Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

111–120 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#111

Post by trhway »

V__ wrote: post #5

> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

>there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?

non necessary vulnerability per. se. Bridged adapter for example lets you do a lot - few years ago there were a story of something like how a guy got a root in container and because the container used bridged adapter he was able to intercept traffic of an account info updates on GCP

Re: I got hacked: My Hetzner server started mining Monero

#112

Post by movedx »

seymon wrote: post #102

What's considered nowadays the best practice (in terms of security) for running selfhosted workloads with containers? Daemon less, unprivileged podman containers? And maybe updating container images with a mechanism similar to renovate with "minimumReleaseTime=7days" or something similar!?

You’ll set yourself up for success if you check the dependencies of anything you run, regardless of it being containerised. Use something like Snyk to scan containers and repositories for known exploits and see if anything stands out.

Then you need to run things with as least privilege as possible. Sadly, Docker and containers in general are an anti-pattern here because they’re about convenience first, security second. So the OP should have run the contains as read-only with tight resource limits and ideally IP restrictions on access if it’s not a public service.

Another thing you can do is use Tailscale, or something like it, to keep things being a zero trust, encrypted, access model. Not suitable for public services of course.

And a whole host of other things.

Re: I got hacked: My Hetzner server started mining Monero

#115

Post by hoppp »

hsbauauvhabzb wrote: post #85
d4mi3n wrote: post #37

Earlier quoted context omitted.

While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy. Th…

Virtual machines are treated as a security boundary despite the fact that with enough R&D they are not. Hosting minecraft servers in virtual machines is fine, but not a great idea if they’re cohosted on a machine that has billions of dollars in crypto or military secrets. Docker is pretty much the same but supposedly more flimsy. Both have non-obvious configuration weaknesses that can lead to escapes.

Yeah but why would somebody co-host military secrets or billions of dollars? Its a bit of a stretch

Re: I got hacked: My Hetzner server started mining Monero

#116

Post by 3np »

jakelsaunders94 wrote: post #18
minitech wrote: post #7

> Here’s the test. If /tmp/.XIN-unix/javae exists on my host, I’m fucked. If it doesn’t exist, then what I’m seeing is just Docker’s default behavior of showing container processes in the host’s ps output, but they’re actually isolated. /tmp/.XIN-unix/javae & rm /tmp/.XIN-unix/javae This article’s LLM writing style is painful, and it’s full of misinformation (is Puppeteer even involved in the vulnerability?).

I fixed it, apologies for the misinformation.

It still says:

> IT NEVER ESCAPED.

You haven't confirmed this (at least from the contents of the article). You did some reasonable spot checks and confirmed/corrected your understanding of the setup. I'd agree that it looks likely that it did not escape or gain persistence on your host but in no way have you actually verified this. If it were me I'd still wipe the host and set up everything from scratch again[0].

Also your part about the container user not being root is still misinformed and/or misleading. The user inside the container, the container runtime user, and whether container is privileged are three different things that are being talked about as one.

Also, see my comment on firewall: https://news.ycombinator.com/item?id=46306974

[0]: Not necessarily drop-everything-you-do urgently but next time you get some downtime to do it calmly. Recovering like this is a good excercise anyway to make sure you can if you get a more critical situation in the future where you really need to. It will also be less time and work vs actually confirming that the host is uncontaminated.

Re: I got hacked: My Hetzner server started mining Monero

#117

Post by hsbauauvhabzb »

hoppp wrote: post #115
hsbauauvhabzb wrote: post #85

Earlier quoted context omitted.

Virtual machines are treated as a security boundary despite the fact that with enough R&D they are not. Hosting minecraft servers in virtual machines is fine, but not a great idea if they’re cohosted on a machine that has billions of dollars in crypto or military secrets. Docker is pretty much the same but supposedly more flimsy. Both have non-obvious configuration weaknesses that can lead to escapes.

Yeah but why would somebody co-host military secrets or billions of dollars? Its a bit of a stretch

I think you’re missing the point, which was that high value targets adjacent to soft targets make escapes a legitimate target, but in low value scenarios vm escapes aren’t worth the R&D

Re: I got hacked: My Hetzner server started mining Monero

#118

Post by jakelsaunders94 »

marwamc wrote: post #107

Hahaha OP could be in deep trouble depending on what types of creds/data they had in that container. I had replied to a child comment but I figure best to reply to OP. From the root container, depending on volume mounts and capabilities granted to the container, they would enumerate the host directories and find the names of common scripts and then overwrite one such script. Or to be even sneakier, they can append th…

Nothing in that container luckily, just what Umami needed to run, so no creds at all. Thanks for the info though!

Re: I got hacked: My Hetzner server started mining Monero

#120

Post by jakelsaunders94 »

3np wrote: post #116
jakelsaunders94 wrote: post #18

Earlier quoted context omitted.

I fixed it, apologies for the misinformation.

It still says: > IT NEVER ESCAPED. You haven't confirmed this (at least from the contents of the article). You did some reasonable spot checks and confirmed/corrected your understanding of the setup. I'd agree that it looks likely that it did not escape or gain persistence on your host but in no way have you actually verified this. If it were me I'd still wipe the host and set up everything from scratch again[0]. Als…

I did see your comment on Firewall, and you're right about the escape. It seems safe enough for now. Between the hacking and accidentally hitting the front page of HN it's been a long day.

I'm going to sit down and rewrite the article and take a further look at the container tomorrow.

Post reply on HN