How exactly a hetzner dedicated server is compromised ?

DP

Blame the previous owner(s) of the IP address.

darthmaul0181

@serv_ee said:
...

I wonder which one of us does more drama
Take some pills and good night

DP

@darthmaul0181 said:

@serv_ee said:
...

I wonder which one of us does more drama
Good night

The community might know if you’ll just use your actual/real account.

cancaocuo

@INCIBE_CERT said: the domain(s) involved is provided at the very bottom of the email

Yeah it does mention the domain after the Spanish version. Though I have no idea who this domain belongs to.

@INCIBE_CERT said: polluted the domain resolution on purpose to annoy/distract security researchers.

Maybe. I don't even know the password generaged by Hetzner Cloud since I use ssh key to login. I really can't believe someone could guess it.

Also, from the email,

This is an information email only and does not require any further action on your part.
It is your choice whether or not to investigate the complaint.
We do not expect any response.

Ignoring this email should be safe as it's not an abuse alert.

yokowasis

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

cancaocuo

@yokowasis said:

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

I agree with you. The title "Abuse Message [AbuseID:xxx]: AbuseInfoMail: [INCIBE-CERT] Fast-Flux Report" does scary me. I thought there're something happened on my server and I will lose my Hetzner account before I read the email.

PHDan

@yokowasis said: then it shouldn't be sent from an abuse email department.

That's how Hetzner works. Don't like it? Leave.

@cancaocuo said: and I will lose my Hetzner account before I read the email.

It got you to read the email didn't it, Sparky?

yokowasis

@PHDan said:

@yokowasis said: then it shouldn't be sent from an abuse email department.

That's how Hetzner works. Don't like it? Leave.

I didn't know that's how hetzner works. Obviously I won't post this if I know that's how they works ( using abuse email to sent some notice )

TimboJones

@yokowasis said:

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

I'm not aware of a single company with a "Notice" or "Announcement" department.

And tracking of a specific communication? That's just basic common sense, or so I thought.

I'm not one to call out snowflakes, but SNOWFLAKES.

yokowasis

@TimboJones said:

@yokowasis said:

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

I'm not aware of a single company with a "Notice" or "Announcement" department.

And tracking of a specific communication? That's just basic common sense, or so I thought.

I'm not one to call out snowflakes, but SNOWFLAKES.

it's called donot-reply, host use it all the time to send announcement, notice, warning for maintenance, information, etc.

I am not aware any other company but hetzner using abuse email , with abuse id to send a Notice / Announcement.

Look, we can go on and on and on, about this.

Case : Hetzner use abuse email with abuse id, to send notice

Me : It's wrong
You : It's right

You entitled of your oppinion, so do I. Clearly I won't be able to change your oppinion about this, and I can assure you, you won't be able to change mine. We shouldn't continue this useless circle.

Personal attack just because other people have different oppinion, is not really my style.

Cheers, have a good day.

martinhuwa

@yokowasis said:

@TimboJones said:

@yokowasis said:

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

I'm not aware of a single company with a "Notice" or "Announcement" department.

And tracking of a specific communication? That's just basic common sense, or so I thought.

I'm not one to call out snowflakes, but SNOWFLAKES.

it's called donot-reply, host use it all the time to send announcement, notice, warning for maintenance, information, etc.

I am not aware any other company but hetzner using abuse email , with abuse id to send a Notice / Announcement.

Look, we can go on and on and on, about this.

Case : Hetzner use abuse email with abuse id, to send notice

Me : It's wrong
You : It's right

You entitled of your oppinion, so do I. Clearly I won't be able to change your oppinion about this, and I can assure you, you won't be able to change mine. We shouldn't continue this useless circle.

Personal attack just because other people have different oppinion, is not really my style.

Cheers, have a good day.

I think you think a bit too complicated.
It's quite easy. Security researchers and others use the official abuse@ email address as recipient or forms like https://abuse.hetzner.com/issues/new?lang=en - which does only forward the information to the customer as explained there. Hetzner can and will not (technically) check the things reported through the abuse form, especially when you have a root server where only you have access to it (regarding the passwords and so on).

As already said, nothing to worry about. The CERT used their abuse form or abuse email address, and Hetzner just forwarded it.

It would be totally different when there is an email through the abuse form from the authorities, police and so on which is a different topic. And: abuse cases are handled like this at many hosting providers. The customer / client then has to check and see if he has to react / do anything at all or not. So no worries. Our servers are still online and we ignored the false-positive emails from the spanish CERT which were definitely not relevant.

PHDan

@yokowasis said:
Me : It's wrong
You : It's right

Yoko: I'm right!
Everyone else (including Timbo): You're a moron.

