Illicit crypto-miners pouncing on lazy DevOps configs leaving clouds vulnerable

https://www.theregister.com/2025/06/03/illicit_miners_hashicorp_tools/

34•rntn•8mo ago

Comments

HenryBemis•8mo ago

Apologies for the (not really) dark humor, but.. [0]. Focus on the cat, and replace the ill did described on the TV with 'higher cloud costs'

[0]: https://i.imgur.com/T8BmaVd.jpeg

hluska•8mo ago

Maybe I don’t understand your sense of humour but it sure seems like you’re laughing at victims of a crime. That’s not funny.

southernplaces7•8mo ago

Sure it is, sometimes at least, depending on who and how dumb the victims were.

HenryBemis•8mo ago

I am obviously not happy that this happens/happened to people and they had to cough up large amounts of $$$ because they got hacked. If anything I'm in the profession Audit/Sec/GRC and VERY much against thieves.

The 'amusing' part is... since the first time I encountered "DevOps" I thought that it is a terrible idea (but what do I know...). There are some stupid buzzwords that became the norm and I thought they were moronic/creepy/dangerous form the fist time I heard them (and I was spot on). DevOps is one. It's like saying "someone eats swords for a living" and "that very someone pierced his stomach". I will feel sorry for the fella and will wish him speedy recovery, but I will whisper to myself "what a f... moron".

Also, due to my Audit/Sec/GRC background, I laugh when I read/hear such stories because "you auditors know shit, we don't need ITGCs" and plenty other stupid shit that I hear from Tech Bros. Well, how do you like them apples/ITGCs now??? So, don't try to bark at the one who laughs. Instead punch the moron who says "we don't need ITGCs, documentation, reviews, etc, they are a waste of time".

So.. sorry, not sorry (at all).

EDIT: as you can understand this is a sensitive topic for me, because ITGCs cause time/money, but hey, go ask those DevOps, (now) would they prefer to have ITGCs are X cost in time, or they prefer the loss? And seeing that they have BAD IT practices who will ever trust them again to do something right?

southernplaces7•8mo ago

And of course you get downvoted, because if something abounds on this site's comment sections, it's utterly humorless pedants.

udev4096•8mo ago

First rule of running any service is to not expose it blindly on the internet. If you do, have a goddamn auth in place. I see way better security practices on /r/selfhosted and /r/homelab than on some of these reckless companies.

latchkey•8mo ago

These sorts of articles always seem suspect to me. Blame the miners is a great trope. There really aren't any valuable crypto's being mined on CPU/GPU any longer. After ETH switched from PoW to PoS, it decimated the whole mining industry. Nothing else has enough volume to really make a huge dent, so the incentive was destroyed. Sure a few people deep into it can make a few grand a day, but this isn't enough to drive a whole market.

buffalobuffalo•8mo ago

Yeah i was wondering about that too. Even small cap PoW chains have dedicated mining hardware that is orders of magnitude faster than a GPU. I guess in theory it could work if you cobbled together enough hacked AWS accounts, but the scale required to make any sort of real profit would be gigantic. It just doesn't seem worthwhile.

latchkey•8mo ago

Exactly. The problem is volume on exchanges to unload what you've mined. Some of these tokens only have a few thousand a day and any selling risks dumping the entire market. If you can steal the compute, sure, that is one thing, but it is very risky for not a huge payout.

gavinray•8mo ago

I actually had this happen to my personal AWS account a month ago.

Someone had gotten ahold of one of my security keys and I stupidly didn't have 2-FA enabled.

They spun up dozens of EC2's with high-end GPU's mining crypto and managed to rack up a $600 bill before AWS flagged it and halted activity + contacted me by email.

I was surprised to learn that AWS support does not have any sort of automated tooling for large-scale service wipes. I asked them just to nuke any AWS service attached to my name, as I had no personal projects or databases I needed to keep.

They couldn't do this, and it was a lot of hand-cleaning and using some public tools from Github.

I refused to pay the $600 and now my AWS account is permanently closed.

Lesson learned: If you have your credit card attached to something, immediately enable 2-FA.

blacksmith_tb•8mo ago

Also, never expect AWS support to actually help with anything around billing or account setup, I had to close out an org on a project that was EOL and it was like pulling teeth, their answer to every roadblock was "you should have known you'd need to have the credentials of your former employees, because we might have demanded their payment info too, as backup" etc. I ended up having to spin back up several email accounts so I could impersonate people who'd left years earlier, just to close their accounts (including add payment info to their accounts in order to close them... mind boggling).

Show HN: MCP Server for TradeStation

Canada unveils auto industry plan in latest pivot away from US

The essential Reinhold Niebuhr: selected essays and addresses

Rentahuman.ai Turns Humans into On-Demand Labor for AI Agents

StovexGlobal – Compliance Gaps to Note

Show HN: Afelyon – Turns Jira tickets into production-ready PRs (multi-repo)

Trump says America should move on from Epstein – it may not be that easy

Tiny Clippy – A native Office Assistant built in Rust and egui

LegalArgumentException: From Courtrooms to Clojure – Sen [video]

US moves to deport 5-year-old detained in Minnesota

If you lose your passport in Austria, head for McDonald's Golden Arches

Show HN: Mermaid Formatter – CLI and library to auto-format Mermaid diagrams

RFCs vs. READMEs: The Evolution of Protocols

Kanchipuram Saris and Thinking Machines

Chinese chemical supplier causes global baby formula recall

I've used AI to write 100% of my code for a year as an engineer

Looking for 4 Autistic Co-Founders for AI Startup (Equity-Based)

AI-native capabilities, a new API Catalog, and updated plans and pricing

What changed in tech from 2010 to 2020?

From Human Ergonomics to Agent Ergonomics

Advanced Inertial Reference Sphere

Toyota Developing a Console-Grade, Open-Source Game Engine with Flutter and Dart

Typing for Love or Money: The Hidden Labor Behind Modern Literary Masterpieces

Show HN: A longitudinal health record built from fragmented medical data

CoreWeave's $30B Bet on GPU Market Infrastructure

Creating and Hosting a Static Website on Cloudflare for Free

"The Stanford scam proves America is becoming a nation of grifters"

Elon Musk on Space GPUs, AI, Optimus, and His Manufacturing Method

X (Twitter) is back with a new X API Pay-Per-Use model

Zlob.h 100% POSIX and glibc compatible globbing lib that is faste and better