Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hetzner Servers Compromised

wiki.hetzner.de

Post reply on HN
Print view View original

31–40 of 133 posts

Re: Hetzner Servers Compromised

#31

Post by staunch »

freehunter wrote: post #16
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

I am not a Hetzner customer, but the comment about Nagios perked up my ears. I work with some clients who have Nagios running in their environment, and I'm wondering if there is an exploit in Nagios or if it's just a coincidence that this was where they noticed the infection?

It's most likely that Nagios was simply used as a tool. It's easy enough to add a Nagios plugin that does something naughty and call it check_inode_usage or something.

..not that I'm a fan of Nagios' architecture though. I'm not.

Re: Hetzner Servers Compromised

#32

Post by PawelDecowski »

amarraja wrote: post #4
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

Have all Hetzner customers received this mail? I currently have a couple of servers with them and have received nothing yet.

I just got mine now (almost 45 minutes after this submission to HN) so yours is probably still in the queue.

Re: Hetzner Servers Compromised

#33

Post by tbh »

aw3c2 wrote: post #26
tbh wrote: post #7

Considering https://twitter.com/omgtbh/status/337567604887658496 I can't say I'm surprised... (tweet text reproduced here: "I asked Hetzner if they plan to support 2 factor auth & was told that they already do - they require a username and a password. Seriously.")

You don't seriously think that a server admin said that, do you? It was probably some low rank customer service peon.

Of course not, but regardless of who in the company said it, the official support response was as quoted. Not exactly encouraging!

Re: Hetzner Servers Compromised

#34

Post by FooBarWidget »

tbh wrote: post #28
epochwolf wrote: post #23

Earlier quoted context omitted.

How does this help? The key is still stored in memory which I assume the hypervisor has access to.

Hetzner provide a lot of physical machines too, I believe this is what the other poster was talking about.

Physical machines don't prevent keys from leaking out. A physical attacker can analyze power usage usage patterns to extract the encryption key. :)

Re: Hetzner Servers Compromised

#35

Post by MrCheese »

tbh wrote: post #33
aw3c2 wrote: post #26

Earlier quoted context omitted.

You don't seriously think that a server admin said that, do you? It was probably some low rank customer service peon.

Of course not, but regardless of who in the company said it, the official support response was as quoted. Not exactly encouraging!

To be fair, Hetzner has very "google translaty" English support for simple matters, so it is not impossible that they simply didn't understand the question

Re: Hetzner Servers Compromised

#36

Post by jtchang »

The lesson to take from this is you can't rely on someone else providing security for you. You need to make sure you "layer" your security. If your database is compromised make sure you are salting your passwords or at least using a hash that is designed to be resistant against cracking.

This doesn't protect against someone who has root access to your box and manages to capture passwords in the clear as they are being transferred but it does limit the surface of a breach.

Re: Hetzner Servers Compromised

#37

Post by pdpi »

anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

Huh, this doesn't make me happy. I haven't gotten an email yet.

Re: Hetzner Servers Compromised

#38

Post by atesti »

M4v3R wrote: post #29
X4 wrote: post #12

Seriously, again?? I think such a fauxpas shouldn't be tolerated twice.

Do you have link to their previous hack?

In October 2011, unfortunately these links are in German only:

http://www.heise.de/security/meldung/Web-Hoster-Hetzner-geha...

http://www.heise.de/ix/meldung/Datenleck-bei-Hetzner-1356468...

http://www.heise.de/security/meldung/Passwortklau-bei-Hetzne...

There was unauthorized access to customer data, even passwords. Someone claims to have accessed it via an FTP-server where he found a root password to a management server

Re: Hetzner Servers Compromised

#39

Post by gtaylor »

pekk wrote: post #14

Several events with Linode, now Hetzner. These are relatively "premier," high-quality hosting companies, you can count on thousands and thousands of companies to pay even less attention. Yet every time, the discussion is only about one specific company, without seeing any broader pattern. When are we ever going to draw the conclusion that popular hosting companies (and, actually related, facilities like RubyGems) are…

They are of good quality, but let's keep in mind that Hetzner tends to be solidly on the budget side. I am a Hetzner customer, and it stinks that this happened, but let's consider: I don't expect Bugatti quality when I'm paying for a Chevy Malibu.

I do appreciate them being forthcoming and sharing some security details that do make me feel pretty safe. I don't care if they have the last few digits of my CC number, and I've already reset my password. Stinks I had to even think about this, but again, Chevy Malibu.

Re: Hetzner Servers Compromised

#40

Post by mike_esspe »

FooBarWidget wrote: post #11

Sigh, another hosting provider hack. As if Linode and OVH are not enough. This is the reason why we use full disk encryption, where we enter the key manually during boot. This way we're protected against many types of hosting provider hacks.

What if attacker infects unencrypted part used for booting? Do you have protection against that?

It's relatively easy on Linux, where /boot is usually not encrypted.

Post reply on HN