22 ms·
Disposable Root Servers
- gnarbarian 4y agohoneypot
- jetbalsa 4y agoOh... these are inside a docker container... that sounds ripe for a kernel privesc -- Also its not /real/ root :V
- normaler 4y agoBetter term would be disposable root shell. I am interested in the networking part of it. How that is achieved.
- kxrm 4y agoGitHub repo https://github.com/hackerschoice/segfault https://github.com/hackerschoice/segfault Not sure if it covers your question though.
- woodruffw 4y agoIt looks like they bind the Docker socket into the guest controller[1], but maybe not the guest itself. But yeah: unrestricted container root plus any capabilities means that they're only one low-effort bug away from a container escape. [1]: https://github.com/hackerschoice/segfault/blob/main/docker-compose.yml#L335 https://github.com/hackerschoice/segfault/blob/main/docker-c...
- coderintherye 4y agoGiven how valuable 0-day container escape exploits are and how knowledgeable the people are who host this, it would seem to make sense economically to host this for free with the explicit hope that someone does in fact escape and pwn the box, assuming they can log enough to determine the method of exploit and be able to reproduce it.
- bigiain 4y agoParanoid me wonders if this is run by law enforcement, who’ve made the segfault.net owners/admins “an offer that can’t refuse”?
- pinebox 4y agoThat was my first thought. Shut down voluntarily in 2019 for no particular reason after 22 years? Mysteriously back and even better? Doesn't pass the smell test. The page talks a big game about hating criminals, but these days if you don't put up a cookie banner RoboCop will shoot you in the dick. And if someone really isn't a criminal we've got a fix for that, too: Just ship them to a country where they are! On the other hand maybe this post-HSA, post-Snowden world has made me jaded and the site really is just good clean fun.
- NoBreakfirst 4y agoI’m not sure to follow. I don’t see any TOS, at all. Anybody can seed whatever and run Tor exit node ? ( not that it would work well but still )
- mccorrinall 4y agoWhen there are no tos defined, the tos is usually an implicit: don’t abuse and don’t be an asshole
- water-your-self 4y agoCertainly this won't be abused
- deleted 4y ago[deleted]
- tony-allan 4y ago"The Server only exists while you are logged in."
- deleted 4y ago[deleted]
- tony-allan 4y agoThat's what their website says, however I had a play and created a file and logged in and out and the file persisted as did my ability to look at the /onion directory via Tor after the ssh session was stopped.
- kxrm 4y agoIt does shutdown when you log out, the only persisted data in on /sec and /everyone Your home directory is in /sec/root. If you install tools outside of /sec/usr they will be reset on your next visit. So if you want to install something that survives a session log out you need to install to /sec/usr
- userbinator 4y agoFrom the name I thought it would be something to do with DNS, since that's the first thing that comes to mind when I see the phrase "Root Servers".
- usr1106 4y agoA virtual root server is a cloud server giving you full access, root in Linux. As opposed to some web page hosting thing. I think has been mainstream for more than 10 years. DNS root servers just work, nobody talks about them. Well, unless there were a major incident some day.
- runlaszlorun 4y agoaren’t we talking about root servers here? or just me…
- deleted 4y ago[deleted]
- LinuxBender 4y agoI've always known this as "root shell" vs. "root servers". I too automatically think root DNS servers. I would love to control the root servers.
- cyanydeez 4y agoSounds like a public honeypot
- sally_glance 4y agoHere's hoping that this is deliberately obvious but also not deliberately irresponsible...
- deleted 4y ago[deleted]
- tony-allan 4y agoYou should always assume that for a service such as this and proceed accordingly.
- guessmyname 4y agoI got excited for a moment reading the title thinking it was referring to (disposable) DNS Root Servers, since that is the only context in which I have heard about “root servers” before.
- kiwijamo 4y agoThat was my thought too. I wondered why one would need disposable DNS Root Servers!
- khanhquole 4y agoYeah, that's what I thought too
- dspillett 4y agoI've seen the term used to mean dedicated servers or VMs, by European hosting companies. Possibly all German companies though that might not be a solid memory, but it does seem quite localised. I assume it is to differentiate between hosted servers where you have an account, multiple accounts, or a reseller account, but not full admin (root level) access. Always stuck me as a clunky term, but it was where my head went first on reading the title here (then I thought DNS servers, but that did not compute so the first thought "won").
