have a go at redrafting this tomorrow in non LLM-ese.

Re: I got hacked: My Hetzner server started mining Monero

#42

Post by Bender » Wed, Dec 17, 2025, 10:09 PM UTC

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

Optimal hardware costs money. Easy to hack machines are free and in nearly unlimited numbers.

Re: I got hacked: My Hetzner server started mining Monero

#43

Post by justinsaccount » Wed, Dec 17, 2025, 10:09 PM UTC

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

If the effectiveness of mining is represented as profit divided by the cost of running the infrastructure, then a CPU that someone else is paying for is worth it as long as the profit is greater than zero.

Re: I got hacked: My Hetzner server started mining Monero

#44

Post by palata » Wed, Dec 17, 2025, 10:11 PM UTC

j45 wrote: post #11

Never expose your server IP directly to the internet, vps or baremetal.

Unless you need it to be reachable from the Internet, at which point it has to be... reachable from the Internet.

Re: I got hacked: My Hetzner server started mining Monero

#45

Post by d4mi3n » Wed, Dec 17, 2025, 10:12 PM UTC

codegeek wrote: post #33

tl:dr: He got hacked but the damage was only restricted to one docker container runn ing Umami (that is built on top of NextJS). Thankfully, he was running the docker container as a non privileged non-root user which saved him big time considering the fact that the attack surface was limited only within the container and could not access the entire host/filesystem. Is there ever a reason someone should run a docker c…

If you're using the container to manage stuff on the host, it'll likely need to be a process running as root. I think the most common form of this is Docker-in-Docker style setups where a container is orchestrating other containers directly through the Docker socket.

Re: I got hacked: My Hetzner server started mining Monero

#46

Post by tolerance » Wed, Dec 17, 2025, 10:13 PM UTC

Was dad notified of the security breach? If not he may want to consider switching hosting providers. Dad deserves a proper LLM-free post mortem.

Re: I got hacked: My Hetzner server started mining Monero

#47

Post by heavyset_go » Wed, Dec 17, 2025, 10:15 PM UTC

I wouldn't trust that boot image or storage again, I'd nuke it for peace of mind.

That said, do you have an image of the box or a container image? I'm curious about it.

Re: I got hacked: My Hetzner server started mining Monero

#48

Post by heavyset_go » Wed, Dec 17, 2025, 10:15 PM UTC

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

Yes, for Monero it is the only real viable option. I'd also assume that the OP's instance is one of many other victims whose total mining might add up to a significant amount of crypto.

Re: I got hacked: My Hetzner server started mining Monero

#49

Post by czbond » Wed, Dec 17, 2025, 10:16 PM UTC

minitech wrote: post #30

Havoc wrote: post #28

Earlier quoted context omitted.

I think a root container can talk to docker daemon and launch additional containers...with volume mounts of additional parts of file system etc. Not particularly confident about that one though

Unintentional vulnerabilities in Docker and the kernel aside, it can only do that if it has access to the Docker API (usually through a bind mount of the Unix socket). Having access to the Docker API is equivalent to having root on the host.

Well $hit. I have been using Docker for installing NPM modules in interactive projects I was testing out. I believed Docker blocked access to the underlying host (my computer).

Thanks for mentioning it - but now... how does one deal with this?

Re: I got hacked: My Hetzner server started mining Monero

#50

Post by jakelsaunders94 » Wed, Dec 17, 2025, 10:17 PM UTC

heavyset_go wrote: post #47

I wouldn't trust that boot image or storage again, I'd nuke it for peace of mind. That said, do you have an image of the box or a container image? I'm curious about it.

Yeah I did consider just killing it, I'm going to keep an eye on it for a few days with a gun to it just in case.

I was lucky in that my DB backups were working so all my persistence wax backed up to S3. I think I could stand up another one in an hour.

Unfortunately I didn't keep an image no. I almost didn't have the foresight to investigate before yeeting the whole box into the sun!