New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Curiouser and curiouser.
so does nobody uses auditd yet in the dartnode vps?
you can potentially catch when/who put/changed a file with that
Yeah that part makes me wonder if they just going to leave it vague like that even for an actual report.
mine is clean for now touches wood
I have a custom port for ssh, root login disabled, and a highly aggressive fail2ban config
I opened a ticket with Dartnode at the beginning of the week when my AI agent found a crypto miner on one of my machines. I offered logs and prelim information, support said they would forward my information to engineering and I never heard back. I tried to follow up with more information couple days ago and never heard back so I'm posting what I found here with redactions.
Some of the highlights from my AI chats,
The attacker already knew your password.
You did turn password login off, but DartNode’s own config file turned it back on without you knowing. In the evidence:
Your setting: sshd_config has PasswordAuthentication no, changed on Jul 23.
DartNode’s file:sshd_config.d/01-dartnode.conf has PermitRootLogin yes and PasswordAuthentication yes, written on Jul 7 when the server was set up.
Why theirs won: your sshd_config loads that folder at the top, and SSH keeps the first value it sees. So DartNode’s yes beat your no, and password login stayed on the whole time. Your serverconfig app only edits the main file, so it couldn’t see this.
The password was DartNode’s. The root password was set on Jul 7, the same moment as their config file, and was never changed. It was a strong random password you never reused or saved, and the attacker logged in on the first try. So it most likely leaked from DartNode’s side: their panel, their emails, their setup data or another of their systems. Most of the bot’s other servers are also on DartNode, which fits.
Here's a screenshot of the tracker I made to see how widespread the root password compromise attack is. Why don't you see 90+ machines on that wallet site people posted earlier? because it's updated every 60 seconds and machines come and go, the only way you get a real view of what is happening is if you create a watcher like I did.
Maybe someone from Dartnode can at least tell us they are looking into how all these root passwords were compromised.
But then you have to delve into the idea a super computer is being used on a random 16-digit hash. security comes with logic too.
You also fail to consider the "email" if like myself all emails are unique you use, this makes the likelyhood of any potential access i'd say 100% unlikely from user perspective.
I signed up and created a VPS at Dartnode just to see if mine would get pwned. It did not. (I was hoping it would get cracked, actually!) I left the default root password unchanged. It was running a patched sshd that logged every attempted password. syslog was configured to use a remote log server. I even had sshd debug turned on, so many of the packets were logged as a hexdump.
Here's a list of the most commonly tested passwords over the last few days:
And the list of 16 char passwords that were used (including the actual password!):
Which distro did you install and was it from their template? Would you be willing to try a different one?
Isn't it more concerning there was not obvious outside attack if nodes are still actively compromised? direst host to kvm intervention
Sorry, should have mentioned that! Debian 12 from their template.