I got hacked last month... so this is where I fess up to where I messed up.

geek

Jun 7, 2015 — 1 min read

This blog was offline for a few weeks

I had my account suspended, my blog down, and a entirely warrented, and slightly annoyed email from my VPS host threatening to shut down my service if this happened again…. cause I was too lazy to set key based authentication.

I always figured a reasonably strong, alphanumeric password was enough, and linux was reasonably safe from viruses. An attacker would need to somehow know my password to get in (and yeah, I REALLY should have known better) and that keeping my software minimal and up to date was good enough.

Turns out I got hit by the xorbddos trojan. Lovely. It brute forced my password, injected a rootkit, and used my little, carefully built VPS to DDOS others. On one hand, I should have known better. I’ve set up good key based authentication and am pondering port knocking.

Victim blaming rarely helps, but there’s a few places where I really messed up.

Passwords arn’t good enough. I actually may redo my key based auth setup with stronger keys than what I have now. Its a pain remembering to have my keys so I need to create device specific keys, and a backup one on a USB drive or something. Key based auth is *easy*. There’s tons of good tutorials out there, and it takes less htna 5 minutes.

I didn’t have real backups – my db is elsewhere and in theory (and practice!) I could easily rebuild my wordpress instance quickly. However, if that install *had* been compromised, well.. I’d be in trouble. Still looking for a good solution there. Pondering a periodic scripted tarball of my /var/www and/or something WP specific

My VPS was running *too* well. I’d probably have noticed if I was paying attention to it. I need to log in and look for *obvious* things like high processor usage. I noticed this when I’d logged in to get my WP install out. In short, I need to *proactively* check on this, and not just run apt-get update every so often.

Some people suck. Seriously. However, a little patience means that they can’t ruin your day by turning your system into a one of the sources of a DDOS attack 😉

Setting up a hurricane electric tunnel with a linux router

This assumes that you have a working router as per my older post . This can work behind a nat (though I ended up DMZing this router) in some circumstances. This distils grawity’s excellent post on superuser – in the context of this setup (which has a few quirks), and some

Setting up Ipv6-pd with dnsmasq on a linux router

This follows on from my last post, and is basically a distillation of this excellent post on Super User. These steps will work with Starhub Fibre ipv6 or any other provider who does IPv6 PD I found I *didn’t* need to set up a few things the way he

Setting up a basic Linux router with Ubuntu 18.04 and firewalld.

I’ve made a few choices that fit around my own preferences (firewalld) and problems I faced (bridgeutils and the classic network interfaces over bridging) This is as much a cookbook as a guide Picking hardware is easy. I got a system that was overkill – but basically there’s a

And another iteration of bias lighting.

While it “works” – there’s various minor issues, and iterations of my bias lighting setup. More brightness is always nice, and I’d like to combine the ability to power it off my PC, with a few additional features. I’d like to turn it off. I went with a

Read more

Setting up a hurricane electric tunnel with a linux router

Setting up Ipv6-pd with dnsmasq on a linux router

Setting up a basic Linux router with Ubuntu 18.04 and firewalld.

And another iteration of bias lighting.