Dartnode Unauthorized SSH Access

barbaros · October 19

@JohnnySac said:
I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:
Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19
I don't see any crypto miners running but someone was def was messing around with it.

Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald

Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

keoir · October 19

If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

Crunchy7761 · October 19

@barbaros said:
@JohnnySac said:
I see a similar thing. On DartNode VPS's that I installed from ISO myself are fine, but the ones I did not get around to setting up yet (still using their Ubuntu 24.04 template) have had their .ssh/authorized_keys files cleared so I couldn't log in with my SSH key. And .bash_history is symlinked to /dev/null. Like OP I see the last person logged in is:
Last login: Sun Sep 27 13:17:32 2026 from 104.28.237.19
I don't see any crypto miners running but someone was def was messing around with it.

Edit: After restarting it I see the miner running named as /usr/local/lib/.system-update/systemd-journald
Don't forget to cat /usr/local/lib/.system-update/config.json to see wallet address. Probably same dude.

{
    "autosave": false,
    "donate-level": 1,
    "cpu": {
        "enabled": true,
        "huge-pages": true,
        "huge-pages-jit": true,
        "hw-aes": null,
        "priority": 2,
        "memory-pool": true,
        "max-threads-hint": 70,
        "asm": true,
        "yield": false
    },
    "randomx": {
        "init": -1,
        "init-avx2": -1,
        "mode": "fast",
        "1gb-pages": false,
        "rdmsr": true,
        "wrmsr": true,
        "cache_qos": false,
        "numa": true,
        "scratchpad_prefetch_mode": 1
    },
    "pools": [
        {
            "url": "pool.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        },
        {
            "url": "de.supportxmr.com:443",
            "user": "466U7FGEbSh89VHcQu7UiLPBSDkHiJpMkDt3rc3PavHdUzBXs8uwhZFXhNfY6bAU9n4W6YNFegU1ubA6hZqpSnZL1df5yCW",
            "pass": "node-[REDACTED]",
            "keepalive": true,
            "tls": true,
            "algo": "rx/0"
        }
    ],
    "log-file": null,
    "print-time": 0,
    "health-print-time": 0,
    "retries": 5,
    "retry-pause": 3,
    "syslog": false,
    "verbose": 0
}

barbaros · October 19

@keoir said:
If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

Please consider adding Debian 13 image, and auto run apt update after installation. Default installation comes with too many outdated packages.

Also the wallet shows the ips miners running on, perhaps get in contact with those server owners or just suspend their servers as the miner is abusing your resources.

@Crunchy7761 said:

yeah it's the same wallet.

Crunchy7761 · October 20

@Neoon said:

@Crunchy7761 said:

@Neoon said:

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

every single one of my vpses has access from unknown ips, and barbaros also had it so not sure what other explanation there could be

brother in christ, every single vps, gets fucked by bots, every single day, bruh.

the password is 16 characters with 62 variants per letter, its quite impossible for the same person to have guessed all my vps passwords, and 2 other peoples as well. And since the login method says ssh with password, we can rule out any other exploit as well, since the root password hasn't been changed and its not possible to get the root password once its been set.

@keoir said:
If you believe your VM has been accessed and you have any other information related to the unauthorized access open a support ticket so we can take a look

Right now we don't have any indication of a security breach, but always happy to look and try to correlate anything we're getting reports on.

Of course, always reset the default password and use ssh keys instead. The default password should just be used for initial access to the system.

And yes we're working on a install with ssh public keys

As said above, currently there are 3 people which have reported the same issue... The only remaining way that I can see they could have obtained the password is if the panel was hacked or a rogue support agent.

nghialele · October 20

@barbaros said: The issue is Dartnode's default Debian 12 (no newer version) shows 300+ apt update, so that install image is quite old.

They told me in ticket that Debian 13 is too early in development for them to deploy in their fleet. Crazy work.

JohnFilch123 · October 20

had the same miner recently, on around 50 servers, so not just dartnode

bugabuga · October 20

Honestly, if you guys are on windows doesn't hurt to just do a quick scan with Malwarebytes! had this happened years back, even AVG AV didn't catch it but MWB did.. Was Zeus keylogger.. I dunno if MWB is still good nowday's but was great back in the day

pdalancer · October 20

I also have two other DartNode VPS instances without changing default password. One is running Ubuntu with an uptime monitor and the other Debian just idle without any applications installed yet. I checked their SSH logs and found successful root logins from the same IP addresses on both VPS instances.

VPS 1:

Oct 15 19:36:21 Accepted password for root from 104.28.205.21
Oct 19 07:17:55 Accepted password for root from 104.28.237.21

VPS 2:

Oct 14 13:46:30 Accepted password for root from 104.28.237.21
Oct 15 18:56:36 Accepted password for root from 104.28.205.21

both are infected with monero miner:

/usr/local/lib/.system-update/systemd-journald \
--config=/usr/local/lib/.system-update/config.json

Edited:
And also infected with traffmonetizer cli:
/usr/local/bin/cli start accept --token xxxxxxxxx

jaden · October 20

With several different users getting infected, this sure seems like a Dartnode compromise.

yoshiki · October 20

1) Apparently it's not common to disable root login, change passwords / SSH ports and enable key logins as a first thing?
2) DartNode sure is carefree about 4 different users getting their servers accessed maliciously. Even if they're using the default password, why are you not offering ssh key installation in your control panel?

Nekopara · October 20

Just checked my dartnode vps and everything is fine. I upgraded this one manually to deb13 some time ago and moved ssh behind ufw whitelist

JoshR · October 20

I just checked last in my VPS and its nothing but my IPs.
Checking journalctl -u ssh -n 25 looks like quite a few bots poking at port 22 as usual.

