Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hetzner Servers Compromised

wiki.hetzner.de

Post reply on HN
Print view View original

91–100 of 133 posts

Re: Hetzner Servers Compromised

#91

Post by PaulFreund »

MrCheese wrote: post #35
tbh wrote: post #33

Earlier quoted context omitted.

Of course not, but regardless of who in the company said it, the official support response was as quoted. Not exactly encouraging!

To be fair, Hetzner has very "google translaty" English support for simple matters, so it is not impossible that they simply didn't understand the question

Exactly, and somebody who didn't yet hear the term can easily come to the conclusion that it is an authentification with two "factors" which means basically two things and that would be username and password. In the past there were system with only one factor...

Re: Hetzner Servers Compromised

#92

Post by 925dk »

warrenm wrote: post #86
925dk wrote: post #69

Earlier quoted context omitted.

Yes seriously, here is what they asked me on first order with them: "Since you're a new customer with Hetzner, we ask you for a scan of your passport or ID card (authenticity check). It's only necessary for your first order with us. Please send the scan by fax or as an email attachment." When they say they delete it after 21 days, as they did in the mail I've just received, I trust them. I find their communication on…

not true for all customers - I needed to send them nothing of the kind (in the US)

This was dedicated servers (root servers they call them) - and I'm from Europe.

Re: Hetzner Servers Compromised

#93

Post by sgt »

I use the Robot to access a VNC console of my leased server. I can even do a CTRL-ALT-DELETE and boot the OS in single user mode from it, if I only have access to the Robot.

Doesn't this imply that my server is potentially compromised as well?

Re: Hetzner Servers Compromised

#94

Post by FooBarWidget »

raylu wrote: post #83
FooBarWidget wrote: post #76

Earlier quoted context omitted.

If I have that many servers then I can assume I have a large budget for security, right? I would make a password entering automation system. Ensure that that system is dead-simple and secured to death. It must run no other services, firewalled to death even from the intranet, physically secured in a cage, and must be off most of the time. It is only to be turned on when booting a system, and turning it on not only re…

Wait, this sounds way harder than the previous solution and entering the password over a remote IPMI console.

It's harder to set up. But when the password entering automation system exists, you just grab the key, go to that system, unlock & boot it, then tell it to enter the passwords for your 1000 servers.

Re: Hetzner Servers Compromised

#95

Post by ahi »

saturdayplace wrote: post #85
pekk wrote: post #14

Several events with Linode, now Hetzner. These are relatively "premier," high-quality hosting companies, you can count on thousands and thousands of companies to pay even less attention. Yet every time, the discussion is only about one specific company, without seeing any broader pattern. When are we ever going to draw the conclusion that popular hosting companies (and, actually related, facilities like RubyGems) are…

Is it just the customer account details that apparently make hosting companies attractive targets. If that's the case, I'm wondering why we're not seeing more breaches from all over the e-commerce world. Why just hosting companies?

Maybe the hosting companies are simply more likely to detect a breach. Not a happy thought I know.

Re: Hetzner Servers Compromised

#96

Post by jholman »

chx wrote: post #82
Ecio78 wrote: post #25

Earlier quoted context omitted.

It makes me wonder if there's any connection with the recent Drupal Security problem (they cited a "third-party software installed on the Drupal.org server infrastructure" but they haven't - afaik - disclosed the software name yet)

Nope, there is not, the two are fundamentally different.

Can you clarify why you believe this, or what special knowledge you have?

Re: Hetzner Servers Compromised

#97

Post by WA »

925dk wrote: post #51

As part of the registration process with hetzner.de, you have to send them scans of personal documents (such as passport, drivers license or similar). I asked them just now if these systems were compromised and they promptly replied: "The system that stores scans of ids, credit cards and so on was not compromised. In addition to that, we delete that information after 21 days."

Is this outside of Germany? I rent two servers and I never sent any ID.

This shit is annoying. I think it have been only 6-8 months since the managed server part of Hetzner (KonsoleH) got hacked. Now the VPS/root server part (Robot) got hacked. I understand that both incidents are completely different and it seems that they might've learned a thing or two from the KonsoleH-hack, but still. My address data and my bank data are very likely to be compromised.

But then, changing the hoster doesn't make any sense. My data is somewhere out there, can't get any worse I guess.

Re: Hetzner Servers Compromised

#98

Post by WA »

muxxa wrote: post #58

I've got a login for robot.your-server.de and have changed my password but don't seem to have one for konsoleh.your-server.de. Is the konsoleh login/account something that would have gotten created for me automatically? i.e. do I need to worry about it?

KonsoleH = managed servers

Robot = VPS/root servers

Re: Hetzner Servers Compromised

#99

Post by sneak »

FooBarWidget wrote: post #70
mike_esspe wrote: post #40

Earlier quoted context omitted.

What if attacker infects unencrypted part used for booting? Do you have protection against that? It's relatively easy on Linux, where /boot is usually not encrypted.

The trick is putting all important data in the encrypted part. The unencrypted part must be reconstructable in an automated manner. If you are paranoid and you assume that all unplanned reboots are attacks, then you can reconstruct the unencrypted part every time. Tools like Chef make this relatively easy.

The kernel lives on /boot, and could be subverted to lie about its uptime to convince you that there was no unplanned reboot.

This is the same methodology I use, and I think about these attacks a lot. There is no good/cheap way to verify a remote execution environment right now with commodity hardware. :/

Re: Hetzner Servers Compromised

#100

Post by sneak »

FooBarWidget wrote: post #20
pekk wrote: post #17

Earlier quoted context omitted.

What kind of effect does this have on your I/O performance?

Minor. It costs more CPU because of encryption/decryption. But our servers have so much CPU power, and our workload is mostly dependent on disk I/O throughput, so enabling encryption is almost free.

AES-NI features in modern CPUs reduce it even further.
Post reply on HN