Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

381–390 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#381

Post by lofaszvanitt »

3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

Why people use these abstractions over nftables? Use nftables, it's easy to learn, effective and if you know it you know everything about firewalls.

Re: I got hacked: My Hetzner server started mining Monero

#382

Post by cyphar »

tgtweak wrote: post #344
butvacuum wrote: post #314

Earlier quoted context omitted.

Too bad it straight doesn't work without heavy mods in pve9

Illumos had a really nice stack for running containers inside jails and zones... I wonder if any of that ever made it into the linux world. If you broke out of the container you'd just be inside a jail which is even more hardened.

SmartOS constructed a container-like environment using LX-branded zones, they didn't create an in-kernel equivalent to Linux's namespaces which it then nested in a zone. You're probably thinking of the KVM port to Solaris/illumos, which does run in a zone internally to provide additional protection.

While LX-branded zones were a really cool tech demo, maintaining compatibility with Linux long-term would be incredibly painful and you're bound to find all sorts of horrific bugs in production. I believe that Oxide uses KVM to run their Linux guests.

Linux has always supported nested namespaces and you can run Docker containers inside LXC (or Incus) fairly easily. Note that while it does add some additional protection (in particular, it transparently adds user namespaces which is a critical security feature most people still do not enable in Docker) it is still the same technology as containers and so kernel bugs still pose a similar risk.

Re: I got hacked: My Hetzner server started mining Monero

#383

Post by BLKNSLVR »

denismenace wrote: post #265
BLKNSLVR wrote: post #110

Earlier quoted context omitted.

Criminals and the porn industry are almost invariably early adopters of new technologies. For better or worse their use-cases are proof-of-concepts that get expanded and built on, if successful, by more legitimate industries. Re: the Internet. Re: Peer-to-peer. Re: Video streaming. Re: AI.

How were criminals the early adopters of Internet, Video streaming and AI?

Single examples:

Internet: The Cuckoo's Egg (nation state, more so than criminals maybe, but it's a blurry distinction)

AI: Elon Musk youtube (often cryptocurrency scam) ads

Video streaming was more obviously exclusively a porn thing

Re: I got hacked: My Hetzner server started mining Monero

#384

Post by eikowagenknecht »

I got another mail from Hetzner on Dec 10, telling me that the BSI told them my web site was having serious security problems with Next.JS. Not having high opinions on the BSI, I first thought this was some very elaborate scam attack but no, it turns out it was legit and also Umamis inbuilt Next.JS for me. But apparently there was no crypto miner or other active abuse yet.

Re: I got hacked: My Hetzner server started mining Monero

#385

Post by dizhn »

chasd00 wrote: post #341
szszrk wrote: post #261

Earlier quoted context omitted.

one thing I always forget about, is that you have a whole network of 127.0.0.0/8 , not just one IP. So you can create multiple addresses with multiple separate "domains" mapped statically in /etc/hosts, and allow multiple apps to listen on "the same" port without conflicts.

I never thought of using localhost like that, I'm surprised that works actually. Typically, if you want a private /8 you would use 10.0.0.0/8 but the standard 192.168.0.0/16 gives you a lot of address space ( 255^2 - 2 IPs (iirc) ) too. ..actually this is very weird. Are you saying you can bind to 127.0.0.2:80 without adding a virtual IP to the NIC? So the concept of "localhost" is really an entire class A network? T…

I didn't really know the mechanism of how this worked but if you check your resolv file you might find that the nameserver IP for your localhost is 127.0.0.53 . It is so in recent Linux distros. (Probably a systemd thing)

Re: I got hacked: My Hetzner server started mining Monero

#386

Post by akimbostrawman »

wnevets wrote: post #356
akimbostrawman wrote: post #343

Earlier quoted context omitted.

nearly half of all emails are spam https://www.statista.com/statistics/420400/spam-email-traffi...

That virtually all ends up in the spam folder. Neither half the revenue generated nor half of the utility people extract from it is criminal. I don't know a single person who has used Monero to conduct non-criminal business.

>I don't know a single person who has used Monero

That's the point, its private by design and unless they tell you, nobody will ever know how much they use and for what. The true hacker spirit.

