Post Mortem on Salt Incident

Re:Post Mortem on Salt Incident by sterlind on Wednesday May 06, 2020 @12:02AM (#23087796)

It seems bizarre to me that a crypto miner got in. It wouldn't make much money on regular CPUs, and the high processor usage would immediately draw attention. So it looks like a low-effort botnet, which is embarrassing to get pwned by.

(The coin mining could be a cover like you mention, but it seems unlikely since it naturally draws attention.)

[ Parent | on HN ]

Re:Post Mortem on Salt Incident by vertex-four on Wednesday May 06, 2020 @04:30AM (#23088960)

It’s easier to sell Monero for cash than... some random data from some random company.

[ Parent | on HN ]

Re:Post Mortem on Salt Incident by itsajoke on Wednesday May 06, 2020 @01:26AM (#23088126)

I once worked at a place where a minor piece of cloud infra got exploited. All the attacker did was run a monero miner on it.

[ Parent | on HN ]

Re:Post Mortem on Salt Incident by sterlind on Wednesday May 06, 2020 @02:35AM (#23088406)

Heh, in a way it makes a good bug bounty. Like if popping calc got you a trickle of income.

[ Parent | on HN ]

Re:Post Mortem on Salt Incident by optimiz3 on Wednesday May 06, 2020 @12:22AM (#23087882)

> It wouldn't make much money on regular CPUs

Not true; some PoWs such as Random-X are designed to be most efficient CPUs.

[ Parent | on HN ]