Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

61–70 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#61

Post by dylan604 »

jakelsaunders94 wrote: post #53
tolerance wrote: post #46

Was dad notified of the security breach? If not he may want to consider switching hosting providers. Dad deserves a proper LLM-free post mortem.

Hahaha, I did tell him this afternoon. This is the bloke who has the same password for all his banking apps despite me buying him 1password though. The imminent threat from RCE's just didn't land.

Buying someone 1Pass, or the like, and calling it good is not enough. People using password managers forget how long it takes to visit all of the sites you use to create that site's record, then update the password to a secure one, and then log out and log back in with the new password to test it is good. For a lot of people having a password manager bought for them is going to be over it after the second site. Just think about how many videos on TikTok they could have been watching instead

Re: I got hacked: My Hetzner server started mining Monero

#62

Post by qingcharles »

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

Re: I got hacked: My Hetzner server started mining Monero

#63

Post by tgtweak »

Just a note - you can very much limit cpu usage on the docker containers by setting --cpus="0.5" (or cpus:0.5 in docker compose) if you expect it to be a very lightweight container, this isolation can help prevent one roudy container from hitting the rest of the system regardless of whether it's crypto-mining malware, a ddos attempt or a misbehaving service/software.

Re: I got hacked: My Hetzner server started mining Monero

#64

Post by tgtweak »

qingcharles wrote: post #62

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

The manageability of having everything on one host is kind of nice at that scale, but yeah you can stack free tiers on various providers for less.

Re: I got hacked: My Hetzner server started mining Monero

#65

Post by ianschmitz »

qingcharles wrote: post #62

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

I would pay $4/mo to stay as far away from Oracle as possible

Re: I got hacked: My Hetzner server started mining Monero

#66

Post by socalgal2 »

d4mi3n wrote: post #37
V__ wrote: post #5

> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy. Th…

that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.

Re: I got hacked: My Hetzner server started mining Monero

#68

Post by venturecruelty »

dylan604 wrote: post #59
wnevets wrote: post #35

Sure does seem like the primary outcome of cryptocurrencies being released onto the world has been criminals making money.

Is that really a surprise though?

Not for anyone who doesn't have a financial stake in said fraud, no.

Re: I got hacked: My Hetzner server started mining Monero

#69

Post by tgtweak »

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

Monero's proof of work (RandomX) is very asic-resistant and although it generates a very small amount of earnings, if you exploit a vulnerability like this with thousands or tens of thousands of nodes, it can add up (8 modern cores 24/7 on Monero would be in the 10-20c/day per node range). OPs Vps probably generated about $1 for those script kiddies.
Post reply on HN