Illicit crypto-miners pouncing on lazy DevOps configs leaving clouds vulnerable

https://www.theregister.com/2025/06/03/illicit_miners_hashicorp_tools/

34•rntn•8mo ago

Comments

HenryBemis•8mo ago

Apologies for the (not really) dark humor, but.. [0]. Focus on the cat, and replace the ill did described on the TV with 'higher cloud costs'

[0]: https://i.imgur.com/T8BmaVd.jpeg

hluska•8mo ago

Maybe I don’t understand your sense of humour but it sure seems like you’re laughing at victims of a crime. That’s not funny.

southernplaces7•8mo ago

Sure it is, sometimes at least, depending on who and how dumb the victims were.

HenryBemis•8mo ago

I am obviously not happy that this happens/happened to people and they had to cough up large amounts of $$$ because they got hacked. If anything I'm in the profession Audit/Sec/GRC and VERY much against thieves.

The 'amusing' part is... since the first time I encountered "DevOps" I thought that it is a terrible idea (but what do I know...). There are some stupid buzzwords that became the norm and I thought they were moronic/creepy/dangerous form the fist time I heard them (and I was spot on). DevOps is one. It's like saying "someone eats swords for a living" and "that very someone pierced his stomach". I will feel sorry for the fella and will wish him speedy recovery, but I will whisper to myself "what a f... moron".

Also, due to my Audit/Sec/GRC background, I laugh when I read/hear such stories because "you auditors know shit, we don't need ITGCs" and plenty other stupid shit that I hear from Tech Bros. Well, how do you like them apples/ITGCs now??? So, don't try to bark at the one who laughs. Instead punch the moron who says "we don't need ITGCs, documentation, reviews, etc, they are a waste of time".

So.. sorry, not sorry (at all).

EDIT: as you can understand this is a sensitive topic for me, because ITGCs cause time/money, but hey, go ask those DevOps, (now) would they prefer to have ITGCs are X cost in time, or they prefer the loss? And seeing that they have BAD IT practices who will ever trust them again to do something right?

southernplaces7•8mo ago

And of course you get downvoted, because if something abounds on this site's comment sections, it's utterly humorless pedants.

udev4096•8mo ago

First rule of running any service is to not expose it blindly on the internet. If you do, have a goddamn auth in place. I see way better security practices on /r/selfhosted and /r/homelab than on some of these reckless companies.

latchkey•8mo ago

These sorts of articles always seem suspect to me. Blame the miners is a great trope. There really aren't any valuable crypto's being mined on CPU/GPU any longer. After ETH switched from PoW to PoS, it decimated the whole mining industry. Nothing else has enough volume to really make a huge dent, so the incentive was destroyed. Sure a few people deep into it can make a few grand a day, but this isn't enough to drive a whole market.

buffalobuffalo•8mo ago

Yeah i was wondering about that too. Even small cap PoW chains have dedicated mining hardware that is orders of magnitude faster than a GPU. I guess in theory it could work if you cobbled together enough hacked AWS accounts, but the scale required to make any sort of real profit would be gigantic. It just doesn't seem worthwhile.

latchkey•8mo ago

Exactly. The problem is volume on exchanges to unload what you've mined. Some of these tokens only have a few thousand a day and any selling risks dumping the entire market. If you can steal the compute, sure, that is one thing, but it is very risky for not a huge payout.

gavinray•8mo ago

I actually had this happen to my personal AWS account a month ago.

Someone had gotten ahold of one of my security keys and I stupidly didn't have 2-FA enabled.

They spun up dozens of EC2's with high-end GPU's mining crypto and managed to rack up a $600 bill before AWS flagged it and halted activity + contacted me by email.

I was surprised to learn that AWS support does not have any sort of automated tooling for large-scale service wipes. I asked them just to nuke any AWS service attached to my name, as I had no personal projects or databases I needed to keep.

They couldn't do this, and it was a lot of hand-cleaning and using some public tools from Github.

I refused to pay the $600 and now my AWS account is permanently closed.

Lesson learned: If you have your credit card attached to something, immediately enable 2-FA.

blacksmith_tb•8mo ago

Also, never expect AWS support to actually help with anything around billing or account setup, I had to close out an org on a project that was EOL and it was like pulling teeth, their answer to every roadblock was "you should have known you'd need to have the credentials of your former employees, because we might have demanded their payment info too, as backup" etc. I ended up having to spin back up several email accounts so I could impersonate people who'd left years earlier, just to close their accounts (including add payment info to their accounts in order to close them... mind boggling).

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

The Waymo World Model

How we made geo joins 400× faster with H3 indexes

Unseen Footage of Atari Battlezone Arcade Cabinet Production

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

Monty: A minimal, secure Python interpreter written in Rust for use by AI

What Is Ruliology?

Show HN: I spent 4 years building a UI design tool with only the features I use

Microsoft open-sources LiteBox, a security-focused library OS

Sheldon Brown's Bicycle Technical Info

Dark Alley Mathematics

Hackers (1995) Animated Experience

Show HN: If you lose your memory, how to regain access to your computer?

PC Floppy Copy Protection: Vault Prolok

Delimited Continuations vs. Lwt for Threads

An Update on Heroku

How to effectively write quality code with AI

Why I Joined OpenAI

Learning from context is harder than we thought

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

Introducing the Developer Knowledge API and MCP Server

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

Female Asian Elephant Calf Born at the Smithsonian National Zoo

Show HN: ARM64 Android Dev Kit

Understanding Neural Network, Visually

I now assume that all ads on Apple news are scams

Zlob.h 100% POSIX and glibc compatible globbing lib that is faste and better

FORTH? Really!?

Show HN: Smooth CLI – Token-efficient browser for AI agents

WebView performance significantly slower than PWA