Illicit crypto-miners pouncing on lazy DevOps configs leaving clouds vulnerable

https://www.theregister.com/2025/06/03/illicit_miners_hashicorp_tools/

34•rntn•1d ago

Comments

HenryBemis•1d ago

Apologies for the (not really) dark humor, but.. [0]. Focus on the cat, and replace the ill did described on the TV with 'higher cloud costs'

[0]: https://i.imgur.com/T8BmaVd.jpeg

hluska•1d ago

Maybe I don’t understand your sense of humour but it sure seems like you’re laughing at victims of a crime. That’s not funny.

southernplaces7•1d ago

Sure it is, sometimes at least, depending on who and how dumb the victims were.

HenryBemis•1d ago

I am obviously not happy that this happens/happened to people and they had to cough up large amounts of $$$ because they got hacked. If anything I'm in the profession Audit/Sec/GRC and VERY much against thieves.

The 'amusing' part is... since the first time I encountered "DevOps" I thought that it is a terrible idea (but what do I know...). There are some stupid buzzwords that became the norm and I thought they were moronic/creepy/dangerous form the fist time I heard them (and I was spot on). DevOps is one. It's like saying "someone eats swords for a living" and "that very someone pierced his stomach". I will feel sorry for the fella and will wish him speedy recovery, but I will whisper to myself "what a f... moron".

Also, due to my Audit/Sec/GRC background, I laugh when I read/hear such stories because "you auditors know shit, we don't need ITGCs" and plenty other stupid shit that I hear from Tech Bros. Well, how do you like them apples/ITGCs now??? So, don't try to bark at the one who laughs. Instead punch the moron who says "we don't need ITGCs, documentation, reviews, etc, they are a waste of time".

So.. sorry, not sorry (at all).

EDIT: as you can understand this is a sensitive topic for me, because ITGCs cause time/money, but hey, go ask those DevOps, (now) would they prefer to have ITGCs are X cost in time, or they prefer the loss? And seeing that they have BAD IT practices who will ever trust them again to do something right?

southernplaces7•1d ago

And of course you get downvoted, because if something abounds on this site's comment sections, it's utterly humorless pedants.

udev4096•1d ago

First rule of running any service is to not expose it blindly on the internet. If you do, have a goddamn auth in place. I see way better security practices on /r/selfhosted and /r/homelab than on some of these reckless companies.

latchkey•1d ago

These sorts of articles always seem suspect to me. Blame the miners is a great trope. There really aren't any valuable crypto's being mined on CPU/GPU any longer. After ETH switched from PoW to PoS, it decimated the whole mining industry. Nothing else has enough volume to really make a huge dent, so the incentive was destroyed. Sure a few people deep into it can make a few grand a day, but this isn't enough to drive a whole market.

buffalobuffalo•1d ago

Yeah i was wondering about that too. Even small cap PoW chains have dedicated mining hardware that is orders of magnitude faster than a GPU. I guess in theory it could work if you cobbled together enough hacked AWS accounts, but the scale required to make any sort of real profit would be gigantic. It just doesn't seem worthwhile.

latchkey•1d ago

Exactly. The problem is volume on exchanges to unload what you've mined. Some of these tokens only have a few thousand a day and any selling risks dumping the entire market. If you can steal the compute, sure, that is one thing, but it is very risky for not a huge payout.

gavinray•1d ago

I actually had this happen to my personal AWS account a month ago.

Someone had gotten ahold of one of my security keys and I stupidly didn't have 2-FA enabled.

They spun up dozens of EC2's with high-end GPU's mining crypto and managed to rack up a $600 bill before AWS flagged it and halted activity + contacted me by email.

I was surprised to learn that AWS support does not have any sort of automated tooling for large-scale service wipes. I asked them just to nuke any AWS service attached to my name, as I had no personal projects or databases I needed to keep.

They couldn't do this, and it was a lot of hand-cleaning and using some public tools from Github.

I refused to pay the $600 and now my AWS account is permanently closed.

Lesson learned: If you have your credit card attached to something, immediately enable 2-FA.

blacksmith_tb•1d ago

Also, never expect AWS support to actually help with anything around billing or account setup, I had to close out an org on a project that was EOL and it was like pulling teeth, their answer to every roadblock was "you should have known you'd need to have the credentials of your former employees, because we might have demanded their payment info too, as backup" etc. I ended up having to spin back up several email accounts so I could impersonate people who'd left years earlier, just to close their accounts (including add payment info to their accounts in order to close them... mind boggling).

FFmpeg merges WebRTC support

Air Lab – A portable and open air quality measuring device

Cursor 1.0

A proposal to restrict sites from accessing a users’ local network

Why I wrote the BEAM book

Show HN: I made a 3D SVG Renderer that projects textures without rasterization

OpenAI slams court order to save all ChatGPT logs, including deleted chats

Autonomous drone defeats human champions in racing first

A Spiral Structure in the Inner Oort Cloud

Differences in link hallucination and source comprehension across different LLM

Prompt engineering playbook for programmers

LLMs and Elixir: Windfall or Deathblow?

Apple Notes Expected to Gain Markdown Support in iOS 26

parrot.live

The iPhone 15 Pro’s Depth Maps

Ada and SPARK enter the automotive ISO-26262 market with Nvidia

Tesla seeks to guard crash data from public disclosure

End of an Era: Landsat 7 Decommissioned After 25 Years of Earth Observation

Authentication with Axum

A practical guide to building agents [pdf]

IRS Direct File on GitHub

Not all tokens are meant to be forgotten

When memory was measured in kilobytes: The art of efficient vision

Comparing Claude System Prompts Reveal Anthropic's Priorities

Show HN: GPT image editing, but for 3D models

PromptArmor (YC W24) Is Hiring in San Francisco

How we reduced the impact of zombie clients

AGI is not multimodal

Amelia Earhart's Reckless Final Flights

Old payphones get new life, thanks to Vermont engineer