Am I needlessly replying? Yep, it sends this topic to the top again and shows everyone you're a dipshit. And it drives more customers to Hetzner. So keep those replies coming, it's only helping them.

yokowasis

@PHDan said:

@yokowasis said:
Me : It's wrong
You : It's right

Yoko: I'm right!
Everyone else (including Timbo): You're a moron.

Am I needlessly replying? Yep, it sends this topic to the top again and shows everyone you're a dipshit. And it drives more customers to Hetzner. So keep those replies coming, it's only helping them.

Fine by me. I have nothing to lose, it's not like I want Hetzner to lose customer or anything. I am not even bashing them. Also, it's holiday. I have plenty of time on my hand.

And no, I am not and never personally attacking anyone by calling them moron.

@martinhuwa said:
As already said, nothing to worry about. The CERT used their abuse form or abuse email address, and Hetzner just forwarded it.

As I already said several posts ago, I already get it. I just personally don't like it. can't I even express my oppinion now ?

TimboJones

@yokowasis said:

@TimboJones said:

@yokowasis said:

@cancaocuo said:
Ignoring this email should be safe as it's not an abuse alert.

then it shouldn't be sent from an abuse email department. It's more like mandatory announcement "oi, don't forget to update, and secure your server, change your password regularly". This kind of announcement shouldn't be sent from abuse department email address, let alone have a unique abuse #ID.

I'm not aware of a single company with a "Notice" or "Announcement" department.

And tracking of a specific communication? That's just basic common sense, or so I thought.

I'm not one to call out snowflakes, but SNOWFLAKES.

it's called donot-reply, host use it all the time to send announcement, notice, warning for maintenance, information, etc.

But you still need to identify the department sending the email. You can't just send out emails from "donotreply@" without a name (ie, "Sales", "Support"). That's just poor etiquette to send a communique without clearly saying who sent it and whom to contact if you need to respond.

I am not aware any other company but hetzner using abuse email , with abuse id to send a Notice / Announcement.

Oh, to me, that's common. Both my local ISP's do this.

Look, we can go on and on and on, about this.

Case : Hetzner use abuse email with abuse id, to send notice

Me : It's wrong
You : It's right

You entitled of your oppinion, so do I. Clearly I won't be able to change your oppinion about this, and I can assure you, you won't be able to change mine. We shouldn't continue this useless circle.

Probably, because feelings from a "From" address shouldn't be more important than the actual content. It's clear you didn't read the email and fully understand it, so making the "From" address any less important sounding isn't going to help. Better reading comprehension would, though.

yokowasis

@TimboJones said:
Oh, to me, that's common. Both my local ISP's do this.

That's where we differ. Never got any email from ISP.

Probably, because feelings from a "From" address shouldn't be more important than the actual content. It's clear you didn't read the email and fully understand it, so making the "From" address any less important sounding isn't going to help. Better reading comprehension would, though.

I don't read every email come to my inbox. When the notification come to my phone, it shows From Abuse, Subject #Abuse ID. Surely I though this was an important email. But the reality is, it's far from important. I don't even need to do anything, and as other suggested, I should just ignore it all together.

serv_ee

What kind of an ISP sends out abuse letters tho? Never had one in 20 years that I've had my own contracts

TimboJones

@yokowasis said:

@TimboJones said:
Oh, to me, that's common. Both my local ISP's do this.

That's where we differ. Never got any email from ISP.

Probably, because feelings from a "From" address shouldn't be more important than the actual content. It's clear you didn't read the email and fully understand it, so making the "From" address any less important sounding isn't going to help. Better reading comprehension would, though.

I don't read every email come to my inbox. When the notification come to my phone, it shows From Abuse, Subject #Abuse ID. Surely I though this was an important email. But the reality is, it's far from important.** I don't even need to do anything, and as other suggested,** I should just ignore it all together.

flips table

I give up. Complaint is that user upset he had to read an email that he could have otherwise ignored.

The rest of us would have read the email, saw the dates, and then promptly went about our lives, having spent all of 10 seconds of our lives that we'll never get back and not dwell on.

yokowasis

@TimboJones said:

@yokowasis said:

@TimboJones said:
Oh, to me, that's common. Both my local ISP's do this.

That's where we differ. Never got any email from ISP.

Probably, because feelings from a "From" address shouldn't be more important than the actual content. It's clear you didn't read the email and fully understand it, so making the "From" address any less important sounding isn't going to help. Better reading comprehension would, though.

I don't read every email come to my inbox. When the notification come to my phone, it shows From Abuse, Subject #Abuse ID. Surely I though this was an important email. But the reality is, it's far from important.** I don't even need to do anything, and as other suggested,** I should just ignore it all together.

flips table

I give up. Complaint is that user upset he had to read an email that he could have otherwise ignored.

