# Concerns about recent Russian attacks using Management Software **URL:** \ **Category:** Help\ **Tags:** agent\ **Created:** [July 9, 2021, 2:29pm UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521 "2021-07-09T14:29:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![johnstonf](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/johnstonf/32/624_2.png) [@johnstonf](https://community.netdata.cloud/u/johnstonf)\ **Post date:** [July 9, 2021, 2:29pm UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/1 "2021-07-09T14:29:11Z")
With all the recent attacks using management software, how is NetData any less vulnerable to hacks (is it more safe for any reason)? I love it, but for my servers, it keeps me awake at night! (do you have any white papers on this?). I am referring, of course, to recent hacks by REvil group into the Kaseya Ransomware attacks, and previous SolarWinds. NetData has high privilege to the core operations of a server too, so I’d like to know what NetData does to prevent these types of attacks, and/or what we, as users need to do for prevention of attacks using NetData. ---
**Author:** ![ivan](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/ivan/32/517_2.png) [@ivan](https://community.netdata.cloud/u/ivan)\ **Post date:** [July 14, 2021, 10:28am UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/2 "2021-07-14T10:28:50Z")
Greetings from Russia 🐻👩‍💻. I would use in general ‘some hackers’. Hm, by the way what is your IP address, sir?) ---
**Author:** ![wmertens](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/wmertens/32/752_2.png) [@wmertens](https://community.netdata.cloud/u/wmertens)\ **Post date:** [July 14, 2021, 4:57pm UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/3 "2021-07-14T16:57:57Z")
- Netdata should be running as the `netdata` user generally, and it has either “regular user” permissions, or in some cases elevated read-only permissions to allow querying services. - It also normally only listens on localhost - It’s open source, hopefully leading to more eyeballs on the code So an attacker would first have to access netdata, then cause it to run arbitrary commands, and then use that to gain root privileges. Alternatively, an attacker might be able to perform a DoS attack by getting netdata to do things that exhaust resources. So, while it’s certainly not impossible, I think netdata is doing the right things to limit problems. ---
**Author:** ![OdysLam](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/odyslam/32/98_2.png) [@OdysLam](https://community.netdata.cloud/u/OdysLam)\ **Post date:** [July 15, 2021, 7:22pm UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/4 "2021-07-15T19:22:49Z")
Hey John, Let’s take first things first. The Netdata Cloud is a very well-designed SaSS platform, by a team of senior engineers. We take security very seriously, but there is no reason it should be more secure than others. Note that we don’t store passwords or metrics. Instead of p/w we use a magic link to login and for the nodes, we store only metadata. When you view your dashboard, you view the metrics as streamed by the node. For the agent, it runs without special privileges and if you use proper security measures (e.g nginx reverse-proxy, block connections not from localhost, etc.) it should be very secure. Please note that the Netdata Cloud can’t make any change to the Netdata Agent (currently). It simply receives data (to stream them to you) and alarms (to send notifications, show in the dashboard). These links might prove useful: > **[Security design | Learn Netdata](https://learn.netdata.cloud/docs/agent/netdata-security)** > > We have given special attention to all aspects of Netdata, ensuring that everything throughout its operation is as secure as possible. Netdata has been designed with security in mind. [https://www.netdata.cloud/data-privacy/](https://www.netdata.cloud/data-privacy/) Thanks @wmertens for responding. @ivan your comment is on-point, @johnstonf I have edited your post to remove the ethnic definition. It’s not relevant to this discussion. It’s a fine line, but it’s best not to phrase things in a manner that others might find disrespectful. We don’t do that here, but I am sure you didn’t intend it that way. Best, Odysseas ---
**Author:** ![johnstonf](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/johnstonf/32/624_2.png) [@johnstonf](https://community.netdata.cloud/u/johnstonf)\ **Post date:** [July 16, 2021, 1:53am UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/6 "2021-07-16T01:53:58Z")
Hi @ivan, i just saw that you asked for my ip address… Why do you want that? Fred ---
**Author:** ![OdysLam](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/odyslam/32/98_2.png) [@OdysLam](https://community.netdata.cloud/u/OdysLam)\ **Post date:** [July 16, 2021, 7:37am UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/7 "2021-07-16T07:37:25Z")
Hey Fred, I am locking this thread since it’s getting out of topic. Please refrain from labeling your views as “known”. We are not here to debate whether these attacks are gov sponsored or not, but to talk about the security of Netdata. I have removed your message and please continue the discussion about the security of Netdata and not the origins of the hacks. We don’t talk about topics that are inherently sensitive, such as politics, religion or sex. ---
**Author:** ![OdysLam](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.netdata.cloud/odyslam/32/98_2.png) [@OdysLam](https://community.netdata.cloud/u/OdysLam)\ **Post date:** [July 16, 2021, 7:38am UTC](https://community.netdata.cloud/t/concerns-about-recent-russian-attacks-using-management-software/1521/8 "2021-07-16T07:38:56Z")
I am pretty sure he was joking, implying that since he is russian, he must be a hacker. Let’s try to keep this discussion on rails guys, it’s a very good topic to discuss. Security is vital to both us and the community, so let’s produce top-quality discussion. Thank you for engaging and contributing. Especially to @johnstonf for raising this issue.