Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Untitled topic

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 53 posts

Re: undefined

#21

Post by anotherlogin448 »

thephyber wrote: post #18

The article hasn’t proven that the infection is in the GHCR Docker image, let alone the newest version. It only says that they had the image installed, then (unknown time later) noticed the infection. According to some messages on Hotio’s Discord server from 2023-11-25, qBitTorrent moved from fixed admin credentials to randomized at initialization. I think MrHotio’s message about that crypto miner was likely a joke a…

The comment was 100% in jest / sarcasm.

OP's system got compromised at some point; the images are clean.

Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system

Re: undefined

#22

Post by anotherlogin448 »

baobun wrote: post #11

Supposedly this image. https://github.com/hotio/qbittorrent/pkgs/container/qbittorr... Based on https://github.com/hotio/base Should be tracable via GitHub Actions logs for anyone signed on - if it is indeed supply-chain and not a qbittorrent exploit or something else.

Indeed. OP's investigation proves nothing other their device / system was compromised and provides 0 evidence the container itself is the issue.

Re: undefined

#23

Post by thephyber »

anotherlogin448 wrote: post #16
wok4899 wrote: post #12

Omg! I am one of the user! Good find. I maily use for built-in VPN facility, gluetun do not cut out. But now time to re-think. I thought my 2000+ linux iso was causing medium CPU usage. But still lack of GPU, on my unraid server with 50+ docker containers running 24/7 CPU load is 2.31 2.04 2.00 so I wonder mining ever triggered? Ps. I do have such binary on my machine as well, ps -ef | grep netservlet root 3708105 36…

OP got compromised there's no issue in any hotio container. Code and CI is all open source.

My money is on the author had not updated their docker image version/tag in over 2 years.

It looks like the app used weak hard-coded admin credentials back then. Appears to have been fixed in 2023.

Re: undefined

#24

Post by wok4899 »

anotherlogin448 wrote: post #16
wok4899 wrote: post #12

Omg! I am one of the user! Good find. I maily use for built-in VPN facility, gluetun do not cut out. But now time to re-think. I thought my 2000+ linux iso was causing medium CPU usage. But still lack of GPU, on my unraid server with 50+ docker containers running 24/7 CPU load is 2.31 2.04 2.00 so I wonder mining ever triggered? Ps. I do have such binary on my machine as well, ps -ef | grep netservlet root 3708105 36…

OP got compromised there's no issue in any hotio container. Code and CI is all open source.

I never have exposed this container to the world ever, and my server do report the existence of such binary. That is the reason based on CPU usage I suspect that mining never triggered.

> ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet

Re: undefined

#25

Post by thephyber »

dalmo3 wrote: post #2

It's a docker image, NOT qbittorrent.

For clarity: The post is about a server running a 3rd party docker image of qbittorrent.

But there’s no evidence presented that it was hotio’s docker image on GCHR which was compromised, and there is reason to believe it might be an older, vulnerable version of qbittorrent in the docker image which was compromised.

The vulnerability: (credit crtasm)

https://torrentfreak.com/qbittorrent-web-ui-exploited-to-min...

Re: undefined

#26

Post by ponchel »

thephyber wrote: post #18

The article hasn’t proven that the infection is in the GHCR Docker image, let alone the newest version. It only says that they had the image installed, then (unknown time later) noticed the infection. According to some messages on Hotio’s Discord server from 2023-11-25, qBitTorrent moved from fixed admin credentials to randomized at initialization. I think MrHotio’s message about that crypto miner was likely a joke a…

Currently, on my own system, the docker container of qBitTorrent definitely doesn't seem to use more resources than it should.

Re: undefined

#27

Post by wok4899 »

thephyber wrote: post #23
anotherlogin448 wrote: post #16

Earlier quoted context omitted.

OP got compromised there's no issue in any hotio container. Code and CI is all open source.

My money is on the author had not updated their docker image version/tag in over 2 years. It looks like the app used weak hard-coded admin credentials back then. Appears to have been fixed in 2023.

I am running, ghcr.io/hotio/qbittorrent:release-5.1.1

Re: undefined

#28

Post by wok4899 »

anotherlogin448 wrote: post #15

And yet everything is open source and easily auditable. Most likely OP got pwnd and clearly is unable to understand sarcasm. You all really think that hotio snuck a crypto miner in somehow with all clearly open source code - and not a single person but OP noticed for years?

With the SSH/NPM supply chain attack, we all live in fear now. It just need one very smart person to deploy such hack. I'm not saying hotio did something, all I am saying that with new information, we all should check our deployment. Along with OP I'm affected, where I never have exposed the docker to world ever.

So we should not deny the possibility of something off here.

Re: undefined

#29

Post by bakugo »

anotherlogin448 wrote: post #21
thephyber wrote: post #18

The article hasn’t proven that the infection is in the GHCR Docker image, let alone the newest version. It only says that they had the image installed, then (unknown time later) noticed the infection. According to some messages on Hotio’s Discord server from 2023-11-25, qBitTorrent moved from fixed admin credentials to randomized at initialization. I think MrHotio’s message about that crypto miner was likely a joke a…

The comment was 100% in jest / sarcasm. OP's system got compromised at some point; the images are clean. Hell if he didn't want to post his clickbait he easily could have verified with a clean image on a known clean system

Brand new account, 7 different comments on this post, all aggressively trying to discredit it.

A bit suspicious, don't you think?

Re: undefined

#30

Post by bakugo »

wok4899 wrote: post #24
anotherlogin448 wrote: post #16

Earlier quoted context omitted.

OP got compromised there's no issue in any hotio container. Code and CI is all open source.

I never have exposed this container to the world ever, and my server do report the existence of such binary. That is the reason based on CPU usage I suspect that mining never triggered. > ps -ef | grep netservlet > root 3708105 3665360 0 08:06 pts/2 00:00:00 grep netservlet

How long have you been running this container?

Can you check the contents of your qBittorrent.conf?

Post reply on HN