You're lucky that Hetzner didn't delete your server and terminate your account.
With which justification?
I got hacked: My Hetzner server started mining Monero
151–160 of 422 posts
Re: I got hacked: My Hetzner server started mining Monero
#152This nextjs vulnerability is gonna be exploited everywhere because its so easy. This is just the start
I didn’t think it was possible for me to dislike nextjs any more, but here we are. It’s the Sharepoint of the JS ecosystem.
Re: I got hacked: My Hetzner server started mining Monero
#153Sorry to hear you got hacked. I know we aren't supposed to rely on containers as a security boundary, but it sure is great hearing stories like this where the hack doesn't escape the container. The more obstacles the better I guess.
Hacks are humans. For like, ten more minutes anyway.
If the human involved can’t escalate, the hack can’t.
Re: I got hacked: My Hetzner server started mining Monero
#154Earlier quoted context omitted.
Not if you run it in rootless mode, which is more of a first class citizen in Podman compared to Docker.
> Not if you run it in rootless mode. Same as for docker, yes? https://docs.docker.com/engine/security/rootless/
nope. You should look at https://docs.docker.com/engine/network/
Networking is just better in podman.
Re: I got hacked: My Hetzner server started mining Monero
#155> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…
it doesn't matter what netfilter frontend you use if you allow outbound connections from any binary.
In order to stop these attacks, restrict outbound connections from unknown / not allowed binaries.
This kind of malware in particular requires outbound connections to the mining pools. Others downloads scripts or binaries from remote servers, or try to communicate with their c2c servers.
On the other hand, removing exec permissions to /tmp, /var/tmp and /dev/shm is also useful.
Re: I got hacked: My Hetzner server started mining Monero
#156Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining
Monero's proof of work (RandomX) is very asic-resistant and although it generates a very small amount of earnings, if you exploit a vulnerability like this with thousands or tens of thousands of nodes, it can add up (8 modern cores 24/7 on Monero would be in the 10-20c/day per node range). OPs Vps probably generated about $1 for those script kiddies.
So $40 a year? Does that imply all monero is mined like this because it's clearly not cost effective at all to mine legitimately?
Re: I got hacked: My Hetzner server started mining Monero
#157Earlier quoted context omitted.
While this is true, the general security stance on this is: Docker is not a security boundary. You should not treat it like one. It will only give you _process level_ isolation. If you want something with better security guarantees, you can use a full VM (KVM/QEMU), something like gVisor[1] to limit the attack surface of a containerized process, or something like Firecracker[2] which is designed for multi-tenancy. Th…
that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.
Not 99%. Many people run an hypervisor and then a VM just for Docker.
Attacker now needs a Docker exploit and then a VM exploit before getting to the hypervisor (and, no, pwning the VM ain't the same as pwning the hypervisor).
Re: I got hacked: My Hetzner server started mining Monero
#158> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…
One of those rare HN comments that's just pure gold.
Re: I got hacked: My Hetzner server started mining Monero
#159As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.
All fine and well, but oracle will threaten to turn off your instance if you don’t maintain a reasonable average CPU usage on the free hosts, and will eventually do so abruptly. This became enough of a hassle that I stopped using them.
I assumed the same, but as long as you keep a credit card on file apparently they will let you idle it too. I went in and set my max budget at $1/mo and set alerts too, just in case.