Email or username:

Password:

Forgot your password?
Eugen's posts Post Back to profile
Eugen Rochko

I'm terribly sorry for today's downtime. We are now back.

Post-mortem:

Yesterday my hosting provider, Hetzner, received an abuse report for our entire IP due to a user account that apparently was used as a botnet controller. I suspended the account immediately, but forgot to submit a statement to Hetzner.

After 24 hours, the IP to mastodon.social was locked by Hetzner. I've reached out to them as soon as I learned of this.

1 Dec 2021 at 15:49 | Open on mastodon.social
16 comments
stux⚡

@Gargron Holy shit.. We had the same thing!!

Only i responded and its resolved!

1 Dec 2021 at 15:52 | Open on mstdn.social
Daniel

@gargron people are using Mastodon accounts to control botnets? What a world we live in…

1 Dec 2021 at 16:02 | Open on social.tchncs.de
Kandy

@Gargron Is there a way to prevent that, or to spot this kind of account ?

1 Dec 2021 at 16:05 | Open on the.goofs.space
Eugen Rochko

@Kandy The account had no posts and was not remarkable in any way except having "hello [IP address]" in its bio.

1 Dec 2021 at 16:17 | Open on mastodon.social
Richard jasmin

@Gargron it's weird we have a decentralized platform but no decentralized updates on a decentralized system..

1 Dec 2021 at 16:19 | Open on mastodon.social
oiyouyeahyou

@Gargron Are you going to set up anything like a simple status.mastodon.social?

1 Dec 2021 at 16:22 | Open on mastodon.social
Iron Bug
@Gargron botnet controller on mastodon??? this is weird.
1 Dec 2021 at 19:09 | Open on friendica.ironbug.org
fernand0

@Gargron thanks for the info and the work.

1 Dec 2021 at 19:13 | Open on mastodon.social
Eugen Rochko

We're talking about an account that was created through normal means, that is not really distinguishable from just any random account, but contains something like "hello 1.2.3.4|" in its bio. The way they seem to be used is that some botnet software checks the profile to get its commands that way. It is not a Mastodon vulnerability and I don't think its specific to Mastodon either.

1 Dec 2021 at 20:06 | Open on mastodon.social
🍵 wizard

@Gargron definitely sounds like it could be implemented with any platform such as Facebook or Twitter

1 Dec 2021 at 20:13 | Open on mstdn.social
gh0stph1sh3r

@Gargron I've seen this often on Instagram, but in the comments section. It's an established TTP for C&C

1 Dec 2021 at 23:11 | Open on mastodon.social
Richard jasmin

@Gargron api automation issue. stop the bots? mandate gplish human accounts.

2 Dec 2021 at 0:15 | Open on mastodon.social
Caleb James DeLisle

@Gargron
Blackholing a site that's Alexa ranked 20k and has 600k users because #LooksLikeBotnet is a very hetzner thing to do. But can't argue with their prices so ...

1 Dec 2021 at 22:17 | Open on mastodon.social
Kat MCP(NT4) MCSE(Win2K)

@Gargron no worries..shit happens.. nice to be back! x

1 Dec 2021 at 23:46 | Open on mastodon.social
Go Up