Hetzner

You know, like that's a case of ecosystem.

You know, you have access to the main European sovereign clouds like Hetzner, OVH, us, like UpCloud, and you can do cool stuff there.

And I think Europe is being, you know, on the vanguard of that.

We should be proud and take it further.

But the big one is a software company called Softaculous, which makes a virtualization management software called Virtualizor that is used by a bunch of places to manage their virtual environments.

basically had the IP range they host at Hetzner hijacked by a different provider, and then malicious software updates for their software deployed to their customers.

So any customer who tried to update their virtualizer software would basically get routed to the right IP address and the right domain name, but pointing to the wrong server because of the BGP hijack, and then download malware in place of the update for the software they were trying to install.

Of course, this is only possible because Softaculous doesn't sign their updates in any way and basically relied only on TLS to verify that the other side was actually their server.

Although in this case, it's not the standard one.

So Hessner was actually deploying the routing PKI stuff to say, here's a signed list of places that are actually allowed to publish routes for this block of IP addresses.

The issue turned out to be that Hetzner's rule did allow more specific routes within that block.

So they have a slash 16 that they announce and they have it RPKI'd, but the attackers were allowed to broadcast a slash 24 that was more specific and hijack only that one part of the subnet.

We're still relying on step functions.

We have had conversations of, well, what do we do if we want to switch to Azure? Do we just implement everything in Azure managed services? If we do that and then someone says we want to move to some, I don't know, bare metal servers in Hetzner or something, it's like, well, then we don't have a solution.

So do we target Kubernetes again? What do we do? So I don't think we have a great answer to that at the moment either.

There's a lot of benefit from using the managed services and just having something that's very targeted because it keeps the code base very simple.

In a sophisticated supply chain attack, hackers hijacked a portion of internet space to install malware on networks.

They exploited weaknesses in the routing security of Hetzner Online and the TLS certificate process, allowing them to control IP addresses assigned to Softicalis.

This UAE-based company provides cloud management software, and the hijacked IPs were used to push malware disguised as legitimate updates.

The attack highlights vulnerabilities in internet routing protocols, emphasizing the need for stronger security measures.

Yeah, I know, right? So what I did was deploy a Docker instance from the upstream images.

on my favorite Hetzner box over in Germany, but I didn't really want to host all of the media on that box.

And so what I did was I used our favorite S3 block storage platform where we store all the audio files.

I thought, well, let's be consistent.

And ARM VPS instances are getting more common.

Hetzner's got ARM boxes.

Oracle Cloud's free tier is ARM.

The Raspberry Pi as a home server is a whole ecosystem.