Skip to content
Register

Portainer on public VPS—how long until I'm a crypto miner?

VPS Hosting by PacketpunkUma 5 replies 187 views
PacketpunkUma

Member OP

#1

I did it. I left Portainer 9443 open to the world with default admin password. Eleven hours. Eleven!!!

Here is what I found:

CONTAINER ID   IMAGE                  COMMAND                  CREATED          STATUS
a1b2c3d4e5f6   xmrig:latest           "./xmrig -o pool..."     3 hours ago      Up 3 hours

They didn't even delete my containers. Just added theirs. Polite note in /tmp/readme.txt:

nice firewall rules. maybe try ufw next time?
- friendly neighborhood miner

I'm dead.

Running forensics now. What do you all want to see?

olespete

Member

Trust No One

#2

Classic. Eleven hours is generous honestly.

ufw wont save you. They scan for 9443 specifically. Ive seen it in under 2 hours on fresh CloudCone box.

Check your docker socket permissions. Bet its mounted rw...

airgapped, encrypted, faraday'd, still worried
LichunLars

Member

#3
PacketpunkUma said:
RUNNING FORENSICS NOW

Here's my route to your IP space for comparison:

traceroute to racknerd.com (203.0.113.47)
 1  10.0.0.1        0.5 ms
 2  racknerd.com  2.1 ms
 3  ix-peer-01       4.3 ms
 4  203.0.113.47    12.7 ms

Route via Vultr adds 12ms from my HostHatch box. RackNerd peer is decent. Not your problem, just baseline.

More useful: check 

docker inspect
for host network mode. Miner probably needed it for kernel module access.

1ms or I don't want it
techmei

Member

#4
PacketpunkUma said:
POLITE NOTE IN /TMP/README.TXT

Haha this attacker will very polite!! I like this!!

You have two server now: original server, and miner server. Will check docker socket mount, yes??

docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Ports}}"

This command show everything. I use always.

XD the "friendly neighborhood miner" is best part. UPPERCASE ANGRY at self for open port, but lowercase impressed at note quality.

btrfs

Member

snapshot obsessive

#5

1) immediate response
A) isolate instance
B) snapshot disk if possible
C) check billing for egress spikes

2) forensic checklist
A) 

docker logs --since 11h

B) 
cat /var/log/auth.log | grep -i fail

C) 
netstat -tulpn | grep -E '9443|2375|2376'

3) emotional processing
A) anger at self
I) justified but unproductive
B) amusement at note
I) also unproductive
C) learning opportunity
I) permanent

4) prevention for next time
A) VPN-only access to management UI — https://tailscale.com
B) fail2ban on 22 at minimum
C) automated port scan alerts

HE

Member

#6

Mas tipo the note is 🤌

Real talk tho: Portainer + = in ⏱️⏱️

I got hit in 45 min once on Oracle free tier.

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft