I got hacked: My Hetzner server started mining Monero • Hacker News Board

Re: I got hacked: My Hetzner server started mining Monero

#341

Post by chasd00 » Thu, Dec 18, 2025, 5:43 PM UTC

szszrk wrote: post #261

zwnow wrote: post #231

Earlier quoted context omitted.

Yup the regular "8080:8080" bind resulted in a ransom note in my database on day 1. Bound it to localhost only now.

one thing I always forget about, is that you have a whole network of 127.0.0.0/8 , not just one IP. So you can create multiple addresses with multiple separate "domains" mapped statically in /etc/hosts, and allow multiple apps to listen on "the same" port without conflicts.

I never thought of using localhost like that, I'm surprised that works actually. Typically, if you want a private /8 you would use 10.0.0.0/8 but the standard 192.168.0.0/16 gives you a lot of address space ( 255^2 - 2 IPs (iirc) ) too.

..actually this is very weird. Are you saying you can bind to 127.0.0.2:80 without adding a virtual IP to the NIC? So the concept of "localhost" is really an entire class A network? That sounds like a network stack bug to me heh.

edit: yeah my route table on osx confirms it. very strange (at least to me)

Re: I got hacked: My Hetzner server started mining Monero

#342

Post by throwawayffffas » Thu, Dec 18, 2025, 6:01 PM UTC

> I also enabled UFW (which I should have done ages ago):

Docker will overwrite your rules when you publish ports.

Do not publish ports with docker. Do not run internal services on the publicly accessible system.

Re: I got hacked: My Hetzner server started mining Monero

#343

Post by akimbostrawman » Thu, Dec 18, 2025, 6:29 PM UTC

wnevets wrote: post #320

akimbostrawman wrote: post #293

Earlier quoted context omitted.

Sure does seem like the primary outcome of email being released onto the world has been criminals making money.

Absolutely not.

nearly half of all emails are spam

https://www.statista.com/statistics/420400/spam-email-traffi...

Re: I got hacked: My Hetzner server started mining Monero

#344

Post by tgtweak » Thu, Dec 18, 2025, 6:36 PM UTC

butvacuum wrote: post #314

tgtweak wrote: post #197

Earlier quoted context omitted.

Most of this is mitigated by running docker in an LXC containers (like proxmox does) which grants a lot more isolation than docker on it's own - closer in nature to running separate VMs.

Too bad it straight doesn't work without heavy mods in pve9

Illumos had a really nice stack for running containers inside jails and zones... I wonder if any of that ever made it into the linux world. If you broke out of the container you'd just be inside a jail which is even more hardened.

Re: I got hacked: My Hetzner server started mining Monero

#345

Post by bingo-bongo » Thu, Dec 18, 2025, 6:44 PM UTC

Hendrikto wrote: post #248

bingo-bongo wrote: post #223

Earlier quoted context omitted.

Coming from FreeBSD and pf, all Linux firewalls I’ve tried feels clunky _at best_ UX-wise. I’d love a Linux firewall configured with a sane config file and I think BSD really nailed it. It’s easy to configure and still human readable, even for more advanced firewall gateway setups with many interfaces/zones. A have no doubt that Linux can do all the same stuff feature-wise, but oh god the UX :/

Have you tried nftables? It is so much nicer than iptables.

Yeah, I'm already using nftables and I agree that it's better than eg. iptables (or the numerous frontends for iptables) and probably the best bet we have at this point - but honestly, it's still far from the UX I get from pf - unfortunately :/

Re: I got hacked: My Hetzner server started mining Monero

#346

Post by miohtama » Thu, Dec 18, 2025, 6:58 PM UTC

esaym wrote: post #202

So this is part of the "React2Shell" CVE-2025-55182 issue? I find it interesting that this seems to get so little publicity. Almost like the issue is normal or expected. And it looks like the affected versions go back a little over a year. So if you've deployed anything with Next.js over the last 12 months your web app is now probably part of a million node bot net. And everyone's advice is just "use docker" or "inst…

Use Svelte? (:

Re: I got hacked: My Hetzner server started mining Monero

#347

Post by Sohcahtoa82 » Thu, Dec 18, 2025, 7:09 PM UTC

hank2000 wrote: post #333

I've bene working with a GPU security company for the last few months... I can tell you that neo clouds (generally) do not see security as a high priority—or often, even their responsibility. Many do not have hte ability to even know if your GPUs have been compromised and they expect you'll take responsibility. Meanwhile companies think the clouds are looking at it.... anyhow. it is a real problem.

> I can tell you that neo clouds (generally) do not see security as a high priority—or often, even their responsibility.

AWS explicitly spells this out in their Shared Responsibility Model page [0]

It is not your cloud provider's responsibility to protect you if you run outdated and vulnerable software. It's not their responsibility to prevent crypto-miners from running on your instances. It's not even their responsibility to run a firewall, though the major players at least offer it in some form (ie, AWS Security Groups and ACL).

All of that is on the customer. The provider should guarantee the security of the cloud. The customer is responsible for security in the cloud.

[0] https://aws.amazon.com/compliance/shared-responsibility-mode...

Re: I got hacked: My Hetzner server started mining Monero

#348

Post by tgsovlerkhgsel » Thu, Dec 18, 2025, 7:12 PM UTC

wnevets wrote: post #35

Sure does seem like the primary outcome of cryptocurrencies being released onto the world has been criminals making money.

I'd argue mining malware is a net benefit to society. I'd much rather have my vulnerable server exploited by mining malware than left alone. If it gets exploited by mining malware, it gives me an extra chance to catch it before something actually bad happens, at almost zero cost to myself and a small reward for the person who found the vuln.

Re: I got hacked: My Hetzner server started mining Monero

#349

Post by Sohcahtoa82 » Thu, Dec 18, 2025, 7:13 PM UTC

IlikeMadison wrote: post #332

I don't think using key-based authentication for SSH and enabling Fail2ban is necessary. Fail2ban is only useful if you keep password authentication. But I might be wrong.

I should check my SSH logs.

My intuition is that since the SSH server reports what auth methods are available, once a bot sees that password auth is disabled, they will disconnect and not try again.

But I also know that bots can be dumb.

Re: I got hacked: My Hetzner server started mining Monero

#350

Post by tgsovlerkhgsel » Thu, Dec 18, 2025, 7:17 PM UTC

dilippkumar wrote: post #247

I’m sorry you went through this. But I am interested in the monero aspect here. Should I treat this as some datapoint on monero’s security having held up well so far?

> Should I treat this as some datapoint on monero’s security having held up well so far?

No. The reason attackers mine Monero and not some other cryptocurrency isn't the anonymity. Most cryptocurrencies aren't (meaningfully) mineable with CPUs, Monero (apparently) is. There may be others, but I suspect that they either deliver less $ per CPU-second (due to not being valuable), or are sufficiently unknown and/or painful to set up that the attackers just go with the known default.

Trying to mine Bitcoin directly would be pointless, you'd get no money because you're competing with ASIC miners. Some coins were designed to be ASIC resistant, these are mostly mined on GPUs. Monero (and some other coins) were designed to also be GPU resistant (I think). You could see it as a sign that that property has held up (well enough), but nothing else.