We got hacked
plumbr.eu
We got hacked
1–10 of 25 posts
Re: We got hacked
#2Clear and open about it. Good.
Re: We got hacked
#3Asked my team to review their Jenkins passwords and Jenkins user rights...
Re: We got hacked
#4Asked my team to review their Jenkins passwords and Jenkins user rights...
I don't know if you're doing this, but I think it's a bad idea to leave Jenkins publicly accessible. Indeed, IMHO, it's a bad idea to leave stuff that should not be accessible by the general public publicly accessible. Especially things that have access to your code.
Do ask your team to review passwords and user rights, but also put this service and others like it behind a VPN. Then both the VPN server and Jenkins will have to have holes simultaneously before you get hacked.
Re: We got hacked
#5Was the original attack via jenkins? all it says some vague privilege escalation was used to upload c file. what?
Re: We got hacked
#6Was the original attack via jenkins? all it says some vague privilege escalation was used to upload c file. what?
I believe the issue was related to the fact that the user running Jenkins was a full passwordless sudo user.
Maybe the attacker used the groovy console too...
Re: We got hacked
#7Asked my team to review their Jenkins passwords and Jenkins user rights...
I don't know if you're doing this, but I think it's a bad idea to leave Jenkins publicly accessible. Indeed, IMHO, it's a bad idea to leave stuff that should not be accessible by the general public publicly accessible. Especially things that have access to your code. Do ask your team to review passwords and user rights, but also put this service and others like it behind a VPN. Then both the VPN server and Jenkins wi…
As the main hero of that story, I can assure you that we are working on VPN setup right now. I guess this is not in top-10 checklist for a startup.
Re: We got hacked
#8This whole post reads like "How Not to Use AWS" instruction guide.
If you're running anything important on a single EC2 instance, you're doing it wrong. If you're logging in and manually configuring an EC2 instance, you're also doing it wrong.
Re: We got hacked
#9This whole post reads like "How Not to Use AWS" instruction guide. If you're running anything important on a single EC2 instance, you're doing it wrong. If you're logging in and manually configuring an EC2 instance, you're also doing it wrong.
That's helpful, cheers.
How about letting us lesser plebs know how to do it properly then?
Re: We got hacked
#10This whole post reads like "How Not to Use AWS" instruction guide. If you're running anything important on a single EC2 instance, you're doing it wrong. If you're logging in and manually configuring an EC2 instance, you're also doing it wrong.
That's helpful, cheers. How about letting us lesser plebs know how to do it properly then?
This is probably beyond the scope of such a thread, but configuration automation via Chef or Puppet is where you'd start.