I got hacked: My Hetzner server started mining Monero

Post by gus_ » Thu, Dec 18, 2025, 1:23 PM UTC

3abiton wrote: post #181

gus_ wrote: post #155

Earlier quoted context omitted.

it doesn't matter what netfilter frontend you use if you allow outbound connections from any binary. In order to stop these attacks, restrict outbound connections from unknown / not allowed binaries. This kind of malware in particular requires outbound connections to the mining pools. Others downloads scripts or binaries from remote servers, or try to communicate with their c2c servers. On the other hand, removing ex…

Is there an automated way of doing this?

Post by hypeatei » Thu, Dec 18, 2025, 1:41 PM UTC

dizhn wrote: post #289

andix wrote: post #278

Earlier quoted context omitted.

It's really a trap. I'm surprised they never changed the default to 127.0.0.1 instead of 0.0.0.0. So you would need to explicitly specify it, if you want to bind to all interfaces.

The reason is convenience. There would be a lot more friction if they didn't do it like this for everything other than local development. Docker also has more traps and not quite as obvious as this. For example, it can change the private IP block its using without telling you. I got hit by this once due to a clash with a private block I was using for some other purpose. There's a way to fix it in the config but it wo…

Post by syhol » Thu, Dec 18, 2025, 1:55 PM UTC

esaym wrote: post #202

So this is part of the "React2Shell" CVE-2025-55182 issue? I find it interesting that this seems to get so little publicity. Almost like the issue is normal or expected. And it looks like the affected versions go back a little over a year. So if you've deployed anything with Next.js over the last 12 months your web app is now probably part of a million node bot net. And everyone's advice is just "use docker" or "inst…

Post by Nelkins » Thu, Dec 18, 2025, 1:58 PM UTC

exceptione wrote: post #297

kh_hk wrote: post #269

Earlier quoted context omitted.

I keep reading comments by podman fans asking to drop Docker and yet every time I have tried to use podman it failed on me miserably. IMHO it would be better if podman was not designed and sold as a docker drop in replacement but its own thing.

That sucks, I never had any problem running a Dockerfile in podman. I don't know what I do differently, but I would as a principle filter out any container that messes with stuff like docker in docker. Podman doesn't need these kind of shenegians. Also the Docker Compose tool is a well-know exception to the compatibility story. (There is some unofficial podman compose tool, but that is not feature complete and quadle…

Post by dizhn » Thu, Dec 18, 2025, 1:59 PM UTC

hypeatei wrote: post #313

dizhn wrote: post #289

Earlier quoted context omitted.

The reason is convenience. There would be a lot more friction if they didn't do it like this for everything other than local development. Docker also has more traps and not quite as obvious as this. For example, it can change the private IP block its using without telling you. I got hit by this once due to a clash with a private block I was using for some other purpose. There's a way to fix it in the config but it wo…

Is there a guide that lists some common options / gotchas in Docker like this? Some quick searching yields generic advice about keeping everything updated or running in rootless mode.

  {
    "log-driver": "json-file",
    "log-opts": {
      "labels": "production_status",
      "tag": "{{.ImageName}}|{{.Name}}|{{.ImageFullID}}|{{.FullID}}",
      "env": "os,customer",
      "max-size": "10m"
    },
    "bip": "172.17.1.1/24",
    "default-address-pools": [
      {"base": "172.17.0.0/16", "size": 24}
    ]
  }