- silisili 4y agoSame. I'm guessing they're German, that's the only other times I've seen the term 'root server' used this way.
- justsomehnguy 4y ago> Since 1995 we have had 3 of our members arrested (0 convicted), we have had visits by the BKA (Germany’s FBI) and BND (Germany’s NSA), we were blackmailed by the British GCHQ and harassed and intimidated by many others
- antonvs 4y agoI didn’t realize that was a German thing - anyone who’s done much renting of bare metal servers is likely to have encountered the term, but that seems to be because some of the biggest global providers of those services are German, like Hetzner and 1&1/Ionos.
- rexreed 4y agoWhat are the CPU bandwidth and storage limits?
- xyzzy123 4y agoSmart way to get plausible deniability for your own grey zone activities. As a third party, of course absolutely experiment but don't rely on there being no logs, lol.
- bigiain 4y agoThe weaselworded non answer to “is it safe” is obviously technically true. Even if they’ve disclosed all activity and logs and user ip addresses to law enforcement, which resulted in hundreds of people going to jail, they went to jail for what they did with this, not for “using it”… It’s a fun curiosity. But anyone relying on it to cover up illegal activity should be very very careful. If what you’re doing can improve a cop’s chance of promotion, you should assume they’ll take advantage of that. And for “lesser crimes”, you can bet that most things you want to do from there are already on blocklists. You’ll have as much chance of getting your spam runs out of there as you do from any cheap vps or tor exit…
- floatinglotus 4y agoI have a hard time understanding the target market for this. If you are so paranoid about your security and anonymity, why would you take promises made by a third party at face value? Why would you trust anyone or anything with an ounce of your identity?
- tgsovlerkhgsel 4y agoMost places require payment, which is hard to do anonymously. Here, you don't have to take many promises at face value. You do have to assume that everything you do on that server is monitored if you don't trust it, but you can connect to it via Tor and/or a VPN.
- surfsvammel 4y agoI might use this just for convenience if I need to test something away from my home network.
- nix23 4y agoExactly, if i want to test my pf firewall with "triggers" then this is one way, test my IDS etc, and with installed Kali everything is possible ;) just perfect! Big Thanks to the Creators!!
- seba_dos1 4y agoThis is a cute toy for hackers, not something that provides "security and anonymity".
- kxrm 4y agoAgreed, I am not sure I understand the "how can you expect this to be secure" argument. I paid nothing, and it's sometimes fun to have a thing to play with that someone created. I am not using this to proxy a hack into Bank of America, nor am I storing my 20 page manifesto. If you do such a thing through here, you deserve whatever happens to you.
- deleted 4y ago[deleted]
- cercatrova 4y agoYou could use Firecracker VMs instead right?
- IncRnd 4y agoFrom the article: Is it safe? Nobody ever got arrested for choosing segfault.net. Take a close look at how that question isn't answered. It's best not to do any work on these, where you need to trust the platform. You might even get blamed for people's actions on their box next to you. Not much remains outside of this being a honeypot or for criminals.
- tony-allan 4y agoOf course, with no further information you should not use it for real data production work but I'm fine with that limitation.
- IncRnd 4y agoThe other part is that you may be liable for how others use these boxes, just by your logging into one. It's not only whether you use one at work.
- MacsHeadroom 4y agoHow is anyone going to know you, specifically, briefly logged into an ephemeral VM over Tor?
- IncRnd 4y agoI'll treat that as an idle question on the technical aspects, not a question about how to evade law enforcement. There are people on this page talking about logging into other services from there, so I think you can see one very easy way. If you use a service that says they don't track anything, delete the machine upon logout, and so forth, who do you think will use that box?
- MacsHeadroom 4y agoI will; to perform port scanning and other reconnaissance, to scrape data, and more. Nothing connected to my identity in any way.
- sva_ 4y agoInteresting project. $ nmap -sn 10.11.0.0/24 Nmap done: 256 IP addresses (86 hosts up) scanned in 1.56 seconds $ uname -srv Linux 5.15.0-1011-aws #14-Ubuntu SMP Wed Jun 1 20:54:22 UTC 2022
- 1vuio0pswjnm7 4y agoAt first from the title I thought this was about DNS root servers. Oh well. It got me thinking.
