Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I got hacked: My Hetzner server started mining Monero

blog.jakesaunders.dev

Post reply on HN
Print view View original

71–80 of 422 posts

Re: I got hacked: My Hetzner server started mining Monero

#71

Post by venturecruelty »

dylan604 wrote: post #61
jakelsaunders94 wrote: post #53

Earlier quoted context omitted.

Hahaha, I did tell him this afternoon. This is the bloke who has the same password for all his banking apps despite me buying him 1password though. The imminent threat from RCE's just didn't land.

Buying someone 1Pass, or the like, and calling it good is not enough. People using password managers forget how long it takes to visit all of the sites you use to create that site's record, then update the password to a secure one, and then log out and log back in with the new password to test it is good. For a lot of people having a password manager bought for them is going to be over it after the second site. Just…

Yeah, mom and I sat down one afternoon and we changed all of her passwords to long, secure ones, generated by 1Password. It was a nice time! It also helped her remember all of the different services she needs to access, and now they're all safely stored with strong passwords. And it was a nice way to connect and spend some time together. :)

Re: I got hacked: My Hetzner server started mining Monero

#72

Post by spiderfarmer »

qingcharles wrote: post #62

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

I pay for Hetzner because it’s an EU based, sane company without a power hungry CEO.

Re: I got hacked: My Hetzner server started mining Monero

#73

Post by angulardragon03 »

qingcharles wrote: post #62

As an aside, if you're using a Hetzner VPS for Umami you might be over-specced. I just cut my Hetzner bill by $4/mo by moving my Umami box to one of the free Oracle Cloud VPS after someone on here pointed out the option to me. Depends whether this is a hobby thing or something more serious, but that option is there.

All fine and well, but oracle will threaten to turn off your instance if you don’t maintain a reasonable average CPU usage on the free hosts, and will eventually do so abruptly.

This became enough of a hassle that I stopped using them.

Re: I got hacked: My Hetzner server started mining Monero

#74

Post by venturecruelty »

dinkleberg wrote: post #14
_fqqr wrote: post #9

This article is very interesting at first but I once again get disappointed after reading clear signs of AI like "Why this matters" and "The moment of truth", and then the whole thing gets tainted with signs all over the place.

Yeah personally I’d much rather read a poorly constructed article with actually interesting content than the same content put into the formulaic AI voice.

Article's been edited:

>Edit: A few people on HN have pointed out that this article sounds a little LLM generated. That’s because it’s largely a transcript of me panicking and talking to Claude. Sorry if it reads poorly, the incident really happened though!

For what it's worth, this is not an excuse, and I still don't appreciate being fed undisclosed slop. I'm not even reading it.

Re: I got hacked: My Hetzner server started mining Monero

#75

Post by venturecruelty »

Carrok wrote: post #21
miramba wrote: post #13

Earlier quoted context omitted.

Is there a way to do that and still be able to access the server?

Many ways. Using a "bastion host" is one option, with something like wireguard or tinc. Tailscale and similar services are another option. Tor is yet another option.

>Never expose your server IP directly to the internet, vps or baremetal.

Re: I got hacked: My Hetzner server started mining Monero

#76

Post by necovek »

V__ wrote: post #34
TheRealPomax wrote: post #23

Earlier quoted context omitted.

Docker containers with root have rootish rights on the host machine too because the userid will just be 0 for both. So if you have, say, a bind mount that you play fast and loose with, the docker user can create 0777 files outside the docker container, and now we're almost done. Even worse if "just to make it work" someone runs the container with --privileged and then makes the terminal mistake of exposing that conta…

Can you explain this a bit further? Wouldn't that 0777 file outside docker be still executed inside the container and not on the host?

I believe they meant you could create an executable that is accessible outside the container (maybe even as setuid root one), and depending on the path settings, it might be possible to get the user to run it on the host.

Imagine naming this executable "ls" or "echo" and someone having "." in their path (which is why you shouldn't): as long as you do "ls" in this directory, you've ran compromised code.

There are obviously other ways to get that executable to be run on the host, this just a simple example.

Re: I got hacked: My Hetzner server started mining Monero

#77

Post by Hackbraten »

iLoveOncall wrote: post #17

> ls -la /tmp/.XIN-unix/javae Unless ran as root this could return file not found because of missing permissions, and not just because the file doesn't actually exist, right? > “I don’t use X” doesn’t mean your dependencies don’t use X That is beyond obvious, and I don't understand how anyone would feel safe from reading about a CVE on a widely used technology when they run dozens of containers on their server. I hav…

> No more Umami. I’m salty.

But kudos for the word play!

Re: I got hacked: My Hetzner server started mining Monero

#78

Post by pigbearpig »

You might want to harden that those outbound firewall rules as another step. Did the Umami container need the ability to initiate connections? If not, that would eliminate the ability to do the outbound scans.

Also could prevent something to exfiltrate sensitive data.

Re: I got hacked: My Hetzner server started mining Monero

#79

Post by sergsoares »

j45 wrote: post #11

Never expose your server IP directly to the internet, vps or baremetal.

Not expose the server IP is one practice (obfuscation) in a list of several options.

But that alone would not solve the problem being a RCE from HTTP, that is why edge proxy provider like Cloudflare[0] and Fastfy[1] proactivily added protections in his WAF products.

Even cloudflare had an outage trying to protect his customers[3].

- [0] https://blog.cloudflare.com/waf-rules-react-vulnerability/ - [1] https://www.fastly.com/blog/fastlys-proactive-protection-cri... - [2] https://blog.cloudflare.com/5-december-2025-outage/

Re: I got hacked: My Hetzner server started mining Monero

#80

Post by rnhmjoj »

meisel wrote: post #38

Is mining via CPU even worthwhile for the hackers? I thought ASICs dominated mining

This is the PoW scheme that Monero currently uses:

> RandomX utilizes a virtual machine that executes programs in a special instruction set that consists of integer math, floating point math and branches. > These programs can be translated into the CPU's native machine code on the fly (example: program.asm). > At the end, the outputs of the executed programs are consolidated into a 256-bit result using a cryptographic hashing function (Blake2b).

I doubt that you anyone managed to create an ASIC that does this more efficiently and cost effective than a basic CPU. So, no, probably no one is mining Monero using an ASIC.

Post reply on HN