3 ms·

To get better idea - I had my webserver hacked solely for a purpose to get on VPN and hack my desktop and laptop one night and all wallet files copied. Person(

by hippich 14y ago

To get better idea - I had my webserver hacked solely for a purpose to get on VPN and hack my desktop and laptop one night and all wallet files copied. Person(s), who did it 1) were definitely very good at it, since they got root permissions on all machines (all 3 running different versions of Ubuntu) and 2) believe in it to the point where they think withdrawing it at this point in time not required - coins still did not move after hack event. For me it sounds like very professional people interested in it and they believe bitcoin will be stable enough to keep coins where they are right now for a long time.

kylebrown 14y ago
Curious to know how they knew to target your webserver. Was it hosting a bitcoin service, or running bitcoind and connected to the network?
- hippich 14y ago
  I hosted few bitcoin-related services, so I was obvious target. Although after year-old hack I never kept significant amount of coins on the server anymore. But this time attack was much more sophisticated.
lsc 14y ago
really? tell us more about what happened. how did they get from the webserver to your laptop? (e.g. what was listening on your laptop?) I find these sorts of attacks very interesting (and very frightening) because if a sysadmin's desktop is compromised, without the sysadmin noticing, the attacker has access, essentially, to everything the sysadmin accesses with that desktop. The best you can do, as far as I can tell, is to use some sort of 'the private key never leaves the smart card' system, and to run some sort of tripwire-esque intrusion detection system; the latter is key, because even with a theoretically perfect smartcard, if the attacker owns my ssh client binary when I authenticate to the server... it's over.
- hippich 14y ago
  i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver, 'cos (s)he removed all system log files. Then (s)he was able somehow to hack into my laptop and desktop connected to this webserver via VPN. My local machines were running regular dev stuff: apache, nginx, mysql, etc, but nothing with obvious vulnerabilities. And on top of it - (s)he removed log files, which could be done only by having root access to both machines. Nothing in authlog (i restored it), nothing in wtmp.. I made byte copy for later research, but at this point in time - no clue how this could happened. While I can suspect hosting staff doing this on server - it really boggles my mind how it could be done on two home remote machines, both running different Ubuntu versions. ps: bizarre part was - once i realized it happened, I started doing research on webserver and (s)he started kicking me out and banning IP address in firewall! the only way to finally get to the machine was to reboot it in single mode (my hosting provider allows to reboot it in single mode and start ssh for root account with random password)

by hippich 14y ago

kylebrown 14y ago

Curious to know how they knew to target your webserver. Was it hosting a bitcoin service, or running bitcoind and connected to the network?

hippich 14y ago
I hosted few bitcoin-related services, so I was obvious target. Although after year-old hack I never kept significant amount of coins on the server anymore. But this time attack was much more sophisticated.

lsc 14y ago

really? tell us more about what happened. how did they get from the webserver to your laptop? (e.g. what was listening on your laptop?) I find these sorts of attacks very interesting (and very frightening) because if a sysadmin's desktop is compromised, without the sysadmin noticing, the attacker has access, essentially, to everything the sysadmin accesses with that desktop. The best you can do, as far as I can tell, is to use some sort of 'the private key never leaves the smart card' system, and to run some sort of tripwire-esque intrusion detection system; the latter is key, because even with a theoretically perfect smartcard, if the attacker owns my ssh client binary when I authenticate to the server... it's over.

hippich 14y ago
i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver, 'cos (s)he removed all system log files. Then (s)he was able somehow to hack into my laptop and desktop connected to this webserver via VPN. My local machines were running regular dev stuff: apache, nginx, mysql, etc, but nothing with obvious vulnerabilities. And on top of it - (s)he removed log files, which could be done only by having root access to both machines. Nothing in authlog (i restored it), nothing in wtmp.. I made byte copy for later research, but at this point in time - no clue how this could happened. While I can suspect hosting staff doing this on server - it really boggles my mind how it could be done on two home remote machines, both running different Ubuntu versions. ps: bizarre part was - once i realized it happened, I started doing research on webserver and (s)he started kicking me out and banning IP address in firewall! the only way to finally get to the machine was to reboot it in single mode (my hosting provider allows to reboot it in single mode and start ssh for root account with random password)