Only lesson seems to be use ufw! (or equivalent)
I got hacked: My Hetzner server started mining Monero
171–180 of 422 posts
Re: I got hacked: My Hetzner server started mining Monero
#172a) containers don't contain
b) if you want to limit your hosting environment to only the language/program you expect to run you should provision with unikernels which enforce it
Re: I got hacked: My Hetzner server started mining Monero
#173This is a perfect example of how honeypots, anti-malware organizations, and blacklists are so important to security.
Even if you are an owasp member who reads daily vulnerability reports, it's so easy to think you are unaffected.
Re: I got hacked: My Hetzner server started mining Monero
#174Something similar happened to me last year, it was with an unsecured user account accessible over ssh with password authentication, something like admin:admin that I forgot about.
At least that's what I think happened because I never found out exactly how it was compromised.
The miner was running as root and it's file was even hidden when I was running ls ! So I didn't understand what was happening, it was only after restarting my VPS from with a rescue image, and after mounting the root filesystem, that I found out the file I was seeing in the processes list did indeed exist.
Re: I got hacked: My Hetzner server started mining Monero
#175The first step I would take is running podman instead of Docker to prevent container escapes. Podman can be run truly rootless and doesn't mess with your firewall. Next I would drop all caps if possible.
What's the difference between running Podman and running Docker in rootless mode? (Other than Docker messing with the firewall, which apparently OP doesn't know about… yet). I understand Podman doesn't require a daemon, but is that all there is to it, or is there something I'm missing?
Rootless docker is more compatible than podman I found. I experienced crash dumps in say mssql with podman, but not with rootless docker.
Also rootless docker does not bypass ufw like rootful docker does.
Re: I got hacked: My Hetzner server started mining Monero
#176Not proof read by a human. It claims more than once the vulnerability was related to Puppeteer. Hallucination! "CVE-2025-66478 - Next.js/Puppeteer RCE)"
TFA mentions it’s mostly a transcript of a Claude session literally in the first paragraph.
That was added as an edit. It does not cover the inaccuracies contained within. It should more realistically say "this article was generated by an LLM and may contain several errors which I didn't bother to find or correct."
Re: I got hacked: My Hetzner server started mining Monero
#177Earlier quoted context omitted.
> Not if you run it in rootless mode. Same as for docker, yes? https://docs.docker.com/engine/security/rootless/
nope. You should look at https://docs.docker.com/engine/network/ Networking is just better in podman.
> nope. You should look at https://docs.docker.com/engine/network/
That page does not address rootless Docker, which can be installed (not just run) without root, so it would not have the ability to clobber firewall rules.
Re: I got hacked: My Hetzner server started mining Monero
#178Hahaha OP could be in deep trouble depending on what types of creds/data they had in that container. I had replied to a child comment but I figure best to reply to OP. From the root container, depending on volume mounts and capabilities granted to the container, they would enumerate the host directories and find the names of common scripts and then overwrite one such script. Or to be even sneakier, they can append th…
Luckily umami in docker is pretty compartimentalized. All data is in the and the DB runs in another container. The biggest thing is the DB credentials. The default config requires no volume mounts so no worries there. It runs unprivileged with no extra capabilities. IIRC don't think the container even has bash, a few of the exploits that tried to run weren't able to due to lack of bash in the scripts they ran.
Deleting and remaking the container will blow away all state associated with it. So there isn't a whole lot to worry about after you do that.
Re: I got hacked: My Hetzner server started mining Monero
#179> The Reddit post I’d seen earlier? That guy got completely owned because his container was running as root. The malware could: [...] Is that the case, though? My understanding was, that even if I run a docker container as root and the container is 100% compromised, there still would need to be a vulnerability in docker for it to “attack” the host, or am I missing something?
If the container is running in privileged mode you can just talk to the docker socket to the daemon on the host, spawn a new container with direct access to the root filesystem, and then change anything you want as root.
Notably, if you run docker-in-docker, Docker is probably not a security boundary. Try this inside any dind container (especially devcontainers): docker run -it --rm --pid=host --privileged -v /:/mnt alpine sh
I disagree with other commenters here that Docker is not a security boundary. It's a fine one, as long as you don't disable the boundary, which is as easy as running a container with `--privileged`. I wrote about secure alternatives for devcontainers here: https://cgamesplay.com/recipes/devcontainers/#docker-in-devc...
Re: I got hacked: My Hetzner server started mining Monero
#180Earlier quoted context omitted.
that's a really good point .. but, I think 99% of docker users believe it is a a sandbox and treat it as such.
Not 99%. Many people run an hypervisor and then a VM just for Docker. Attacker now needs a Docker exploit and then a VM exploit before getting to the hypervisor (and, no, pwning the VM ain't the same as pwning the hypervisor).
'Double-bagging it' was what we called it in my day.