18 ms·

This was reported first at the begining of May. They got into the server via that Salt vuln and just ran crypto miners on the server, they didn't (as far as any

This was reported first at the begining of May. They got into the server via that Salt vuln and just ran crypto miners on the server, they didn't (as far as anyone knows) use the keys to do anything bad. From the original email reporting the problem: (the attacker doesn't seem to realize that they gained access to the keys and were running other services on the instracture)

some_furry 6y ago
Cryptocurrency continues to improve security by polluting attackers with short-sighted incentives that prevent real damage from occurring.
- nailer 6y ago
  I don't think cryptocurrency has changed much in that regard. Before CC mining the default use for an owned box was warez servers, IRC or jump hosts.
  - gruez 6y ago
    Those are much harder to detect, especially the latter two.
    - nailer 6y ago
      I'm not sure. Most crackers don't use port knocking or other obfuscation techniques, so something that shouldn't be listening on a box and a large amount of bandwidth being used is normally a good indicator.
      - gruez 6y ago
        I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. If you're monitoring your servers for unknown listening ports, chances are you're keeping your systems up to date. Same with bandwidth, although if bandwidth is expensive (eg. cloud providers), your accounting dept might notice.
        nailer 6y ago
        > I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. Agreed. CC mining would be CPU on most servers, and go undetected for the same reasons. Some servers and gaming rigs would have GPUs, but not many vs CPUs.
- cordite 6y ago
  3 max-expensive "analytics" servers were how my company discovered a breach. "Why is our cost projected to go up so significantly?" They were of course mining on GPUs.
VWWHFSfQ 6y ago
Nobody knows for sure what they were doing since the script dropped via the salt vulnerability downloaded new scripts and executed them every 60 seconds. Just because all they found were crypto miners doesn't mean it was the only thing it was doing. And also there were multiple groups exploiting this vulnerability at the same time as was evidenced in one of the scripts trying to detect and eliminate competing scripts dropped by someone else
lowbloodsugar 6y ago
Two approaches to doing nasty things on other people's servers: 1) be very quiet and try not to get caught at all. 2) be very noisy doing something "innocent" like running a bitcoin miner. If you do not assume that everything bad that could have happened, did happen, then you will have some interesting explaining to do later, with lawyers.

some_furry 6y ago

Cryptocurrency continues to improve security by polluting attackers with short-sighted incentives that prevent real damage from occurring.

nailer 6y ago
I don't think cryptocurrency has changed much in that regard. Before CC mining the default use for an owned box was warez servers, IRC or jump hosts.
- gruez 6y ago
  Those are much harder to detect, especially the latter two.
  - nailer 6y ago
    I'm not sure. Most crackers don't use port knocking or other obfuscation techniques, so something that shouldn't be listening on a box and a large amount of bandwidth being used is normally a good indicator.
    - gruez 6y ago
      I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. If you're monitoring your servers for unknown listening ports, chances are you're keeping your systems up to date. Same with bandwidth, although if bandwidth is expensive (eg. cloud providers), your accounting dept might notice.
      - nailer 6y ago
        > I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. Agreed. CC mining would be CPU on most servers, and go undetected for the same reasons. Some servers and gaming rigs would have GPUs, but not many vs CPUs.
cordite 6y ago
3 max-expensive "analytics" servers were how my company discovered a breach. "Why is our cost projected to go up so significantly?" They were of course mining on GPUs.

VWWHFSfQ 6y ago

Nobody knows for sure what they were doing since the script dropped via the salt vulnerability downloaded new scripts and executed them every 60 seconds. Just because all they found were crypto miners doesn't mean it was the only thing it was doing. And also there were multiple groups exploiting this vulnerability at the same time as was evidenced in one of the scripts trying to detect and eliminate competing scripts dropped by someone else

lowbloodsugar 6y ago

Two approaches to doing nasty things on other people's servers: 1) be very quiet and try not to get caught at all. 2) be very noisy doing something "innocent" like running a bitcoin miner. If you do not assume that everything bad that could have happened, did happen, then you will have some interesting explaining to do later, with lawyers.