Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode Security Advisory

blog.linode.com

Post reply on HN
Print view View original

111–119 of 119 posts

Re: Linode Security Advisory

#111

Post by monster2control »

KaleidoscopeFan wrote: post #109
SomeCallMeTim wrote: post #95

Earlier quoted context omitted.

They changed the 2FA to use a microservice, so whatever the vulnerability was before, if the 2FA is now on an isolated server, that vulnerability shouldn't have access to the new 2FA key.

I think it's fairly important to note that they're NOT currently using the microservice for the 2FA, and they're NOT using bcrypt right now. The blog post states they're "working towards" these changes, they're not currently in place. It's fairly unlikely that they're using the same secret key as the one they found on the server, but it's fair to assume that they are still using salted SHA-2 for your passwords and th…

The article didn't state that. The article stated they are rolling out soon. The new dashboard will be an open source project. So you'll know when that gets released. There is no link to the project yet so assume that part isn't started yet. So the microservices should be released in a timely manner. Let's hope with the new focus on transparency if there are any delays they will keep us posted.

Re: Linode Security Advisory

#112

Post by ryanlol »

jaskerr wrote: post #101
ryanlol wrote: post #89

Earlier quoted context omitted.

If you're are paying double digits or more for cloud hosting, you'd probably get much better bang for your buck by getting a similarly priced dedicated hosting setup. The main value provided by cloud hosting is easy scalability, not cheap prices.

Do you have hosts you would suggest? There are so many hosts out there, it's hard to know wheat from chaff (to put it politely).

I'd start out by looking at the OVH offerings, Kimsufi (a part of OVH) has dedis starting from $5 a month in both NA and EU.

You can get a cheap "High Availability" setup for $10 with servers on two different continents.

Oh, and the bandwidth is free. (Although, 100mbit.) You can max that line 24/7 for a month and pay nothing more than $5, on linode that costs twice as much that'd cost $600 just for the bandwidth.

If you need something beefier than Kimsufi, OVH also has their mid-range brand soyoustart (https://www.soyoustart.com/us/essential-servers/) with prices starting at $42 that'll just completely destroy any similarly priced cloud offerings.

I'm only focusing on OVH here because they're IMO as the biggest provider in this market they're also the safest choice. Leaseweb and Voxility might be worth checking out too.

Quick disclaimer: I'm not currently an OVH customer (their DC locations don't fit my use case) nor am I in any way affiliated with them.

Re: Linode Security Advisory

#113

Post by TheSwordsman »

ethomson wrote: post #64
TheSwordsman wrote: post #23

Hey There, I'm a PagerDuty employee and am the same individual who made this post on the last HN thread: * https://news.ycombinator.com/item?id=10845985 Unfortunately, there are some facts in Linode's post that are not correct. >On July 9 a customer notified us of unauthorized access into their Linode account. The customer learned that an intruder had obtained access to their account after receiving an email notifica…

This is very helpful information. Can you say if you've moved to a different provider or if you're now racking your own machines? And if you do have a new provider, can you say who you are and how you evaluated them? I have been doing some research in my (limited) spare time to try to find a new provider, but I still have not made the switch from Linode.

So we ended on Microsoft Azure in Fresno. In hindsight, they would not be my preferred choice of a non-AWS provider to replace Linode. However, with the situation we were in they were the best choice.

We operate all of our datacenters in a multi-master configuration across the WAN, so latency is something we need to be mindful of. We were also in the middle of an emergency situation that required a migration, so we needed a solution that would allow us to evacuate quickly.

In the end we decided that we wanted a provider who supported a VPC-like network configuration, and was roughly within the same latency profile as Linode in respect to US-WEST-1 and US-WEST-2.

If timing hadn't been a concern, we may have chosen differently. We felt we didn't have the luxury of time.

Re: Linode Security Advisory

#114

Post by novaleaf »

tptacek wrote: post #21
chc wrote: post #18

Earlier quoted context omitted.

It sounds they have an idea how it could have happened — the Lish vulnerability — but they don't know if that's how it actually did happen or if there's another undiscovered vulnerability lurking.

Ok, now help me understand how that can be true given this quote from the advisory: The findings of our security partner’s investigation concluded there was no evidence of abuse or misuse of Linode’s infrastructure that would have resulted in the disclosure of customer credentials. Furthermore, the security partner’s assessment of our infrastructure and applications did not yield a vector that would have provided thi…

from the disclosure:

> After examining the image from our July investigation, we discovered software capable of generating TOTP codes if provided a TOTP key. We found software implementing the decryption method we use to secure TOTP keys, along with the secret key we use to encrypt them. We also found commands in the bash history that successfully generated a one-time code. Though the credentials found were unrelated to any of the unauthorized Linode Manager logins made in December, the discovery of this information significantly changed the seriousness of our investigation.

so, it was an inside job then?

