Does it make sense to contact the Police after hacking three servers of the same provider?

Question

System administration

It is clear that the question is quite naive, and maybe even stupid, but this is the first time I have come across such a situation in 12 years of work in the field of development. Just want to make a reservation that I'm not a sis. admin, and most likely my skills in the field of administration of * nix systems may not be enough, but certainly enough to understand basic things.

It started with the fact that from the support of "Provider A" they wrote to me with a comment in the style of "Dear, if you do not stop scanning the entire Internet from your server X, then we will be forced to ban you, since a complaint has been received against you."

Next comes the link and text from the backbone provider of the Netherlands (Provider A has servers there, including mine is located there, along with this they have servers in Moscow), which literally says the following that a fierce port scan 5555 comes from my server. Ok I thought.

Logging into the server using the public key, I find a ton of zmap processes that are just scanning this port in the range 0.0.0.0 - 255.255.255.255, after killing them, I begin to analyze the situation. According to auth.log, it turns out that on September 18, September 26 and September 30 (the day this post was written) there were logins from ip addresses of the form 94.231.132.***, which, judging by a cursory search, belong to the Samara home Internet provider https://telenettv. ru/ .

Further study of the logs showed that they logged in on the first try with a password, login with a password in sshd is enabled, I never logged in with a password, immediately after buying the server I added my public key. I have never told anyone the password from Provider A's personal account, which is stored there in the clear , and I have never thrown it off in any correspondence.

Fail2ban is installed on the server, and password bruteforcing is extremely unlikely + the password length is 12 upper and lower case characters + special characters, which together makes it almost impossible to guess.

Provider A has three servers, on all three servers there are direct logins with passwords from addresses, such as those I gave above. On some servers, apart from logins, there were no actions (judging by .bash_history, which can certainly be cleaned, but judging by the other two servers, this was not done), while on others there were a lot of actions, ranging from installing zmap and modifying the settings file for the scan, and before packaging the sources of my projects and sending them to 0x0.st.

In one of the python files that served to send zmap logs, there is a post request for these very logs to 185.231.155.175:5000/lol.

In this regard, two questions
1) How else, besides reading auth.log, lastb, .bash_history, can one understand user activity?
2) Is it worth writing to the police, it is clear that ip addresses can be proxies / VPNs, but judging by the fact that this is a home Internet provider, there is still hope.

UPD 3) And the most important question is how, in addition to a direct leak of Provider A passwords, a person could log in to the server. I admit that it is possible (which is extremely unlikely) that my applications that run on the server could contain vulnerabilities, but when exploiting vulnerabilities, entries in ssh logs clearly do not appear

Answer 1

Hence moral 1 - never put the same password on different services. Leak one - lose everything. And moral 2 - change ALL passwords on ALL services once in a short period of time.

Answer 2

none7 , So for sure, the LC of "Provider A" was hacked, the IP log shows just the same "Samara addresses", which, with regards to protection, of course, I have already done this. Of course, I didn’t immediately think about the provider’s LC, of ​​course, for some reason it didn’t occur to me. As for how it was done - about 8 years ago, the password from one of my mailboxes, which was just at "Provider A", was leaked to the Internet, so I'm not surprised here. In general, everything turned out to be much easier

Answer 3

Does it make sense to call the police?

No.
No serious damage - what's the point of the police to deal with this case? They will advise you not to fool around, but to set up security on the servers is normal.
Of course, the application will be accepted if you insist, but there will be no sense from this.

I have never told anyone the password from Provider A, which is stored there in the clear, and in any correspondence I have never thrown off

The password cannot be stored in the provider's personal account in clear text!
This is done only when registering the service - they give you access addresses and a password and remind you that it must be changed.
You must immediately change this password to your own, which will not be stored anywhere. If you haven't done that, well, you're in trouble.

Answer 4

In the SSH config, it is better to disable the ability to log in with a password.
PasswordAuthentication no