Our server is hacked: foreign addresses in china, finland, france etc

[ZeZaung]

Hello there

Evidently, we got hacked.

Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

Question for the cloudron's so-called turnkey security team: What can we do to protect ourselves? This is especially important to get an answer from you since we're incapable of installing modest network or Os-level security provisions within the instance without interfering with cloudron itself.

We understand Cloudron literature suggests the following

Security is a core feature of Cloudron and we continue to push out updates to tighten the Cloudron firewall's security policy. Our goal is that Cloudron users should be able to rely on Cloudron being secure out of the box without having to do manual configuration.

Can the turnkey security team give us some advice on software we can install (that still works with cloudron) to deal with this? A lot of our preferred security & hardening measures are not doable without interfering with cloudron itself

Before our team goes through the onerous process of creating a new instance and backing up these apps individually or resetting them all together, we want to know what security measures can be implemented on the second time around, so we aren't wasting time after the fact.

A simple netstat and awk monitoring program shows unique hits from foreign addresses in countries such as China, finland, and France, all on strange ports certainly not associated with our deployed applications.

Considering the restrictive nature of 3rd party installations of software on a OS level for the master control plane instance we are hoping cloudron's turnkey security team can get back to us promptly. the current state of things suggests we can't rely on cloudron as a platform for production grade loads or traffic.

[BrutalBirdie]

@ZeZaung
Could you please explain what got hacked?
Because the statement:

foreign addresses in china, finland, france etc

can be expected for a public server.

Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

What exactly was happening? This is all so vague.

Can the turnkey security team give us some advice on software we can install (that still works with cloudron) to deal with this? A lot of our preferred security & hardening measures are not doable without interfering with cloudron itself

To give advise or investigate it would be tremendously helpful to know what happened.
Do you have:

• logs
• statements from the provider

Did the server get compromised on the root level, was custom software running?
An App level?

---

Did you perhaps run an the adguard app and did not secure it properly, and it got used for a reflection attack?

Please share more details.

[ZeZaung]

@BrutalBirdie

Answers to your question.

Could you please explain what got hacked?

The VPS itself has been hacked and an unknown process emanating from this IP has been detected by our cloud provider

can be expected for a public server.

I am telling you that connections from all these different hosts is unconnected and not explainable, no/

Our instance provider has let us know that we have abuse traffic emanating from our machine. We've monitored foreign addreses and know, for sure, the instance is compromised.

What exactly was happening? This is all so vague.

See below

Do you have:

• logs
• statements from the provider
  See below

Hello,

Here is a sample of the traffic that was detected per your request.

-- Traffic excerpt below --

Reported-From: root@dascos.info
Report-ID: 1676447666@jeeg
Category: abuse
Report-Type: login-attack
Service: 404trap
User-Agent: csf v14.17
Date: 2023-02-15T08:54:26+0100
Source:(OUR.IP.WAS.HERE)
Source-Type: ipv4
Attachment: text/plain
Schema-URL: https://download.configserver.com/abuse_login-attack_0.2.json

(OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:17 +0100] GET /?author=161 HTTP/2.0 404
(OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:18 +0100] GET /?author=162 HTTP/2.0 404
(OUR.IP.WAS.HERE) 172.16.0.50 nolodapria.it [15/Feb/2023:08:54:19 +0100] GET /?author=163 HTTP/2.0 404
(OUR.IP.WAS.HERE).16.0.50 nolodapria.it [15/Feb/2023:08:54:20 +0100] GET /?author=164 HTTP/2.0 404

-- Traffic excerpt above --

Please review and resolve the abuse.

We will be forced to power down this instance if we do not receive an update within 24 hours.

This was one of their warnings. We have done some preliminary investigation via netstat and rootkit searches and can provide logs to you. Who do we email?

Can you help us differentiate the traffic we are seeing to discern what processes are responsible for this and where the security compromise is arising from within the operating system? A lot of our diagnostic tools we can not install without interfering with cloudron.

