Dartnode Unauthorized SSH Access

Crunchy7761

Hello, so I have a few vpses idling in dartnode, and I noticed there have been logins via ssh with password from people that are not me... Since most of these are idle I didn't bother changing the default password, which seems to be how they are logging in, maybe dartnode was hacked or something? Not sure.

Here is the command to check if anyone wants to check their vps: journalctl -u sshd --no-pager | grep 'Accepted ' or journalctl -u ssh --no-pager | grep 'Accepted '

I had connections on all of my vpses from the following ips: 185.121.108.3 104.28.237.21 104.28.205.19 103.29.127.12 108.165.120.4 108.165.12.55

NotFoundException

@Crunchy7761 said: I didn't bother changing the default password

nghialele

@Crunchy7761 said: I didn't bother changing the default password

emperor

BOSTON is LIVE yeeeeeeeey
EDIT you should harden a bit your ssh
EDIT2 if they are hacked it would not be from ssh..

wadhah

The provider does not need your ssh password to login to your vps, they can do it without alerting you at all.

Not sure about this though, seems weird but @DartNode should be pinged to respond

Crunchy7761

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

NotFoundException

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

emperor

@NotFoundException said:

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

If he use same default password everywhere, that is more likely
EDIT : We see everyday breaches, so everything can be.. Only @DartNode can know for sure..

Crunchy7761

@emperor said:

@NotFoundException said:

@Crunchy7761 said:

@emperor said:
EDIT2 if they are hacked it would not be from ssh..

I mean the panel specifically, the only way these ssh logins could have been done that I can think of is either the panel was hacked, or someone from support is connecting to them?

or your account has been hacked

If he use same default password everywhere, that is more likely

I use password manager with randomly generated password

bugabuga

Maybe you downloaded something with a keylogger? scan your PC

globalRegisters

Yes, I'm sure I your provider got hacked and not you.

Crunchy7761

@bugabuga said:
Maybe you downloaded something with a keylogger? scan your PC

the fact that 2 of the ips that connected to my vpses are from dartnode themselves, and I checked all my dartnode vpses and they dont have that ip, would be quite unlikely a keylogger would be run by someone who also has a dartnode vps.
Also I'm sure if I had installed a keylogger I would have noticed by now. And none of my other vpses have this, only the ones from dartnode.

barbaros

Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

zed

@Crunchy7761 said: 2 of the ips that connected to my vpses are from dartnode themselves

@barbaros said: Just cleaned XMR miner from my Dartnode idler

gets more interesting.

tux

@barbaros, maybe it is hacked someway.

emperor

@barbaros said:
Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

Thats bad.. sharing location of the miner in the vm would be great help so ppl can clean them faster. I doubt you are the only ones..

barbaros

@emperor said:

@barbaros said:
Just cleaned XMR miner from my Dartnode idler, considering default password is 16 characters, it should be kinda hard to guess it.

Edit: Also last logged in IP is the same one as @Crunchy7761 had. CF warp IP

Thats bad.. sharing location of the miner in the vm would be great help so ppl can clean them faster. I doubt you are the only ones..

TBH, I was just lazy, gave the output of

ps aux --sort=-%cpu | head

and it said

Yes, this is almost certainly a compromise: PID 3552784 is a fake systemd-journald running from /usr/local/lib/.system-update/ (a hidden directory) with a config.json, which is the classic layout of a crypto miner like XMRig. The real journald lives at /lib/systemd/systemd-journald, and this one has burned about 347 minutes of CPU since Oct 14; the kswapd0 at 407 minutes is also worth checking, though it may just be genuine memory pressure.

To confirm, cat /usr/local/lib/.system-update/config.json will show a mining pool address and wallet, and ss -tupn | grep 3552784 will show its connection. Before anything else, copy that directory somewhere safe for evidence and run ls -l /proc/3552784/exe.

And config.json had the miner details, so I just reinstalled server.

The issue is Dartnode's default Debian 12 (no newer version) shows 300+ apt update, so that install image is quite old.

zed

maybe they'll have time to address concerns during the next big twitch sale extravaganza

Fubuki

@Crunchy7761 said: I didn't bother changing the default password

OP... that's your fault...

Neoon

big oof, as a baseline, I can recommend, an extremely aggressive, fail2ban config.
If whatever hits your ssh port and fails to auth, gets send to the middle east.

Put that into /etc/fail2ban/jail.local

[recidive]
enabled = true
bantime = 604800      # 1 week
findtime = 86400      # 1 day
maxretry = 3

[sshd]
enabled = true
port    = ssh
filter  = sshd
maxretry = 1
findtime = 600
bantime  = 86400
banaction = %(banaction_allports)s
# Overrides default failregex to catch your exact log patterns
failregex = ^.*Invalid user \S+ from <HOST>.*$
            ^.*Failed publickey for \S+ from <HOST>.*$
            ^.*Connection closed by authenticating user \S+ <HOST> port \d+ \[preauth\].*$
            ^.*Disconnected from authenticating user \S+ <HOST> port \d+ \[preauth\].*$

TimboJones

I find it a bit of a relief when it's just a miner and not spam or ransomware related.

ShadowLurker

@emperor said:

BOSTON is LIVE yeeeeeeeey

when, where, no emails/services on my profile

emperor

@ShadowLurker said:

@emperor said:

BOSTON is LIVE yeeeeeeeey

when, where, no emails/services on my profile

I just got my email 2h ago