Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

131–140 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#131

Post by exceptione »

doodlesdev wrote: post #123
exceptione wrote: post #119

The first step I would take is running podman instead of Docker to prevent container escapes. Podman can be run truly rootless and doesn't mess with your firewall. Next I would drop all caps if possible.

What's the difference between running Podman and running Docker in rootless mode? (Other than Docker messing with the firewall, which apparently OP doesn't know about… yet). I understand Podman doesn't require a daemon, but is that all there is to it, or is there something I'm missing?

The runtime has been designed from the ground up to be run daemonless and rootless. They also have a K8s runtime, that has an extremely small surface, just enough to be K8s compliant.

But podman has also great integration with systemd. With that you could use a socket activated systemd unit, and stick the socket inside the container, instead of giving the container any network at all. And even if you want networking in the container, the podman folks developed slirp4netns, which is user space networking, and now something even better: passt/pasta.

Re: I got hacked: My Hetzner server started mining Monero

#132

Post by jwrallie »

danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

Password auth being enabled is also very brave. I don’t think fail2ban is necessary personally, but it’s popular enough that it always come up.

Re: I got hacked: My Hetzner server started mining Monero

#133

Post by 3np »

denkmoon wrote: post #124
3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

I’ll just mention Foomuuri here. Its bit of a spiritual successor to shorewall and has firewalld emulation to work with tools compatible with firewalld

Thanks! Would be cool to have it packaged for alpine since firewalld requires D-Bus. There is awall but that's still on iptables and IMO at bit clunky to set up.

Re: I got hacked: My Hetzner server started mining Monero

#134

Post by 3np »

jakelsaunders94 wrote: post #120
3np wrote: post #116

Earlier quoted context omitted.

It still says: > IT NEVER ESCAPED. You haven't confirmed this (at least from the contents of the article). You did some reasonable spot checks and confirmed/corrected your understanding of the setup. I'd agree that it looks likely that it did not escape or gain persistence on your host but in no way have you actually verified this. If it were me I'd still wipe the host and set up everything from scratch again[0]. Als…

I did see your comment on Firewall, and you're right about the escape. It seems safe enough for now. Between the hacking and accidentally hitting the front page of HN it's been a long day. I'm going to sit down and rewrite the article and take a further look at the container tomorrow.

Hey, thanks for taking the time to share your learnings and engage. I'm sure there are HN readers out there who will be better off for it alongside you!

(And good to hear you're leaving the LLMs out of the writing next time <3)

Re: I got hacked: My Hetzner server started mining Monero

#135

Post by heavyset_go »

zamadatix wrote: post #121
heavyset_go wrote: post #52

Earlier quoted context omitted.

If you're root in a namespace and manage to escape, you can have root privileges outside of it.

Are you referring to user namespaces and, if so, how does that kind of break out to host root work? I thought the whole point of user namespaces was your UID 0 inside the container is UID 100000 or whatever from the perspective of outside the container. Escaping the container shouldn't inherently grant you ability to change your actual UID in the host's main namespace in that kind of setup, but I'm not sure Docker ac…

Users in user namespaces are granted capabilities that root has, user namespaces themselves need to be locked down to prevent that, but if a user with root capabilities escapes the namespace, they have the capabilities on the host.

They also expose kernel interfaces that, if exploited, can lead to the same.

In the end, namespaces are just for partitioning resources, using them for sandboxes can work, but they aren't really sandboxes.

Re: I got hacked: My Hetzner server started mining Monero

#136

Post by hughw »

You can run Docker Scout on one repo for free, and that would alert you that something was using Next.js and had that CVE. AWS ECR has pretty affordable scanning too: 9 cents/image and 1 cent/rescan. Continuous scanning even for these home projects might be worth it.

[*] https://aws.amazon.com/inspector/pricing/

Re: I got hacked: My Hetzner server started mining Monero

#137

Post by BLKNSLVR »

lapetitejort wrote: post #130
BLKNSLVR wrote: post #110

Earlier quoted context omitted.

Criminals and the porn industry are almost invariably early adopters of new technologies. For better or worse their use-cases are proof-of-concepts that get expanded and built on, if successful, by more legitimate industries. Re: the Internet. Re: Peer-to-peer. Re: Video streaming. Re: AI.

What is the average length of time for new tech to escape porn and crime and integrate into real applications? Longer than 15 years?

Some kind of function of how quickly regulation comes to the technology.

Re: I got hacked: My Hetzner server started mining Monero

#139

Post by tete »

danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

Firewalls in the majority of cases don't get you much. Yes it's a last line of defense if you do something really stupid and don't even know where or what you configure your services to listen on, but if you don't the difference between running firewalls and not is minuscule.

There are way more important things like actually knowing that you are running software with widely known RCE that don't even use established mechanisms to sandbox themselves it seems.

The way the author describes docker being the savior appears to be sheer luck.

Re: I got hacked: My Hetzner server started mining Monero

#140

Post by jsheard »

3np wrote: post #129
exceptione wrote: post #122

Earlier quoted context omitted.

> Specifically for docker it is a very common gotcha that the container runtime can and will bypass firewall rules and open ports anyway. Like I said in another comment, drop Docker, install podman.

This affects podman too.

Not if you run it in rootless mode, which is more of a first class citizen in Podman compared to Docker.
Post reply on HN