Did you perhaps run an the adguard app and did not secure it properly, and it got used for a reflection attack?
Sorry no

Please let us know who to send this info to. We will capture logs over hte past 20 mins or so in a few files.

[BrutalBirdie]

@ZeZaung
please provide as many details as possible to support@cloudron.io

[ZeZaung]

thanks, we'll be in toch

[girish]

Yes, please send a mail to support@cloudron.io with more information. I am not really sure what was compromised or how things were compromised from your report. There is nothing inherently wrong with a server contacting china/finland/france depending on what software you have installed. If you can tell us what additional security measure you want to put in place , we can give suggestions there as well , so that it doesn't interfere with Cloudron.

[BrutalBirdie]

@ZeZaung also I highly doubt you made a disk image of the server for forensic analytics, right?

[ZeZaung]

@BrutalBirdie Would a copy of a file generated at /var/backups suffice?

[BrutalBirdie]

@ZeZaung Please provide as many information as possible to support@cloudron.io

• VPS Provider
• OS Used (Version)
• was ssh for root enabled with a weak password
• what cloudron version was running
• what apps where running
• logs of the apps
• logs of the system

Provide as many details as possible.

[ZeZaung]

@BrutalBirdie
How do I tell which version of cloudron we're running?

[ZeZaung]

@BrutalBirdie Also, which system logs would be most appropriate?

[BrutalBirdie]

@ZeZaung like I said, a full disk image for forensic analysis would be best.

You can determine the Cloudron version from the latest backup made, since the newest backup included the box_X.Y.Z.tar.gz

If you can provide everything that you have from that system that would be best.

[andreasdueren]

Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

[jdaviescoates]

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

I shouldn't think so.

Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

[BrutalBirdie]

@andreasdueren I am running all cloudron servers with root on complete lockdown.
This even blocks default support access for the staff, if you enabled it.

I also use normal ssh keys for the designated sudo user and also ed25519-sk and ecdsa-sk ssh keys for 2FA via Yubikey.
This works with no issues.

[LoudLemur]

@BrutalBirdie Does Cloudron have a "click to create disk image" button?

[BrutalBirdie]

@LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

For that you need a live boot and create it yourself with dd or a tool like clonzilla.

For more details: https://wiki.archlinux.org/title/disk_cloning

[privsec]

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

Piggybacking on this thread: I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

@jdaviescoates said in Our server is hacked: foreign addresses in china, finland, france etc:

@andreasdueren said in Our server is hacked: foreign addresses in china, finland, france etc:

I was wondering for a while about enabling 2fa for SSH. would this interfere with cloudron?

I shouldn't think so.

Personally I never have login with a password enabled and only have login via SHA public/ private keys enabled. Not sure what benefit 2FA would have in that case, but I'm presuming you've got a root password?

I have all accounts require username, password, SSH with a key and 2FA

[LoudLemur]

Thanks. For a cloned disk image to be useful, wouldn't it also have to be very recent, too? Repeatedly cloning the entire disk and then archiving these images would be resource intensive.

Perhaps information from btrfs or ZFS might be useful, if they were the file system.

@BrutalBirdie said in Our server is hacked: foreign addresses in china, finland, france etc:

@LoudLemur a disk image is a complete bit to bit copy to a file of the whole drive.
There is no way a software running on the same drive and at the same time that can create such an image, since it would recursively write it self into infinity.

For that you need a live boot and create it yourself with dd or a tool like clonzilla.

For more details: https://wiki.archlinux.org/title/disk_cloning

[BrutalBirdie]

@LoudLemur yes full disk images are regularly as big as the disk it self.
So if you got a 1TB disk the Disk Image will be 1TB.
Yes you could cut empty space which is unused.

When a system is compromised, normally you shutdown the system, create a disk image and then format the server and setup new.
Then this disk image can be used for later analytics.