The rest of us would have read the email, saw the dates, and then promptly went about our lives, having spent all of 10 seconds of our lives that we'll never get back and not dwell on.

I dont know that it can be safely ignored. I know it because I open this thread. I never ignore any abuse email. Because like I said in previous page, ignoring abuse email is never a good idea. Now I know, hetzner is sending an abuse email you can safely ignore.

There are a lot of promotion and information comes to my mail. Just by reading the subject and the sender, I can safely ignore most of them, or at the very least, deal with it later. But not abuse email, that kind of email is you have to deal immediately.

Hetzner_OL

@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

SteveMC

That's nothing,... once I received a genuine email from an US army office, because one of their guy had visit my site, and their security system blocked my page because they "detected the signature of a virus/malware". I crapped my panties 1- because of receiving such email, and 2- for having my site/server compromised without knowing.

Finally, this was a false-positive, a randomly generated string on the page, happened to contain a sequence of characters matching this virus/malware signature. I exchanged several mails with them, and I have to say they were cool

TimboJones

@Hetzner_OL said:

@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail.

Lol, in that case, no good admins on LET.

Katie, you know you're like one of two actual females on LET, right?

yokowasis

@Hetzner_OL said:
@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

Thanks. Next time I receive email from abuse, I will make sure to reply on it. I just don't like to bother people at work.

I prefer asking and bothering let members. Because if they answer, it means they have nothing more important to do at the moment. It's not like this is an urgent / critical issue or anything.

TimboJones

@yokowasis said:

@Hetzner_OL said:
@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

Thanks. Next time I receive email from abuse, I will make sure to reply on it. I just don't like to bother people at work.

I prefer asking and bothering let members. Because if they answer, it means they have nothing more important to do at the moment. It's not like this is an urgent / critical issue or anything.

Why? With what? That makes no sense, no response was requested. And you'd most definitely be bothering someone at work.

serv_ee

@yokowasis said:

@Hetzner_OL said:
@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

Thanks. Next time I receive email from abuse, I will make sure to reply on it. I just don't like to bother people at work.

I prefer asking and bothering let members. Because if they answer, it means they have nothing more important to do at the moment. It's not like this is an urgent / critical issue or anything.

Did you really just not understand what they said?

If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully

yokowasis

@TimboJones said:

@yokowasis said:

@Hetzner_OL said:
@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

Thanks. Next time I receive email from abuse, I will make sure to reply on it. I just don't like to bother people at work.

I prefer asking and bothering let members. Because if they answer, it means they have nothing more important to do at the moment. It's not like this is an urgent / critical issue or anything.

Why? With what? That makes no sense, no response was requested. And you'd most definitely be bothering someone at work.

Why? Because Katie said I should write to [email protected]. Yes I definitely would be bothering them, that's why I choose I don't, but when hetzner rep said I should, I shall do it.

@serv_ee said:

@yokowasis said:

@Hetzner_OL said:
@yokowasis -- As other people have already written in this thread, our abuse team often forwards mails from government security agencies, respected security researchers, etc. A good admin will look at the details in the email that affect her server, check that everything is in order, and then delete the mail. If something is not in order, then they will fix the issue and report it to any of their own customers, etc.
Our abuse team reviews these mails before sending them out. In fact, part of my job here includes translating them into English. Many people who receive them are not affected. But if even just a few out of 100 people are affected, then it makes sense to send it out. It's a precaution.
Our Abuse department sends out these messages because they are the department best suited for it. We don't ask them to send out these messages to be scary or threatening.
If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully. If you're still unsure, just write to [email protected]. Copy the mail and ask for more information or help. Or, if you want to ask people here, maybe you could word it a little more neutrally, like, "I got this mail below from Hetzner, and I am not sure how to react to it. Thanks for any help you can give me! ." --Katie

Thanks. Next time I receive email from abuse, I will make sure to reply on it. I just don't like to bother people at work.

I prefer asking and bothering let members. Because if they answer, it means they have nothing more important to do at the moment. It's not like this is an urgent / critical issue or anything.

Did you really just not understand what they said?

If you ever receive a mail from our abuse team, and you don't understand it, read it again carefully

Yeah I read it. But hetzner rep said, I should write to [email protected] if I have something that I don't understand. That's what I will do on the future. Not really my style, but that's what they suggest, so yeah. Fine by me.

PHDan

@TimboJones said: Why? With what? That makes no sense, no response was requested. And you'd most definitely be bothering someone at work.

He's a shittier version of Deank, attempting troll status.

yokowasis

@PHDan said:

@TimboJones said: Why? With what? That makes no sense, no response was requested. And you'd most definitely be bothering someone at work.

He's a shittier version of Deank, attempting troll status.

Nah. Troll doesn't deserve me.