If you bother to look past news headlines you will find a vibrant community of people paying for legal goods that value privacy before FUD and ignorance.

https://monerica.com/sitemap

This kind of fearmongering is already leading us towards a cashless society because "only criminals use it". This is hackernews and not facebook or congress so it should be obvious to everybody here what the end result of criminalizing/demonizing non KYC payments will be (hint: look at china).

Re: I got hacked: My Hetzner server started mining Monero

#387

Post by szszrk »

chasd00 wrote: post #341
szszrk wrote: post #261

Earlier quoted context omitted.

one thing I always forget about, is that you have a whole network of 127.0.0.0/8 , not just one IP. So you can create multiple addresses with multiple separate "domains" mapped statically in /etc/hosts, and allow multiple apps to listen on "the same" port without conflicts.

I never thought of using localhost like that, I'm surprised that works actually. Typically, if you want a private /8 you would use 10.0.0.0/8 but the standard 192.168.0.0/16 gives you a lot of address space ( 255^2 - 2 IPs (iirc) ) too. ..actually this is very weird. Are you saying you can bind to 127.0.0.2:80 without adding a virtual IP to the NIC? So the concept of "localhost" is really an entire class A network? T…

That was deliberate. Works on Linux and Windows as well. I think this is the current RFC: https://datatracker.ietf.org/doc/html/rfc5735

You can do:

python3 -m http.server -b 127.0.0.1 8080

python3 -m http.server -b 127.0.0.2 8080

python3 -m http.server -b 127.0.0.3 8080

and all will be available.

Private network ranges don't really have the same purpose, they can be routed, you have to always consider conflicts and so on. But here with 127/8 you are in your own world and you don't worry about anything. You can also do tests where you need to expose more than 65k ports :)

You have to also remember these are things established likely before even DNS was a thing, IP space was considered so big that anyone could have a huge chunk of it, and it was mostly managed manually.

Re: I got hacked: My Hetzner server started mining Monero

#388

Post by danw1979 »

rainonmoon wrote: post #276
danw1979 wrote: post #232

Earlier quoted context omitted.

The only time I have ever had a machine compromised in 30 years of running Linux is when I ran something exposed to the internet on a well known port. I know port scanners are a thing but the act of using non-default ports seems unreasonably effective at preventing most security problems.

This is very, very, very bad advice. A non-standard port is not a defence. It’s not even slightly a defence.

Did I at any point in my previous comment say that using non-standard ports was my only line of defence ?

Its security through obscurity, which puts you out of view of the vast majority of the chaos of the internet. It by no means protects you from all threats.

Re: I got hacked: My Hetzner server started mining Monero

#389

Post by p0w3n3d »

kgeist wrote: post #285
p0w3n3d wrote: post #207

$ sudo ufw default deny incoming $ sudo ufw default allow outgoing $ sudo ufw allow ssh $ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp $ sudo ufw enable As a user of iptables this order makes me anxious. I used to cut myself out from the server many times because first blocking then adding exceptions. I can see that this is different here as the last command commits the rules...

I had this one too: I first denied all incoming requests and was about to allow SSH, but my SSH connection dropped :) Fortunately, I was able to restore the VM with the provider's VM console.

I have a funny story, when I did it in the startup script, then I ran it. I lost my ssh, and moreover this server was in another country, France. And moreover I set up the internal keyboard layout there to be US as I am writing without looking at the keyboard. In the result, the Polish-French guy there, who was at site, was unable to enter the password correctly unless I translated it to the french keyboard for him.

Re: I got hacked: My Hetzner server started mining Monero

#390

Post by DaSHacka »

arein3 wrote: post #362
DaSHacka wrote: post #331

Earlier quoted context omitted.

Same here, I'm surprised most linux users I know like to install firewalld, UFW, or some other overlaying firewall rather than just editing the nftables config directly. It's not very difficult, although I've never really dug deep into the weeds of iptables. I suspect many people who have used iptables long ago in the past assume nftables is samilar and avoid interacting with it directly out of habit.

With nftables you need to learn a lot before you cam be partially sure of wbat you do. With ufw gui you need a single checkbox - block incoming connections.

Not sure what you find difficult about it, but I just took the "workstation" config from the gentoo wiki and used it on my laptop.

Perhaps if you're doing more complicated things like bridging interfaces or rerouting traffic it would be more difficult to use than the alternatives, but for a simple whitelist it's extremely easy to configure and modify.

Post reply on HN