Re:Post Mortem on Salt Incident
by lasdfas on Tuesday May 05, 2020 @11:46PM
(#23087729)
I agree. I would like to seem more details of how they determined it was only crypto mining. Finding only mining scripts in your logs doesn't mean they were not running other code once they had root.
[ Parent
| on HN ]
It seems bizarre to me that a crypto miner got in. It wouldn't make much money on regular CPUs, and the high processor usage would immediately draw attention. So it looks like a low-effort botnet, which is embarrassing to get pwned by.
(The coin mining could be a cover like you mention, but it seems unlikely since it naturally draws attention.)
Re:Post Mortem on Salt Incident
by vertex-four on Wednesday May 06, 2020 @04:30AM
(#23088960)
It’s easier to sell Monero for cash than... some random data from some random company.
I once worked at a place where a minor piece of cloud infra got exploited. All the attacker did was run a monero miner on it.
Heh, in a way it makes a good bug bounty. Like if popping calc got you a trickle of income.
> It wouldn't make much money on regular CPUs
Not true; some PoWs such as Random-X are designed to be most efficient CPUs.