Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

91–100 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#91

Post by dist-epoch »

socalgal2 wrote: post #66
d4mi3n wrote: post #37

Earlier quoted context omitted.

While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy. Th…

that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.

it is a sandbox against unintentional attacks and mistakes (sudo rm -rf /)

but will not stop serious malware

Re: I got hacked: My Hetzner server started mining Monero

#92

Post by danparsonson »

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

Re: I got hacked: My Hetzner server started mining Monero

#93

Post by fragmede »

freedomben wrote: post #87
socalgal2 wrote: post #66

Earlier quoted context omitted.

that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.

And not without cause. We've been pitching docker as a security improvement for well over a decade now. And it is a security improvement, just not as much as many evangelists implied.

Must depend on who you've been talking to. Docker's not been pitched for security in the circles I run in, ever.

Re: I got hacked: My Hetzner server started mining Monero

#95

Post by nodesocket »

I also run Umami, but patched once the CVE patch was released. Also, I only expose the tracking js endpoint and /api/send via Caddy publically (though, /api/send might be enough to exploit the vul). To actually interact with Umami UI I use Twingate (similar to Tailscale) to tunnel into the VPC locally.

Re: I got hacked: My Hetzner server started mining Monero

#96

Post by marwamc »

necovek wrote: post #76
V__ wrote: post #34

Earlier quoted context omitted.

Can you explain this a bit further? Wouldn't that 0777 file outside docker be still executed inside the container and not on the host?

I believe they meant you could create an executable that is accessible outside the container (maybe even as setuid root one), and depending on the path settings, it might be possible to get the user to run it on the host. Imagine naming this executable "ls" or "echo" and someone having "." in their path (which is why you shouldn't): as long as you do "ls" in this directory, you've ran compromised code. There are obvi…

Another example is they would enumerate your directories and find the names of common scripts and then overwrite your script. Or to be even sneakier, they can append their malicious code to an existing script in your filesystem. Now each time you run your script, their code piggybacks.

OTH if I had written such a script for linux I'd be looking to grab the contents of $(hist) $(env) $(cat /etc/{group,passwd})... then enumerate /usr/bin/ /usr/local/bin/ and the XDG_{CACHE,CONFIG} dirs - some plaintext credentials are usually here.

The $HOME/.{aws,docker,claude,ssh}

Basically the attacker just needs to know their way around your OS. The script enumerating these directories is the 0777 script they were able to write from inside the root access container.

Re: I got hacked: My Hetzner server started mining Monero

#97

Post by Nextgrid »

danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

But the firewall wouldn't have saved them if they're running a public web service or need to interact with external services.

I guess you can have the appserver fully firewalled and have another bastion host acting as an HTTP proxy, both for inbound as well as outbound connections. But it's not trivial to set up especially for the outbound scenario.

Re: I got hacked: My Hetzner server started mining Monero

#99

Post by Nextgrid »

V__ wrote: post #5

> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

Container escapes exist. Now the question is whether the attacker has exploited it or not, and what the risk is.

Are you holding millions of dollars in crypto/sensitive data? Better assume the machine and data is compromised and plan accordingly.

Is this your toy server for some low-value things where nothing bad can happen besides a bit of embarrassment even if you do get hit by a container escape zero-day? You're probably fine.

This attack is just a large-scale automated attack designed to mine cryptocurrency; it's unlikely any human ever actually logged into your server. So cleaning up the container is most likely fine.

Re: I got hacked: My Hetzner server started mining Monero

#100

Post by tracker1 »

tgtweak wrote: post #63

Just a note - you can very much limit cpu usage on the docker containers by setting --cpus="0.5" (or cpus:0.5 in docker compose) if you expect it to be a very lightweight container, this isolation can help prevent one roudy container from hitting the rest of the system regardless of whether it's crypto-mining malware, a ddos attempt or a misbehaving service/software.

Another is running containers in read-only mode, assuming they support this configuration... will minimize a lot of potential attack surface.
Post reply on HN