New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
nope, all my vpses have different passwords
it had happened in all of my vpses, including the stock debian 12 dartnode install, the stock debian 12 upgraded to 13 when i bought it, and alma linux
My servers are still offline. Last message I got from them in a ticket was:
Clean on my Dartnode VPS.
Tho password auth is disabled and also
PermitRootLogin nohelps with that a bit.I feel like this has to be a compromised image, a outdated image with a vuln, or some bad default config file (since these was mention of upgrading from debian 12 to 13).
Note: if you can't clean install and/or harden a VPS right away, shut it down. You can always power it up when you're ready to "do the needful" on it...
Bro, I don't think so, There is no 100% absolute security in the field of network security. The most effective efficient powerful wapon in our hand is increasing the complex of architechure of program that will increase hacker's cost of sucessful of hacking as well. random 16-key password is just one of those measures, for exmaple, You should consider that quantum computer can crack random 16-key password in seconds. the lucky situation where we are is quantum compute's cost is also very high, It is a meaningless action to crack your worthless vps by using quantum computer. so my theory is random 16-key password is approaching infinitely to 100% security. But never ever say we are100% absolute.
I was also included here but only my fresh idle, 1 of 3 and it was fast like I reinstalled the os and then 6-7 hours later it was running the miner so I reimagine and completed the setup removing authorized keys and changing password
Any opened port on it ?
I've had a VPS with DartNode for 2 years and I haven't once had any signs of intrusion (using an ISO straight from debian), granted I would like to complain about a few other things.
XMRig may as well be running since it's completely unusable 10% of the time, I can't host anything on it without people complaining about downtime (packets get dropped randomly). I've also needed to contact support before as well since the disk would previously be unusable for 30+ minute spans (iowait would be consistently be above 50%).
I never had any issues at all when I had a dedicated server with them, so I still highly recommend snagging one if you can get a decent deal on one.
A recent vulnerability could allow an attacker to escape a KVM virtual machine and gain control of the host, potentially being exploited to launch attacks.
CVE-2026-99999
+1 affected here.
/usr/local/lib/.system-update/systemd-journald, using the exact same Monero wallet./etc/systemd/system/sys-journal-daemon.service(Restart=always)./opt/.cache/kworker-events, running as root.Problem, upload ISO is not working on their panel..
huh?
(it appears there are some routing issues, so heres the bare link as well for your viewing pleasure https://files.catbox.moe/twsk4l.png)
Theres also https://github.com/bin456789/reinstall/blob/main/README.en.md
For me its stuck on upload iso for 1hour using debian 13 minimal iso.
Probably its their node in Boston, i cant even open VNC :
I ran into a similar problem too.
The first time, I didn’t change the password that DartNode gave me - I thought it looked pretty secure. But after a while, I noticed unauthorized access to the server: TrafficMonetizer had been installed in a Docker container, so I spotted it pretty quickly and reinstalled the system.
But damn, it happened a second time. I changed the root password right after reinstalling the server, and about a few days or a week later, that thing was installed on my server again. I thought I was the only one dealing with this…
Not the only provider where that happens
What else are you installing or doing? You might be installing something upstream that's infecting you. I had a Sabnzb container got hacked even after being recently installed/current.
No, increasing an architecture's complexity increases attack surface area and makes it easier to "hack".
That's incorrect. Quantum computers are not magic crypto-solving machines. They can only accelerate a narrow class of algorithms to solve problems in BQP (the Bounded-error Quantum Polynomial time complexity class), which famously includes integer factorization and DLP/ECDLP via Shor's algorithm which can solve them in polynomial time. Symmetric cryptography can only be attacked by the significantly slower (and badly scaling) Grover's algorithm which only gives a quadratic improvement over classical brute force.
Let's say you choose a random 16-key password out of all 95 possible ASCII keys. That's log2(95^16) ≈ 105 bits of security. A quantum computer running Grover's algorithm, which is proven to be asymptotically optimal btw, only halves the number of bits of security. So a quantum computer would need to attack a log2(95^16) / 2 ≈ 53 bit keyspace. On average it'll find the key after searching half the keyspace, so that means very roughly 2^52 searches before having a 50% chance of success. Now assuming a full search takes just 100 nanoseconds, which is extremely optimistic btw, it'll have a mere 50% chance of guessing the password after... 14 years. Even if you only used a-zA-Z0-9 and no symbols, it would take the better part of a year just to get to the 50% point. That's a far cry from "seconds".
And Grover's algorithm doesn't parallelize well either. Even if you have k quantum computers all running at once, you only get a √k speedup (thus 10,000 quantum computers would only give you a 100x speedup).
Anyway, this doesn't even matter because quantum computers aren't going to be able to brute force a network connection. You can't perform any cryptanalysis, quantum or classical, until you at least have the hash.
The cost isn't high, they (cryptographically-relevant quantum computers) literally don't exist yet.
My dedis are fine; my (custom?) Ubuntu VPS is also fine, but default CentOS image looks like it got pwned.
Do with this information what you will.
Default pw or no ?
What panel do they use?
I can offer more cases from nodeseek :
1. https://www.nodeseek.com/post-1001923-1
2. https://www.nodeseek.com/post-966530-1
3. https://www.nodeseek.com/post-955971-1
I also have a dartnode vps. Fortunately, I change the default ssh port，disabled login with password and only use ssh key to login. As a result, I haven't found any signs of my VPS being hacked.
really interesting the lack of comment from dartnode, maybe someone should bring it up in their next twitch stream
Dartnode actually sent an automated email (which they said it was a mistake in next email) saying that the VPS is using too much resources and it might be running miner and some shady shit and includes basic steps how to secure the server.
So it seems like they are working on this topic.
I see nothing, shadow is clear, no miner running.
Otherwise would also gotten a push to my phone, that someone logged in
Would be something if someone is fucking around with the qemu quest agent.
also check for /etc/systemd/system/sg_metrics.service and /usr/bin/sg_metrics which will use config.json somewhere around /usr/bin
and then a few hours they said it was a mistake...
Yeah that was weird. Mine said “identified as communicating with known cryptomining infrastructure or actively directing computing resources to an unauthorized mining wallet.”
No logs, no evidence, nothing. Couldn’t be any more vague. I checked the server thoroughly nevertheless and opened a ticket asking for more details about the finding, and shortly after they replied it was a mistake.