- tony-allan 4y agoFor me, this is a great testing and experimenting server with a fresh environment every time I use it. I often want test or observe something i'm doing from outside my environment... lynx https://news.ycombinator.com curl https://jsonplaceholder.typicode.com/todos/1
- tgsovlerkhgsel 4y ago> Your server will self-destruct on log out (and all data & traces will get wiped). This does not seem to be entirely accurate (and it would also be very obnoxious, especially for use over Tor, if a dropped connection meant starting from scratch). The servers do allow reconnects, and data is preserved (presumably in encrypted form).
- bdcravens 4y agoconnection != session
- ghostly_s 4y agoIt does with ssh... maintaining a persistent session thru reconnect requires a wrapper utility like mosh.
- egberts1 4y agoOr tmux.
- sureglymop 4y agoPretty sure that mosh uses ssh initially and then the communication is over udp. Not sure if an ssh connection is even maintained then. Tmux I guess you would run locally and put in the background when you want to work on something else. But then your ssh connection could still drop or tmux could crash on your local machine.
- tony-allan 4y agoI had a play and created a file and logged in and out and the file persisted as did my ability to look at the /onion directory via Tor after the ssh session was stopped.
- tony-allan 4y agoThe next morning, after being logged out overnight, I ssh'ed into the server and it had been reset (and my saved files removed). Credentials still worked but a fresh instance.
- tony-allan 4y agoThe Hacker's Choice — Disposable Root Servers https://www.thc.org/segfault/ https://www.thc.org/segfault/ Deploy your own... https://github.com/hackerschoice/segfault https://github.com/hackerschoice/segfault
- Havoc 4y agoI hope it thrives. Not super optimistic given how even CI compute gets abused for crypto mining…but hopeful
- gz5 4y ago> Reverse Port Forwards (forget ngrok. This is free & better). i assume this means the 'disposable root server' can send [whatever] encrypted data over the ssh tunnel to my machine (and my network if the machine is not properly segmented)? if so, what should i do to protect it?
- deleted 4y ago[deleted]
- Tepix 4y agoYou can configure it (or not) the way you want it. It is not a security issue by itself.
- levkk 4y ago┌──(rootsf-BrushFocus)-[~] └─# finger No one logged on. Where is everyone?
- deleted 4y ago[deleted]
- lpgauth 4y agoPretty cool, useful if you need a SOCKS proxy to access blocked services. e.g. `ssh -v -D 30314 -q -C -N root@segfault.net`
- ctb_ 4y agoOwn your own root, run it on your own machine or hardware.
- joshxyz 4y agointeresting, anyone know if there's a docker image available of that os with preinstalled hacking stuffs?
- Veve 4y agoYes there is: https://github.com/hackerschoice/segfault https://github.com/hackerschoice/segfault
- tux 4y agoInteresting project thank you THC.
- derefr 4y ago> It shall be used for good purposes only. So, uh... how do you (the creator of the service) know that, without doing some sort of data tracking? For that matter, how do you know that someone's not grabbing 10,000 of these to run a botnet?
- javajosh 4y ago"Good purpose" is ambiguous. Even if you start with a "reasonableness standard" that is something like a "test particle" that is white, male, raised in Minnesota to vaguely Christian parents born in the 80's watched Sponge Bob squarepants, it's less ambiguous. It means respecting the law, including ones you don't agree with. Including the laws that you think it would be good to break. This server sits there as a perfect vehicle from which to break the law. It's like someone leaving a fleet of getaway cars and guns, with tips on which banks are loaded right now left on the drivers side seat, and delivering it to a poor neighborhood, where it is rational to accept higher risk for a higher reward. There may be some who use it out of intellectual curiosity, and who are careful not to run afoul of any laws. LEOs will be of this type, I assume. I'm curious to know what is in that 8GB of tools that is included in every shell, for example. So for me the appeal would be a "safe" place to play with tools that I may have concern about even installing myself and what lists that adds me too. So in that sense its quite a good thing, it is freeing from risk of state involvement if your experiment/exploration goes wrong. Presumably all serious hacking attempts originate from a remote process anyway, as only a very silly/young/foolish hacker would try certain tools from their actual home IP address and personal laptop. So one argument for this service is that it reduces the demand for (coerced) botnet nodes. If you squint your eyes it's a similar argument for providing clean needles and methodone to a community, no questions asked. No, it's ugly that people use, but it's even uglier that people use and reuse/share needles to avoid detection. So while I agree it's probably a honeypot, there is also a sound argument for it to exist, legitimately, as a public service - a hacker's hamsterdam.
