Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

51–60 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#51

Post by michaelt »

V__ wrote: post #5

> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

Firstly, the attacker just wants to mine Monero with CPU, they can do that inside the container.

Second, even if your Docker container is configured properly, the attacker gets to call themselves root and talk to the kernel. It's a security boundary, sure, but it's not as battle-tested as the isolation of not being root, or the isolation between VMs.

Thirdly, in the stock configuration processes inside a docker container can use loads of RAM (causing random things to get swapped to disk or OOM killed), can consume lots of CPU, and can fill your disk up. If you consider denial-of-service an attack, there you are.

Fourthly, there are a bunch of settings that disable the security boundary, and a lot of guides online will tell you to use them. Doing something in Docker that needs to access hot-plugged webcams? Hmm, it's not working unless I set --privileged - oops, there goes the security boundary. Trying to attach a debugger while developing and you set CAP_SYS_PTRACE? Bypasses the security boundary. Things like that.

Re: I got hacked: My Hetzner server started mining Monero

#52

Post by heavyset_go »

zamadatix wrote: post #10

I don't use Docker for my containers at home, but I take it by the concern that user namespacing is not the employed by them or something?

If you're root in a namespace and manage to escape, you can have root privileges outside of it.

Re: I got hacked: My Hetzner server started mining Monero

#53

Post by jakelsaunders94 »

tolerance wrote: post #46

Was dad notified of the security breach? If not he may want to consider switching hosting providers. Dad deserves a proper LLM-free post mortem.

Hahaha, I did tell him this afternoon. This is the bloke who has the same password for all his banking apps despite me buying him 1password though. The imminent threat from RCE's just didn't land.

Re: I got hacked: My Hetzner server started mining Monero

#54

Post by [deleted] »

Havoc wrote: post #28
V__ wrote: post #5

> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

I think a root container can talk to docker daemon and launch additional containers...with volume mounts of additional parts of file system etc. Not particularly confident about that one though

[deleted]

Re: I got hacked: My Hetzner server started mining Monero

#55

Post by minitech »

czbond wrote: post #49
minitech wrote: post #30

Earlier quoted context omitted.

Unintentional vulnerabilities in Docker and the kernel aside, it can only do that if it has access to the Docker API (usually through a bind mount of the Unix socket). Having access to the Docker API is equivalent to having root on the host.

Well $hit. I have been using Docker for installing NPM modules in interactive projects I was testing out. I believed Docker blocked access to the underlying host (my computer). Thanks for mentioning it - but now... how does one deal with this?

If you didn’t mount docker.sock or any directory above it (i.e. / or /run by default) or run your containers as --privileged, you’re probably fine with respect to this angle. I’d still recommend rootless containers under unprivileged users* or VMs for extra comfort. Qubes (https://www.qubes-os.org/) is good, even if it’s a little clunkier than it could be.

* but if you’re used to bind-mounting, they’ll be a hassle

Edit: This is by no means comprehensive, but I feel compelled to point it out specifically for some reason: remember not to mount .git writable, folks! Write access to .git is arbitrary code execution as whoever runs git.

Re: I got hacked: My Hetzner server started mining Monero

#56

Post by qingcharles »

grekowalski wrote: post #26

Recently, those Monero miners were installing themselves everywhere that had a vulnerable React 19. I had exactly the same problem.

I had to nuke my Oracle Cloud box that runs my Umami server. It got hit. Was a good excuse to upgrade version and upgrade all my backup systems etc. Lost a few hours of data while it was returning 500 errors.

Re: I got hacked: My Hetzner server started mining Monero

#57

Post by qingcharles »

iLoveOncall wrote: post #17

> ls -la /tmp/.XIN-unix/javae Unless ran as root this could return file not found because of missing permissions, and not just because the file doesn't actually exist, right? > “I don’t use X” doesn’t mean your dependencies don’t use X That is beyond obvious, and I don't understand how anyone would feel safe from reading about a CVE on a widely used technology when they run dozens of containers on their server. I hav…

Yeah, my Umami box was hit, but the time between the CVE disclosure and my box getting smacked was incredibly low. Umami patched it very quickly. And then patched it again a second time when the second CVE dropped right after.

Nothing is immune. What analytics are you going to run? If you roll your own you'll probably leave a hole somewhere.

Re: I got hacked: My Hetzner server started mining Monero

#58

Post by edm0nd »

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

Its easily worth it as they are not spending any money on compute or power.

If they can enslave 100s or even 1000s of machine mining XMR for them, easy money if you set aside the legality of it.

Post reply on HN