Re: Linode Security Advisory

#115

Post by ryanlol »

elbee wrote: post #40
msbarnett wrote: post #30

Earlier quoted context omitted.

> SHA-2 for password hashes They're moving on from them, but they're going to leave SHA-2s sitting there and wait until everyone logs in to upgrade to bcrypt hashes at rest. Not getting a super competent vibe off of these folks.

Waiting until login until you upgrade to bcrypt is a requirement is compotent password storage. At this point in time all Linode should know is SHA-2(password) and they can't use that to derive bcrypt(password). The way upgrade should work is that the user provides their password, which is verified with SHA-2 and then hashed with bcrypt and stored again. In order to do this without people logging in Linode would have…

>The way upgrade should work is that the user provides their password, which is verified with SHA-2 and then hashed with bcrypt and stored again.

Er no, forcing email password resets and blocking the old passwords is the only way you should ever handle breaches like this.

to the downvoter: do you think it's cool to fuck over every single one of your customers that hasn't logged in recently?

Re: Linode Security Advisory

#116

Post by ivank »

I learned to not to trust Linode after incident around 2012-01-23: I emailed them asking if they would compile a new kernel without the /proc/pid/mem local root exploit; they manually patched and compiled a new 3.2.1-linode40 kernel. I booted into it, but it repeatedly locked up my VPS after ~10-12 hours of runtime. No monitoring or automatic reboot on their side, and both lockups happened right before I went to sleep. Did they bother notifying anybody about their buggy kernel, which many people probably booted into? Nope. Nothing.

Re: Linode Security Advisory

#117

Post by KaleidoscopeFan »

monster2control wrote: post #111
KaleidoscopeFan wrote: post #109

Earlier quoted context omitted.

I think it's fairly important to note that they're NOT currently using the microservice for the 2FA, and they're NOT using bcrypt right now. The blog post states they're "working towards" these changes, they're not currently in place. It's fairly unlikely that they're using the same secret key as the one they found on the server, but it's fair to assume that they are still using salted SHA-2 for your passwords and th…

The article didn't state that. The article stated they are rolling out soon. The new dashboard will be an open source project. So you'll know when that gets released. There is no link to the project yet so assume that part isn't started yet. So the microservices should be released in a timely manner. Let's hope with the new focus on transparency if there are any delays they will keep us posted.

Isn't that exactly what I said? o.O I said they will "likely" get rolled out with the new dashboard, not that the article said they would lol. But, they never stated when it would happen anyways, so "delays" aren't really a thing when there's no deadlines.

Re: Linode Security Advisory

#118

Post by monster2control »

stephendicato wrote: post #39
msbarnett wrote: post #30

Earlier quoted context omitted.

> SHA-2 for password hashes They're moving on from them, but they're going to leave SHA-2s sitting there and wait until everyone logs in to upgrade to bcrypt hashes at rest. Not getting a super competent vibe off of these folks.

To add to that, bcrypt is not the best recommendation if choosing a password hash today. In theory they should be adopting Argon2 (or maybe scrypt). In practice, I suspect that either the bindings for Argon2/scrypt don't exist or aren't easily adoptable given their use of ColdFusion. They do exist in Python. Either way, it seems like a sub-optimal decision.

Just an FYI, NIST still recommends SHA-2 for password hashing, they still don't see enough benefit from Bcrypt with the advent of super fast ASIC and FPGAs. Scrypt and Argon2 are too immature. Coldfusion isn't a reason for not using either as cold fusion can run any Java code very easily. Python can run C code easily. So bindings for any language is never a reason as long as you know how to use your tools. Bcrypt does add some extra benefits over SHA-2 for typical offline password hacking. So it's still a good step. It would be foolish to go with Agon2 as it only won the Password Hashing contest a little over 6 months ago. Bcrypt has been found to be solid for other 15 years now and has had tons of eye balls on it. Scrypt has had issue in the past and hasn't been nearly as scrutinized as Bcrypt. The fact of the matter is, the good guys aren't working as hard as the bad guys when it comes to good security.

Re: Linode Security Advisory

#119

Post by jjoe »

developer2 wrote: post #82
odonnellryan wrote: post #14

Earlier quoted context omitted.

I feel DO's level of service is on-bar. I've gotten multiple discounts from DO for "annoyances" I wasn't even annoyed by.

This is because DO is desperate to retain customers. I don't know if it's still the case, but a year or so ago the CEO was personally handling customer service, responding via email and adding credits to people's accounts. If the CEO has that much time on his hands, to personally handle every customer dissatisfaction, then the customer base must be quite small. I think for me the largest red flag was DO not even havi…

Frankly, I don't see any harm in this. Actually, it's quite positive to see a CEO mingle with her user base. That's how you make sure you're in touch with your users to know what they need.
Post reply on HN