Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hetzner Servers Compromised

wiki.hetzner.de

Post reply on HN
Print view View original

111–120 of 133 posts

Re: Hetzner Servers Compromised

#111

Post by ricardobeat »

alexvr wrote: post #104

Am I an overly-cautious nubcake, or do any of you also refrain from clicking the link when it says, "We've been compromised. Come visit our site!"? If I were a mean dude who hacked into some prominent site, the first thing I would do is submit a link to HN that points to a malicious "article" and laugh as malware gets thrust into thousands of computers.

Way too much mork. If you have a way of infecting computers by simply visiting a webpage, just tag it some kind of porn and post on reddit & other forums.

Re: Hetzner Servers Compromised

#112

Post by zapt02 »

berkay wrote: post #41

Things seem to be getting worse there. A server we have there just went offline, and their management servers are not responding. I wonder it's part of the exploit or as a result of attempts to "fix" the problem

I had 5 minutes of downtime, but everything seems to be back in working order.

Re: Hetzner Servers Compromised

#113

Post by geoffw8 »

925dk wrote: post #92
warrenm wrote: post #86

Earlier quoted context omitted.

not true for all customers - I needed to send them nothing of the kind (in the US)

This was dedicated servers (root servers they call them) - and I'm from Europe.

Hey - I didn't have to provide anything but a CC number and I'm based in Europe. We don't have a huge account, how many boxes did you order?

Re: Hetzner Servers Compromised

#114

Post by Dylan16807 »

darkarmani wrote: post #54
gommm wrote: post #9

Earlier quoted context omitted.

Just got the email too. I'm quite happy with how clear they are about what happened and how they hash their passwords. Very different from Linode. I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal).

> I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal). If they fall under PCI:DSS, they might not be able to use bcrypt since it isn't an official recommended standard. (I am of course assuming that they mean PBKDF2 when they say salted SHA256.)

That's quite an assumption.

Re: Hetzner Servers Compromised

#115

Post by Dylan16807 »

larrys wrote: post #67
925dk wrote: post #51

As part of the registration process with hetzner.de, you have to send them scans of personal documents (such as passport, drivers license or similar). I asked them just now if these systems were compromised and they promptly replied: "The system that stores scans of ids, credit cards and so on was not compromised. In addition to that, we delete that information after 21 days."

"you have to send them scans of personal documents (such as passport, drivers license or similar)." What? Seriously? "In addition to that, we delete that information after 21 days." Hmm, do they delete the info that ends up on backup copies? How do you know they even actually delete it in 21 days? It's not like there is a third party even auditing which you can rely on. (Not that I'd ever do that for something like t…

If they're proper backups then they're offline and you don't have to worry about them getting hacked.

Re: Hetzner Servers Compromised

#116

Post by thejosh »

perlgeek wrote: post #88
gokhan wrote: post #53

The info in the mail regarding the safety of credit card info contradicts with the linked FAQ. FAQ: Bank details are encrypted (two-way) in the database. However, it cannot be excluded that the attacker/s have also been able to obtain access to the key. Mail: With credit cards, only the last three digits of the card number, the card type and the expiry date are saved in our systems. All other card data is saved solel…

Hetzner probably has many customers who pay with debit card/recurring direct debit instead of credit card. It's quite common in Germany.

They also allow PayPal, which I recently changed to with Hetzner. 99% of my payments to websites are PayPal, for this very reason.

Re: Hetzner Servers Compromised

#117

Post by e12e »

amarraja wrote: post #4
anoother wrote: post #2

Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…

Have all Hetzner customers received this mail? I currently have a couple of servers with them and have received nothing yet.

I can also confirm receiving the email (but I really need to tidy up my mail filters, I actually read about the hack here first).

Nice email, one improvement would be to host the wiki behind a proper https-site -- especially since we already know the attack appears somewhat sophisticated, and that the attackers gained control over servers on the Hetzner network. Now, the faq doesn't contain anything obviously bad (email your credit card info to... etc) -- but one small thing that could be improved.

Other than that I appreciate how Hetzner have handled this so far.

Re: Hetzner Servers Compromised

#118

Post by e12e »

Dylan16807 wrote: post #115
larrys wrote: post #67

Earlier quoted context omitted.

"you have to send them scans of personal documents (such as passport, drivers license or similar)." What? Seriously? "In addition to that, we delete that information after 21 days." Hmm, do they delete the info that ends up on backup copies? How do you know they even actually delete it in 21 days? It's not like there is a third party even auditing which you can rely on. (Not that I'd ever do that for something like t…

If they're proper backups then they're offline and you don't have to worry about them getting hacked.

They might be stolen.

Re: Hetzner Servers Compromised

#119

Post by e12e »

FooBarWidget wrote: post #11

Sigh, another hosting provider hack. As if Linode and OVH are not enough. This is the reason why we use full disk encryption, where we enter the key manually during boot. This way we're protected against many types of hosting provider hacks.

Well, maybe. Do you have servers with a secure boot environment?

Also, if the attackers are able to attack your servers in a similar fashion (gaining access without reboot) -- they have full access to the already decrypted disks (well virtual devices).

As for other comments on automating booting -- as eg cryptsetup allows entering the encryption key via ssh -- automating that shouldn't be too hard.

I still think that it mostly defends against someone stealing/cloning the physical disks though.

Re: Hetzner Servers Compromised

#120

Post by Dylan16807 »

e12e wrote: post #118
Dylan16807 wrote: post #115

Earlier quoted context omitted.

If they're proper backups then they're offline and you don't have to worry about them getting hacked.

They might be stolen.

Okay, but stealing a backup gets you 21 days of those documents, the same amount you can get from the live system. There is no need to worry about backups in particular.
Post reply on HN