3 ms·
This hit RamNode too. > This message is to customers with VPSs on our legacy SolusVM system. > At approximately 20:34 eastern (GMT -4) on May 2, recently publ
by lol768 6y ago
This hit RamNode too.
> This message is to customers with VPSs on our legacy SolusVM system.
> At approximately 20:34 eastern (GMT -4) on May 2, recently published SaltStack vulnerabilities (CVE-2020-11651, CVE-2020-11652) were used to launch cryptocurrency miners on our SolusVM host nodes. The attack disrupted various services in order to allocate as much CPU as possible to the miners. SSH and QEMU processes were killed on some of our CentOS 6 KVM hosts, causing extended downtime in certain cases.
> Upon detecting the disruption, we quickly began to re-enable SSH, disable and remove Salt, kill related processes, and boot shutdown KVM guests. After careful analysis of the exploit used, we do not believe any data was compromised.
> RamNode was not specifically targeted, but rather anyone running SaltStack versions prior to the one released a few days ago (April 29).
- londons_explore 6y ago> After careful analysis of the exploit used, we do not believe any data was compromised. If someone had code running as root on their machine, they can't say that statement with any confidence whatsoever.
- lol768 6y ago> If someone had code running as root on their machine, they can't say that statement with any confidence whatsoever. Indeed, I think you need to assume all guests running on the affected nodes are now compromised.