Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Notification and Linode Manager Password Reset

blog.linode.com

Post reply on HN
Print view View original

51–60 of 173 posts

Re: Security Notification and Linode Manager Password Reset

#51

Post by aqtrans »

TheSwordsman wrote: post #42

I'm glad to see that this information has now been publicly disclosed. In July 2015, we suffered a compromise at PagerDuty via the Linode Manager. I hope that we can provide a bit more of an official in-depth post-mortem of our compromise, but I'd be happy to disclose some of the details here. Using the access gained within the Linode Manager, the attacker reset the root password on a few systems, and used Lish to ga…

Yikes...This comment has me seriously thinking about moving my VPS elsewhere. Thanks for spreading this information, this is definitely good to know.

Re: Security Notification and Linode Manager Password Reset

#52

Post by alextgordon »

Someone1234 wrote: post #39
masterleep wrote: post #35

Earlier quoted context omitted.

If the Linode Manager database only stores the hash, how would they know the password? How did you find out about the illicit login?

> If the Linode Manager database only stores the hash, how would they know the password? Hashes can be turned back into plain text, it is just computationally expensive to do so. Hashing only slows down an attack (and or increases the cost), it doesn't not mitigate one. In particular if the hashes aren't salted then a rainbow table is an extremely effective way of breaking all of the hashes concurrently. The main met…

This only works if the input password has low entropy. You would think that people using Linode are savvy enough to be using long, randomly generated passwords.

Re: Security Notification and Linode Manager Password Reset

#55

Post by ryanlol »

vox_mollis wrote: post #54
ryanlol wrote: post #49

Earlier quoted context omitted.

Yeah.

How exactly did you get caught? opsec/comsec violation?

Difficult question to answer. There was a complete lack of "technical" evidence against me (e.g .bash_history files, wiretaps).

The only evidence the prosecution had against me were a list of compromised sites and several coldfusion 0days I had in my possession.

They could never prove that I generated the list of compromised sites, but the judges felt that the possession of said list was enough evidence to convict me.

We would've appealed but there was no point as the sentence was essentially nothing.

Re: Security Notification and Linode Manager Password Reset

#56

Post by dangrossman »

msh wrote: post #50

Why the hell have they not emailed their customers about this! This is not the kind of thing I want to learn from HN.

They're doing so as we speak. It takes a while to send 400,000 mails if you actually want them to be delivered to inboxes.

Re: Security Notification and Linode Manager Password Reset

#57

Post by StanAngeloff »

madaxe_again wrote: post #6
wiremine wrote: post #3

The page was slashdotted for me, here's a copy: "Effective immediately, Linode Manager passwords have been expired. You will be prompted to set a new password on your next login. We regret this inconvenience, however this is a necessary precaution. "A security investigation into the unauthorized login of three accounts has led us to the discovery of two Linode.com user credentials on an external machine. This implies…

Sadly I trust them as far as I can throw them, and we moved everything important from them to AWS a few years back. We had left a few static sites there but after the shenanigans over the holidays, we're moving our remaining stuff. Sad. We spent >$10k/month with them for a while, before their shit started falling apart. They didn't appear to care at all when we left, so I suppose they have an awful lot of large custo…

We've been watching the unfolding situation closely as well and have decided to migrate/duplicate on AWS. Glad it worked our for you.

At what point should Linode start thinking damage control? DDoS, breaches, lack of transparency...

Re: Security Notification and Linode Manager Password Reset

#58

Post by chinathrow »

TheSwordsman wrote: post #42

I'm glad to see that this information has now been publicly disclosed. In July 2015, we suffered a compromise at PagerDuty via the Linode Manager. I hope that we can provide a bit more of an official in-depth post-mortem of our compromise, but I'd be happy to disclose some of the details here. Using the access gained within the Linode Manager, the attacker reset the root password on a few systems, and used Lish to ga…

Nice writeup.

Keeping logins of ex-employees on 3rd party systems is a no-no though I admit full removal might pose some hurdles.

Re: Security Notification and Linode Manager Password Reset

#59

Post by TheSwordsman »

chinathrow wrote: post #58
TheSwordsman wrote: post #42

I'm glad to see that this information has now been publicly disclosed. In July 2015, we suffered a compromise at PagerDuty via the Linode Manager. I hope that we can provide a bit more of an official in-depth post-mortem of our compromise, but I'd be happy to disclose some of the details here. Using the access gained within the Linode Manager, the attacker reset the root password on a few systems, and used Lish to ga…

Nice writeup. Keeping logins of ex-employees on 3rd party systems is a no-no though I admit full removal might pose some hurdles.

To clarify, we did not leave the users enabled in the Linode Manager. When you delete a Linode user, Linode shadow deletes them in the DB by setting an inactive date on the row.

The honeypot user would not have been able to access the account had the credentials been valid, but based on the information given by Linode we did see someone attempt to log in as that user only once around the time of the compromise.

Re: Security Notification and Linode Manager Password Reset

#60

Post by Someone1234 »

alextgordon wrote: post #52
Someone1234 wrote: post #39

Earlier quoted context omitted.

> If the Linode Manager database only stores the hash, how would they know the password? Hashes can be turned back into plain text, it is just computationally expensive to do so. Hashing only slows down an attack (and or increases the cost), it doesn't not mitigate one. In particular if the hashes aren't salted then a rainbow table is an extremely effective way of breaking all of the hashes concurrently. The main met…

This only works if the input password has low entropy. You would think that people using Linode are savvy enough to be using long, randomly generated passwords.

> This only works if the input password has low entropy.

If you're generating every single possible password up to e.g. 8 characters the password's quality doesn't matter, only the length does.

Post reply on HN