Illicit crypto-miners pouncing on lazy DevOps configs leaving clouds vulnerable | Hacker News Reader

Illicit crypto-miners pouncing on lazy DevOps configs leaving clouds vulnerable

theregister.com

34 pointsrntn11 comments

I actually had this happen to my personal AWS account a month ago.

Someone had gotten ahold of one of my security keys and I stupidly didn't have 2-FA enabled.

They spun up dozens of EC2's with high-end GPU's mining crypto and managed to rack up a $600 bill before AWS flagged it and halted activity + contacted me by email.

I was surprised to learn that AWS support does not have any sort of automated tooling for large-scale service wipes. I asked them just to nuke any AWS service attached to my name, as I had no personal projects or databases I needed to keep.

They couldn't do this, and it was a lot of hand-cleaning and using some public tools from Github.

I refused to pay the $600 and now my AWS account is permanently closed.

Lesson learned: If you have your credit card attached to something, immediately enable 2-FA.

Also, never expect AWS support to actually help with anything around billing or account setup, I had to close out an org on a project that was EOL and it was like pulling teeth, their answer to every roadblock was "you should have known you'd need to have the credentials of your former employees, because we might have demanded their payment info too, as backup" etc. I ended up having to spin back up several email accounts so I could impersonate people who'd left years earlier, just to close their accounts (including add payment info to their accounts in order to close them... mind boggling).

These sorts of articles always seem suspect to me. Blame the miners is a great trope. There really aren't any valuable crypto's being mined on CPU/GPU any longer. After ETH switched from PoW to PoS, it decimated the whole mining industry. Nothing else has enough volume to really make a huge dent, so the incentive was destroyed. Sure a few people deep into it can make a few grand a day, but this isn't enough to drive a whole market.

Yeah i was wondering about that too. Even small cap PoW chains have dedicated mining hardware that is orders of magnitude faster than a GPU. I guess in theory it could work if you cobbled together enough hacked AWS accounts, but the scale required to make any sort of real profit would be gigantic. It just doesn't seem worthwhile.

Exactly. The problem is volume on exchanges to unload what you've mined. Some of these tokens only have a few thousand a day and any selling risks dumping the entire market. If you can steal the compute, sure, that is one thing, but it is very risky for not a huge payout.

First rule of running any service is to not expose it blindly on the internet. If you do, have a goddamn auth in place. I see way better security practices on /r/selfhosted and /r/homelab than on some of these reckless companies.

Apologies for the (not really) dark humor, but.. [0]. Focus on the cat, and replace the ill did described on the TV with 'higher cloud costs'

[0]: https://i.imgur.com/T8BmaVd.jpeg

Maybe I don’t understand your sense of humour but it sure seems like you’re laughing at victims of a crime. That’s not funny.

Sure it is, sometimes at least, depending on who and how dumb the victims were.

I am obviously not happy that this happens/happened to people and they had to cough up large amounts of $$$ because they got hacked. If anything I'm in the profession Audit/Sec/GRC and VERY much against thieves.

The 'amusing' part is... since the first time I encountered "DevOps" I thought that it is a terrible idea (but what do I know...). There are some stupid buzzwords that became the norm and I thought they were moronic/creepy/dangerous form the fist time I heard them (and I was spot on). DevOps is one. It's like saying "someone eats swords for a living" and "that very someone pierced his stomach". I will feel sorry for the fella and will wish him speedy recovery, but I will whisper to myself "what a f... moron".

Also, due to my Audit/Sec/GRC background, I laugh when I read/hear such stories because "you auditors know shit, we don't need ITGCs" and plenty other stupid shit that I hear from Tech Bros. Well, how do you like them apples/ITGCs now??? So, don't try to bark at the one who laughs. Instead punch the moron who says "we don't need ITGCs, documentation, reviews, etc, they are a waste of time".

So.. sorry, not sorry (at all).

EDIT: as you can understand this is a sensitive topic for me, because ITGCs cause time/money, but hey, go ask those DevOps, (now) would they prefer to have ITGCs are X cost in time, or they prefer the loss? And seeing that they have BAD IT practices who will ever trust them again to do something right?

And of course you get downvoted, because if something abounds on this site's comment sections, it's utterly humorless pedants.

Reply on news.ycombinator.com