I had something similar, but I was lucky enough to catch it myself. I've used SSH for years, and never knew that it - by default - also accepts password logins. Maybe dumb on my part, but there you go...
I got hacked: My Hetzner server started mining Monero
251–260 of 422 posts
Re: I got hacked: My Hetzner server started mining Monero
#252> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…
Hetzner has a free firewall service outside of your machine. You can use that as the first line of defence.
That's what I use. Is it enough? Or should I also install a firewall on my machine?
Re: I got hacked: My Hetzner server started mining Monero
#253> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…
..backed by xml?
Re: I got hacked: My Hetzner server started mining Monero
#254I am not an expert in incident reaction, but I thought the safe way was to image the affected machine, turn it off, take a clean machine, boot a clean OS image with the affected image mounted read only in a VM, and do the investigation like that ?
Assume that the malware has replaced system commands, possibly used a kernel vulnerability to lie to you to hide its presence, so do not do anything in the infected system directly ?
Re: I got hacked: My Hetzner server started mining Monero
#255I find it interesting that the recent trend of moving to self-hosted solutions is sparking this rediscovery of security issues that come with self-hosting. One more time and it will be a cycle!
What trend? All I'm seeing here is further centralisation: Search engines try to fight slop results with collateral damage mostly in small or even personal websites. Restaurants are happy to be on one platform only: Google Maps. Who needs an expensive website if you're on there and someone posts your menu as one of the pictures? (Ideally an old version so the prices seem cheaper and you can't be pinned down for false…
it's slow, but there are people slowly turning towards a more decoupled internet, the problem is that you still *have* to use cloudflare (or any kind of http proxy), it's just a basic requirement that you can't avoid for anything that people would be interested in keeping offline.
I've been on the receiving end of attacks that were reported to be the size of more than 10tbps I couldn't imagine how I would deal with that if I didn't have a 3rd party providing such protection - it would require millions $$ a year just in transit contracts.
There is an increasing amount of software that attempts to reverse this, but as someone from https://thingino.com/ said: opensource is riddled with developers that died to starvation (nobody donates to opensource projects).
Re: I got hacked: My Hetzner server started mining Monero
#256I am not an expert in incident reaction, but I thought the safe way was to image the affected machine, turn it off, take a clean machine, boot a clean OS image with the affected image mounted read only in a VM, and do the investigation like that ? Assume that the malware has replaced system commands, possibly used a kernel vulnerability to lie to you to hide its presence, so do not do anything in the infected system…
Maybe if your company infrastructure is affected but not the server you use to host your side projects on with “coolify” unless IT security is your hobby.
Re: I got hacked: My Hetzner server started mining Monero
#257TY for the article. You made me look into my server, and also found some strange activity on my docker containers. Good call!
Re: I got hacked: My Hetzner server started mining Monero
#258Earlier quoted context omitted.
> but a lot of docker containers are misconfigured or unnecessarily privileged, allowing for escape Honestly, citation needed. Very rare unless you're literally giving the container access to write to /usr/bin or other binaries the host is running, to reconfigure your entire /etc, access to sockets like docker's, or some other insane level of over reach I doubt even the least educated docker user would do. While of c…
I've seen many articles with `-v /var/run/docker.sock:/var/run/docker.sock` without scary warning
What would the intended use case for that be?
Re: I got hacked: My Hetzner server started mining Monero
#259so what's the point of containers here? seems only to make things less transparent and more complex to manage.
js scripts running on frameworks running inside containers
PS so I see the host ended up staying uncompromised
Re: I got hacked: My Hetzner server started mining Monero
#260Earlier quoted context omitted.
Unless you need it to be reachable from the Internet, at which point it has to be... reachable from the Internet.
Public facing services routed through a firewall or waf (cloudflare) always. Backend access trivial with Tailscale, etc.
Stupid question probably, but: how can it not be routed through a firewall? If you have it at home, it's behind a router that should have a firewall already, right? And just forwards the one port you expose to the server?
Cloudflare can certainly do more (e.g. protect against DoS and hide your personal IP if your server is at home).