Makes me wonder.

@Crunchy7761 were you part of that mass reinstall?
I wonder if their template was compromised....

Crunchy7761 · October 20

@JoshR said:
I just checked last in my VPS and its nothing but my IPs.
Checking journalctl -u ssh -n 25 looks like quite a few bots poking at port 22 as usual.

Makes me wonder.

@Crunchy7761 were you part of that mass reinstall?
I wonder if their template was compromised....

What mass reinstall? I did notice one of my ryzen vpses was reinstalled on october 15, but all other ones were still the same install from when I got them (dartday), mostly debian 12 / debian 13 however one was the default alma linux, and that was also compromised.
Also, did you change your password for your vps? I think the ssh logins started around september iirc so if you changed password before then you were probably safe. Also you can do the command in my original post to list all accepted ssh connections

JoshR · October 20

I did change my password shortly after provision.
They had a node that had a drive failing and basically if didn't have a backup was sol.
Maybe you wernt on that node.

Mainfrezzer · October 20

i wonder if this correlates to @forest vm rollback. hmmm

JoshR · October 20

@Mainfrezzer said:
i wonder if this correlates to @forest vm rollback. hmmm

What I'm talking about maybe. but still makes me wonder...
@forest have you seen anything strange?

xvps · October 20

xvps · October 20

@Neoon said:

@OpaqueRegistrant said:
Direct node access won't show this signature of someone who logged in with the correct password. They probably wouldn't even do it with SSH.

I doubt that dartnode got breached.
If they got breached, we shall see, the next 24h will tell.

It might as well be a third part that has been hacked. For example a shared hosting backup provider that don't use real isolation and where security only rely on permissions. One small mistake or a panel vulnerability and everyone has access to everything.

From what I have seen, 50% of the users don't encrypt their backups or store their encryption key together with the backup.

JohnFilch123 · October 20

@xvps said: It might as well be a third part that has been hacked

Was also thinking this but in my case it was pubkey auth, password disabled, so potentially my privkey was leaked. I suspect how but this is just a guess. I am not going to give more details just because those guys read this forum.

Hayzee · October 20

I wasn't a donkey and changed my pw/secured my ssh n i seem to be in the clear hopefully that doesnt change lmao

LEBUserJoe · October 20

Can the 3 affected users, share the first portion of the default password here or with each other?

Datnode compromised, or that password is literally default, or that image has a very basic and easy to exploit 0-day that's quite public as this miner, and traffic cli is some very basic ah shi for such exploit.

zed · October 20

@LEBUserJoe said: or that password is literally default

oh man that would be incredible

Carlin0 · October 20

Disable password login

barbaros · October 20

@LEBUserJoe said:
Can the 3 affected users, share the first portion of the default password here or with each other?

Datnode compromised, or that password is literally default, or that image has a very basic and easy to exploit 0-day that's quite public as this miner, and traffic cli is some very basic ah shi for such exploit.

I used Debian 12 image and right after installation it shows 300 packages needing update with apt.

gbcbooks · October 20

{
"ip": "104.28.237.19",
"city": "Lviv",
"region": "Lviv",
"country": "UA",
"loc": "49.8383,24.0232",
"org": "AS13335 Cloudflare, Inc.",
"postal": "79000",
"timezone": "Europe/Kyiv",
"readme": "https://ipinfo.io/missingauth"
}

do you release this IP is from Cloudflare.

barbaros · October 20

@gbcbooks said:
{
"ip": "104.28.237.19",
"city": "Lviv",
"region": "Lviv",
"country": "UA",
"loc": "49.8383,24.0232",
"org": "AS13335 Cloudflare, Inc.",
"postal": "79000",
"timezone": "Europe/Kyiv",
"readme": "https://ipinfo.io/missingauth"
}

do you release this IP is from Cloudflare.

yeah it's cloudflare warp ip

gbcbooks · October 20

@barbaros said:

@gbcbooks said:
{
"ip": "104.28.237.19",
"city": "Lviv",
"region": "Lviv",
"country": "UA",
"loc": "49.8383,24.0232",
"org": "AS13335 Cloudflare, Inc.",
"postal": "79000",
"timezone": "Europe/Kyiv",
"readme": "https://ipinfo.io/missingauth"
}

do you release this IP is from Cloudflare.

yeah it's cloudflare warp ip

You can't deny possibility for hacker to crack your ssh password, use public key instead, raise your account secure level. enhance hacker's cost of cracking.

LEBUserJoe · October 20

@gbcbooks said:

@barbaros said:

@gbcbooks said:
{
"ip": "104.28.237.19",
"city": "Lviv",
"region": "Lviv",
"country": "UA",
"loc": "49.8383,24.0232",
"org": "AS13335 Cloudflare, Inc.",
"postal": "79000",
"timezone": "Europe/Kyiv",
"readme": "https://ipinfo.io/missingauth"
}

do you release this IP is from Cloudflare.

yeah it's cloudflare warp ip

You can't deny possibility for hacker to crack your ssh password, use public key instead, raise your account secure level. enhance hacker's cost of cracking.

You absolutely can. Cracking a random 16-key password even without additional symbols can not be done on a mass scale, and certainly not profitable for an XMR miner.

In this case dartnode claims it's randomised with symbols, that's not crackable in the way you make it sound. the IP is a CF warp IP e.g cloudflare free VPN & DNS routing at http://1.1.1.1

You can use warp as an exit to anything, including an existing connection.

JabJab · October 20

plot twist: everyone has the same randomized 16-key password.
It was randomized, once, per deploy.

Howdy, Stranger!

Categories

In this Discussion

Dartnode Unauthorized SSH Access

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

Dartnode Unauthorized SSH Access

Comments