- MichaelCollins 4y ago> with tips on which banks are loaded right now left on the drivers side seat I don't think they're going that far (it doesn't come with a list of profitable organizations to hack.)
- ComputerGuru 4y agoThis is already being severely abused; system load jumped to 9.xx an hour ago and has stayed there.
- ghostly_s 4y agoI don't see how it possibly could not be, seeing as they don't seem to have even made any effort to curtail it.
- hezag 4y agoAbout the creators: THC (The Hackers Choice) is a well known hacker group active since 1995. One of their most famous project is Hydra[0]. > "We research and publish tools and academic papers to expose fishy IT security that just isn’t secure. We also develop and publish tools to help the IT Security movement."[1] 0. https://en.wikipedia.org/wiki/Hydra_%28software%29 https://en.wikipedia.org/wiki/Hydra_%28software%29 1. https://www.thc.org/ https://www.thc.org/
- noduerme 4y agoNot to piss in the honeypot here, but is there any assurance this collective hasn't been co-opted in the last 25 years?
- MichaelCollins 4y agoHow could there possibly be assurance of that? People who get coerced and turned into being informants don't go around advertising it to everybody else. Absolutely not, no assurance whatsoever.
- efitz 4y agoHahaha “free h4x0r servers with no logs” hahaha That’s exactly a thing the FBI would say. They should name the service “honeypot.com”.
- antonvs 4y agoIf I’m doing something the FBI won’t care about, then it’s just a free resource. Woohoo
- dudeinjapan 4y ago"Well," said Pooh, "what I like best," and then he had to stop and think. Because although Eating Honey was a very good thing to do, there was a moment just before you began to eat it which was better than when you were, but he didn't know what it was called." - A. A. Milne
- chaz6 4y agoThis is a great development. Sadly there is no support for IPv6. Hopefully that will come soon.
- tomschwiha 4y agoCould you keep them permanently online if you circularly create another server, that logs back into the first server? Just wondering
- prmoustache 4y agoWhat does "root server" even means? The only context where I saw servers being mentionned as root is in the domain name system. These aren't.
- deleted 4y ago[deleted]
- MontyCarloHall 4y agoIt means you have root access.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- runlaszlorun 4y agoI’ve got a few beefy servers that are under fixed fee contracts and are underutilized at the moment. Anyone got an ideas on how I can support the cause?
- jedisct1 4y agoToo bad all the DNS traffic just goes to Cloudflare instead of using their own resolvers.
- gertruded 4y agoWas wondering what the limits are on this service - turns out they quite sensibly restrict the number of shells allowed per source IP address. This script shows it starts refusing new SSH sessions after a few connections back to itself: #!/usr/bin/expect set timeout -1 spawn torsocks ssh root@segfault.net while (true) { expect " password:" send "segfault\n" expect "\[~]" send "gsocket -s NzdlMWQxNGQM ssh root@segfault.net\n" expect "t\])? " send "yes\n" } Eventually starts showing this in response: [ERROR] --> You (172.22.0.21) have to many servers running --> Read https://www.thc.org/segfault/youcheapfuck --> Contact us on Telegram: https://t.me/thorg Connection to 127.31.33.7 closed. Also their Tor hidden service currently seems to be inaccessible. Perhaps there's a hard limit on the number of connections via that route, given that one can't restrict per any individual source due to the design of Tor.
- imhoguy 4y agoIf anyone worries it honeypot... well, you can self-host: https://github.com/hackerschoice/segfault https://github.com/hackerschoice/segfault
- ComputerGuru 4y agoThey've either been compromised or severely borked in an attempt to fight abuse. The entire? image is now read-only, or at least /tmp and the home directory both are. Their login script fails and errors out about read-only filesystems and you can't do anything useful with the machine without some extra hacking.
- aabbcc1241 4y agoI try to serve a static web server on it with npx, then try to access it from the IP I got from 'curl icanhazip.com' but it got timeout