Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

301–310 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#301

Post by danparsonson »

xetera wrote: post #264
danparsonson wrote: post #92

No firewall! Wow that's brave. Hetzner will let you configure one that runs outside of the box so you might want to add that too, as part of your defense in depth - that will cover you if you make a mistake with ufw. Personally I keep SSH firewalled only to my home address in this way; if I'm out and about and need access, I can just log into Hetzner's website and change it temporarily.

For the record this is only available for their VPS offering and not dedis. If you rent a dedi through their server auction you still need to configure your own firewall.

Dedicated servers can configure external firewalls too; there's a tab for it on the server config. It's basic but functional.

Re: I got hacked: My Hetzner server started mining Monero

#303

Post by hypeatei »

esaym wrote: post #202

So this is part of the "React2Shell" CVE-2025-55182 issue? I find it interesting that this seems to get so little publicity. Almost like the issue is normal or expected. And it looks like the affected versions go back a little over a year. So if you've deployed anything with Next.js over the last 12 months your web app is now probably part of a million node bot net. And everyone's advice is just "use docker" or "inst…

You can write web apps without touching the hottest JS framework of the week. I've never touched these frameworks that try to blur the line between frontend and backend.

Pick a solid technology (.NET, Java, Go, etc...) for the backend and use whatever you want for your frontend. Voila, less CVEs and less churn!

Re: I got hacked: My Hetzner server started mining Monero

#306

Post by gus_ »

bostik wrote: post #292
gus_ wrote: post #155

Earlier quoted context omitted.

it doesn't matter what netfilter frontend you use if you allow outbound connections from any binary. In order to stop these attacks, restrict outbound connections from unknown / not allowed binaries. This kind of malware in particular requires outbound connections to the mining pools. Others downloads scripts or binaries from remote servers, or try to communicate with their c2c servers. On the other hand, removing ex…

> On the other hand, removing exec permissions to /tmp, /var/tmp and /dev/shm is also useful. Sadly that's more of a duck tape or plaster, because any serious malware will launch their scripts with the proper '/bin/bash /path/to/dropped/payload' invocation. A non-exec mount works reasonably well only against actual binaries dropped into the paths, because it's much less common to launch them with the less known '/bin…

I agree. That's why I said that it's also useful. It won't work in all scenarios, but in most of the cryptomining attacks, files dropped to /tmp are binaries.

Re: I got hacked: My Hetzner server started mining Monero

#307

Post by loloquwowndueo »

themafia wrote: post #176
loloquwowndueo wrote: post #150

Earlier quoted context omitted.

TFA mentions it’s mostly a transcript of a Claude session literally in the first paragraph.

That was added as an edit. It does not cover the inaccuracies contained within. It should more realistically say "this article was generated by an LLM and may contain several errors which I didn't bother to find or correct."

That’s fair!

Re: I got hacked: My Hetzner server started mining Monero

#308

Post by arminiusreturns »

3np wrote: post #106

> I also enabled UFW (which I should have done ages ago) I disrecommend UFW. firewalld is a much better pick in current year and will not grow unmaintainable the way UFW rules can. firewall-cmd --persistent --set-default-zone=block firewall-cmd --persistent --zone=block --add-service=ssh firewall-cmd --persistent --zone=block --add-service=https firewall-cmd --persistent --zone=block --add-port=80/tcp firewall-cmd --…

UFW and Firewall-CMD both just use iptables in that context though. The real upgrade is in switching to nftables. I know I'm going to need to learn eBpf as the next step too, but for now nftables is readable and easy to grok especially after you rip out the iptables stuff, but technically nftables is still using netfilter.

And ufw supports nftables btw. I think the real lesson is write your own firewalls and make them non-permissive - then just template that shit with CaC.

Re: I got hacked: My Hetzner server started mining Monero

#309

Post by lmf4lol »

jakelsaunders94 wrote: post #41
seafoamteal wrote: post #24

Earlier quoted context omitted.

Hi Jake! Cool article, and it's something I'll keep in mind when I start giving my self-hosted setup a remodel soon. That said, I have to agree with the parent comment and say that the LLM writing style dulled what would otherwise have been a lovely sysadmin detective work article and didn't make me want to explore your site further. I'm glad you're up to writing more of your own posts, though! I'm right there with y…

Thanks for the encouragement! I find it difficult to write articles beyond simply stating a series of facts. I tried handwriting https://blog.jakesaunders.dev/schemaless-search-in-postgres/ bit I thought it came off as rambling. Maybe I'll have a go at redrafting this tomorrow in non LLM-ese.

This is much more pleasent to read and it gives a great insight into your actual thought process. Thanks for sharing and great writeup.

Re: I got hacked: My Hetzner server started mining Monero

#310

Post by reedlaw »

esaym wrote: post #202

So this is part of the "React2Shell" CVE-2025-55182 issue? I find it interesting that this seems to get so little publicity. Almost like the issue is normal or expected. And it looks like the affected versions go back a little over a year. So if you've deployed anything with Next.js over the last 12 months your web app is now probably part of a million node bot net. And everyone's advice is just "use docker" or "inst…

I had a Pangolin instance compromised by this: https://github.com/orgs/fosrl/discussions/2014
Post reply on HN