Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hetzner Servers Compromised

wiki.hetzner.de

Post reply on HN
Print view View original

71–80 of 133 posts

Re: Hetzner Servers Compromised

#71

Post by devicenull »

freehunter wrote: post #16
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

I am not a Hetzner customer, but the comment about Nagios perked up my ears. I work with some clients who have Nagios running in their environment, and I'm wondering if there is an exploit in Nagios or if it's just a coincidence that this was where they noticed the infection?

I'm kinda confused about why Nagios was even involved here. If you've got all your checks setup properly, the Nagios host doesn't have any write access to your monitored hosts. You can use NRPE to restrict what commands it runs. Combine that with a read only SNMP account, and even if your Nagios server is compromised it cannot access your server.

Re: Hetzner Servers Compromised

#72

Post by adw »

FooBarWidget wrote: post #30
jonknee wrote: post #21

Earlier quoted context omitted.

Do you have a very small number of servers? Requiring manual steps to boot is not very scalable--if there is an event that requires all your servers to reboot (power outage, mandatory upgrade, etc) you would be in quite a tough spot.

I much prefer having to repeatedly enter the password dozens of times than risking data leaking out - or worse, data being tampered with.

So "yes" – what would you do if you had, say, several hundred (or several thousand) servers?

Re: Hetzner Servers Compromised

#73

Post by wyck »

freehunter wrote: post #16
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

I am not a Hetzner customer, but the comment about Nagios perked up my ears. I work with some clients who have Nagios running in their environment, and I'm wondering if there is an exploit in Nagios or if it's just a coincidence that this was where they noticed the infection?

Well it's hard to tell what Hetzner means, it could be someon just piggybacked onto Nagios, but there there is also this, http://www.cvedetails.com/vulnerability-list/vendor_id-1424/...

Re: Hetzner Servers Compromised

#74

Post by freehunter »

devicenull wrote: post #71
freehunter wrote: post #16

Earlier quoted context omitted.

I am not a Hetzner customer, but the comment about Nagios perked up my ears. I work with some clients who have Nagios running in their environment, and I'm wondering if there is an exploit in Nagios or if it's just a coincidence that this was where they noticed the infection?

I'm kinda confused about why Nagios was even involved here. If you've got all your checks setup properly, the Nagios host doesn't have any write access to your monitored hosts. You can use NRPE to restrict what commands it runs. Combine that with a read only SNMP account, and even if your Nagios server is compromised it cannot access your server.

You might be surprised at the number of incorrectly configured Nagios installations.

Re: Hetzner Servers Compromised

#75

Post by jonknee »

FooBarWidget wrote: post #30
jonknee wrote: post #21

Earlier quoted context omitted.

Do you have a very small number of servers? Requiring manual steps to boot is not very scalable--if there is an event that requires all your servers to reboot (power outage, mandatory upgrade, etc) you would be in quite a tough spot.

I much prefer having to repeatedly enter the password dozens of times than risking data leaking out - or worse, data being tampered with.

Shouldn't all your servers have different passwords? How do you manage the passwords in case you're not available when the server reboots?

Re: Hetzner Servers Compromised

#76

Post by FooBarWidget »

adw wrote: post #72
FooBarWidget wrote: post #30

Earlier quoted context omitted.

I much prefer having to repeatedly enter the password dozens of times than risking data leaking out - or worse, data being tampered with.

So "yes" – what would you do if you had, say, several hundred (or several thousand) servers?

If I have that many servers then I can assume I have a large budget for security, right?

I would make a password entering automation system. Ensure that that system is dead-simple and secured to death. It must run no other services, firewalled to death even from the intranet, physically secured in a cage, and must be off most of the time. It is only to be turned on when booting a system, and turning it on not only requires a password but also physically walking to the cage, opening it with a physical key, and pressing the "on" button. All target servers must be configured in such a way that they can obtain network access before mounting the encrypted part.

But I'm not a security expert. Maybe I've overlooked something.

Re: Hetzner Servers Compromised

#77

Post by FooBarWidget »

jonknee wrote: post #75
FooBarWidget wrote: post #30

Earlier quoted context omitted.

I much prefer having to repeatedly enter the password dozens of times than risking data leaking out - or worse, data being tampered with.

Shouldn't all your servers have different passwords? How do you manage the passwords in case you're not available when the server reboots?

Have two people know all the passwords. Let each of them encrypt this list of passwords with a password only they individually know. Sync passwords each time someone changes something.

Re: Hetzner Servers Compromised

#78

Post by mythz »

amarraja wrote: post #4
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

Have all Hetzner customers received this mail? I currently have a couple of servers with them and have received nothing yet.

yes, received mine this morning as well.

Re: Hetzner Servers Compromised

#79

Post by oijaf888 »

darkarmani wrote: post #54
gommm wrote: post #9

Earlier quoted context omitted.

Just got the email too. I'm quite happy with how clear they are about what happened and how they hash their passwords. Very different from Linode. I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal).

> I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal). If they fall under PCI:DSS, they might not be able to use bcrypt since it isn't an official recommended standard. (I am of course assuming that they mean PBKDF2 when they say salted SHA256.)

https://www.pcisecuritystandards.org/pdfs/pci_dss_glossary_v... seems to list Blowfish as an approved standard as far as the PCI standards group is concerned.

Re: Hetzner Servers Compromised

#80

Post by StavrosK »

illumen wrote: post #48

Their SSL certificate is fucked for their security page... oh dear. https://wiki.hetzner.de/index.php/Security_Issue/en Hope everyone has fun with their identity theft cleanups. They ask people for ID scans. Bank details are compromised. boo! This was announced AFTER the German work day was done. Really nice for admins. Thanks.

You would have preferred that they waited until tomorrow?
Post reply on HN