The feeling of getting your home server hacked

[slaeshjag]

The new guy got into www-data, I only run nginx as that user. He installed all his nasty scripts in /tmp and among them is what looks like a collection of exploits to gain root, I shall investigae them when order is restored...


I never permit root-login from SSH, and I generally never leaves a root terminal up unused (I have been using one in a tmux because I was too lazy to give me permissions to look at logs), but that will change now.


The nginx version was silly old, something like 0.6.29, but since debian didn't offer any upgrades (and debian are usually pretty darn fast to fix security issues), I though I was only missing out on features. That has now changed.


I can instantly say that this was prolly no one I know, not even the first one. I'm pretty sure none of my friends who knows about netcat runs it with the short "nc"


And the latest... We'll see if I get a call from my ISP soon ;_;

 

[doublebeta]

I use passwords. Because I don't trust myself noit to lose, like, my laptop or something, and then let whoever finds it have a shell. BUt I'm just super paranoid.
My sudo-group pass is about as long as a key anyway .

The problem with this are MITM-attacks. You will never know if someone is grabbing your PW. At least with ssh-keys any PW-prompt means there is a MITM going on.

Hmm? As long as noone has my private key, yes, PRIVATE key, I'm fine...wasn't slaeshjag's box logged into via publickey?


With ssh-keys, any PW-prompt means there is some idiot trying to bruteforce sshd. Unless I'm missing something?


I think you don't mean MITM, I think you mean phishing or something. MITM = Man In The Middle, i.e. sniffed connection. I suppose if someone jacked your IP and poses as a SSH server, instead of just routing packets through while dumping - heeey...I see now.


If you get a message saying that the keys are untrusted or whatever it is, when a) The IP hasn't changed and B) You haven't reinstalled...pay the server a local visit...


And I know when someone's got my PW when there's logins from Russia . No offence to Russians, you're not all evil. That's a bad stereotype.


slaeshjag, you should copy those scripts out . Use them (just kidding!) or report them so they are fixed.


Check if they are skiddy scripts or originals. If they're skiddy scripts, don't worry too much, your attacker doesn't know much. Change your keys and pws, update nginx, REINSTALL, and you're fine.


So if I have it correct...you were hacked twice?


0.6?? Jeezus...I was running 0.7.something (hard disk head crash last night. I knew it was gonna happen, i have backups).


Click.


Click.


Click.


EDIT: Btw, I almost forgot: Good luck! And I hope the feds are understanding if they get involved...


It's so unfair that you have to put up with your ISP because some jackass wants to brute force some server. To the unknown jackass: Your princess is in another castle (LOL that was NOT supposed to be a racist Italian joke).

 

[PowerGod]

while searching about tmux I found out this interesting topic

Any news after some years ?

 

[slaeshjag]

I've made sure to keep nginx up to date and I haven't noticed any intruders since  

 

[PowerGod]

cool

 

[TrashyMG]

Had to check my auth logs... looks like I've had no attempts on my systems. I even have a proper domain name forwarded to my home server, but I don't use standard SSH or VNC port numbers to avoid most direct attacks.

 

[slaeshjag]

In my case, the intruder used a vuln in nginx, probably a buffer overflow or something to that effect, to inject a key into my ~/.ssh/authorized_keys. And yes, the version of nginx in debian was never updated in that release. In fact, I think even the current debian stable has a vulnerable version of nginx in repo. 

 

[benoitb]

So adding password authentication would have saved you in this case ?

 

[skeezix]

After someone has been in, on a home server..

Slash and Burn.

Rebuild from known clean backup, or a known clean fresh start (backups could have been violated in the past.) Worst case is someone does a crack, and then doesn't use it for a year, and then styarts using it; restoring to backups 6mo back do you no good. Also, if a guy is in for 1 minute, and installed a rootkit (hiding everything). and what was that 'sercret server' business? etc?

Now, all that is an ancient threaad but point stands.. if you get violated, rebuild; your data files are the goods, and not likely dangerous. There have been MSWord doc exploits and such in the past, even modifying jpegs to be nasty etc, but thats all low risk; your audio, video, family photos, taxes etc are all good; all the excutables, scripts, system files.. burn, rebuild; get your stuff under control hardcore, and no more worries.

It hurts peoples brains, but I always say .. first thing I'd do as an invaders is modify the code trhat reads the filesystems in use, so whenever you go looking for modifications you'd never find them; it'd self hide. How do you fix that case? Slash and burn baby.

(some people go so far as to verify or reflash their various firmwares too.. it is rare but known to occur that malware will try to infect your BIOS etc, and self-reinstall; but that shoudl be pretty hard to do on most motherboards

jeff

 

[slaeshjag]

In my case, it was a romaian script kiddie who DDOS'd italian telecom server, so I think the reinstall I did with changed password was enough

 

[dummi]

Hey, i run a little home server too. I used the tips from this guide lately http://pastebin.com/raw.php?i=cRYvK4jb

With the mentioned tools and tricks it is possible to check the own home server for holes. I found some things in the configuration of my webserver.

 

[kasp]

My Synology Nas I had on got hacked.  However that was because of a problem with Synology software.

The funny thing was because of the shit poor job on my scripts the hackers couldn't run their own which is why I didn't notice for ages.  Apparently they set peoples NAS's to mine dogecoins.  The only reason I noticed because I was wondering why my Sickbeard script wasn't working anymore and when I logged in they changed all the symbolic links of most of the commands.  

Dunno why they did that, if someone knows enough to be sshing into their nas box and making changes from there I am pretty sure they would notice something was up when you remove pretty much any command of use, even top.  In fact if they hadn't done that I probably would have just fixed my script and been done with it  I am pretty lazy when it comes to my home gear.