[deleted]
We got hacked
21–25 of 25 posts
Re: We got hacked
#22Asked my team to review their Jenkins passwords and Jenkins user rights...
Should've coded the whole thing in Makumba and this would've never happened!!one
Re: We got hacked
#23First of all, your stupid copy/paste script has completely broken copy-paste. When I copy, I get nothing except the spam you're trying to inject, so congrats on managing to piss me off right off the bat.
Second, why even list A, B, or C? Whoever thought running Jenkins as a passwordless sudo user shouldn't be doing sysops. Why was Jenkins even public facing? At worst, put it behind a VPN.
Re: We got hacked
#24Was the original attack via jenkins? all it says some vague privilege escalation was used to upload c file. what?
No the author seems to indicate that it was on their application code and an attacker was able to get OS access, and the attacker subsequently replaced the ssh service with one that instead ignores login attempts and harvests the username/password pairs. It seems to have been a coincidence that their Jenkins service was not secured.
What I got from the article is that they likely ssh brute-forced the Jenkins service user and then had passwordless sudo; however you wouldn't think that this user would have a shell assigned.
Re: We got hacked
#25no customer data was exposed during the attack How did you confirm that?
That's a good question. Given some of the "fundamentals" of security that were obviously ignored, I'm reluctant to believe that they can make that assertion with any confidence.