This is becoming embarassing.
Another one of my VPSs is fucked.

This time by a crypto miner virus.
It's only been up for 3 weeks. And the worst thing is, I've configured it to my template security VPS. So unless Grafana/Prometheus distros are compromised. I'm going to have to do a review from scratch...
...that or my endpoint is compromised which is a possibility I will not discount.
#threatintel #hosed #hacked #xmrigminer #grafana #prometheus #crypto

0.4MB (yeah that's the right unit)
Per second may not seem much, but it's enough to send my shitty charity VPS into 100% utilisation killing everything, not just the WP container that's being hosed.

I recon I need to set up rate limiting on the reverse proxy but I have NFI how to do that. At least the learnings will go to harden the other VPSes.
Or maybe...I can set up a CPU limit on the container? Is that a good idea?

Also, I'd like to find out where it's coming from.
#hacked #hosed #nginx #docker #blackhatsdiediedie

One of my sites was up for 3.5 years untouched...

2 weeks after a professional security assessment...it's hosed...

...it's also a weird compromise.
Too clever for a script kiddie.
Too visible for a pro.

Almost as if a couple of gentlemen in stripey suits showed up..

"It's a nice system you got here...shame if anything happened to it..."

Makes me wonder about security of this specific #infosec outfit ...

#hosed