Am 07.10.26 um 14:29 schrieb Dr Remmiz via tor-relays:
- Where did the attacker get the operator password before Aug 28? Not by brute force, and not through the WGDashboard on the management server (its web UI had been failing to start since April); the candidates are another of our relays, the admin workstation, or reuse somewhere we haven't found.
Is there any reason to exclude the WG dashboard just because of the date it stopped working? As you wrote it was operational until April and there was a bug that allowed unwanted filesystem reads (haven't found info if that is possible while unauthenticated), this could be the door the attackers used. Maybe they waited some time and then manipulated the machine.
-- Gruß Marco Muell und Spam bitte an abfalleimer2002@xxxxxxxxxxxxxxxxxxxxxx
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx