3 ms·
No the author seems to indicate that it was on their application code and an attacker was able to get OS access, and the attacker subsequently replaced the ssh
by ihsw 14y ago
No the author seems to indicate that it was on their application code and an attacker was able to get OS access, and the attacker subsequently replaced the ssh service with one that instead ignores login attempts and harvests the username/password pairs.
It seems to have been a coincidence that their Jenkins service was not secured.
- indigo_daddy 14y agoWhat I got from the article is that they likely ssh brute-forced the Jenkins service user and then had passwordless sudo; however you wouldn't think that this user would have a shell assigned.