I got hacked: My Hetzner server started mining Monero

Post by tgtweak » Fri, Dec 19, 2025, 3:01 PM UTC

Sohcahtoa82 wrote: post #352

beeflet wrote: post #200

Earlier quoted context omitted.

I think so, but it is hard to say. Could be a lot of people with extra power (or stolen power), but their own equipment. I mine myself with waste solar power

Another option: Deliberate heat generation. If it's cold and you're going to be running a heater anyways, then if your heat is resistive, then running a cryptominer is just as efficient and returns a couple dollars back to you. It effectively becomes "free" relative to running the heater. If you use a heat pump, or you rely on burning something (natural gas, wood, whatever) to generate heat, then the math changes.

Post by tremon » Fri, Dec 19, 2025, 3:23 PM UTC

kh_hk wrote: post #372

exceptione wrote: post #297

Earlier quoted context omitted.

That sucks, I never had any problem running a Dockerfile in podman. I don't know what I do differently, but I would as a principle filter out any container that messes with stuff like docker in docker. Podman doesn't need these kind of shenegians. Also the Docker Compose tool is a well-know exception to the compatibility story. (There is some unofficial podman compose tool, but that is not feature complete and quadle…

A side-effect of running rootless and daemonless is that containers stop on user log out, and I can't believe how all this is to be expected for a newcomer to parse. Because I thought the whole point of containers in production was for them to keep running when you log out. Of course, when you think about it, nobody expects a command to just survive logging out, but coming from docker, you still have that expectation…

Post by akimbostrawman » Fri, Dec 19, 2025, 9:03 PM UTC

wnevets wrote: post #391

akimbostrawman wrote: post #386

Earlier quoted context omitted.

>I don't know a single person who has used Monero That's the point, its private by design and unless they tell you, nobody will ever know how much they use and for what. The true hacker spirit. If you bother to look past news headlines you will find a vibrant community of people paying for legal goods that value privacy before FUD and ignorance. https://monerica.com/sitemap This kind of fearmongering is already leadi…

> unless they tell you, nobody will ever know how much they use and for what. As opposed to email?

Post by lgvld » Sat, Dec 20, 2025, 1:24 PM UTC

hermannj314 wrote: post #325

vultour wrote: post #280

Earlier quoted context omitted.

If you're at a point where you are exposing services to the internet but you don't know what you're doing you need to stop. Choosing what interface to listen on is one of the first configuration options in pretty much everything, if you're putting in 0.0.0.0 because that's what you read on some random blogspam "tutorial" then you are nowhere near qualified to have a machine exposed to the internet.

Don't do anything until you are an expert is excellent gatekeeping, fortunately this is hacker news so we can ignore the gatekeepers! I suggest people fuck around and find out, just limit your exposure. Spin up a VPS with nothing important, have fun, and delete it. At some point we are all unqualified to use the internet and we used it anyway. No one is going to die because your toy project got hacked and you are out…

Post by dietr1ch » Sat, Dec 20, 2025, 2:36 PM UTC

szszrk wrote: post #261

zwnow wrote: post #231

Earlier quoted context omitted.

Yup the regular "8080:8080" bind resulted in a ransom note in my database on day 1. Bound it to localhost only now.

one thing I always forget about, is that you have a whole network of 127.0.0.0/8 , not just one IP. So you can create multiple addresses with multiple separate "domains" mapped statically in /etc/hosts, and allow multiple apps to listen on "the same" port without conflicts.