Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

theregister.com

Post reply on HN
Print view View original

11–20 of 50 posts

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#11

Post by TonyTrapp »

terom wrote: post #6
terom wrote: post #4

Apparently with plaintext customer data. > Lechelle said Scaleway worked with the YouTuber to recover the disk. The French-language video creator has written to Scaleway with assurances they have not copied the information contained on the disk. It is said some customer data was on the drive, unencrypted, including the source code and SSH keys of an Italian VPS provider.

Based on links in the other hackernews thread, it was quick-formatted, but a filesystem containing qemu disk images was recovered: [1] The YouTube video is in French without English CC subtitles, but there's screenshots of exploring what I assume would be one of the qcow images: [2] * 03:59 `/root/.ssh` with SSH id_rsa (private) keys, (public) authorized_keys and (hashed) known_hosts * 07:14 server binaries * 08:42 s…

Note: QB64 (which is mentioned in the video) is a modern-day reimplementation of QBasic. It doesn't have to be legacy. Some people still prefer using Basic as their "scripting language" for quick tasks where other people would be using Python or JS these days.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#12

Post by alyandon »

TonyTrapp wrote: post #11
terom wrote: post #6

Earlier quoted context omitted.

Based on links in the other hackernews thread, it was quick-formatted, but a filesystem containing qemu disk images was recovered: [1] The YouTube video is in French without English CC subtitles, but there's screenshots of exploring what I assume would be one of the qcow images: [2] * 03:59 `/root/.ssh` with SSH id_rsa (private) keys, (public) authorized_keys and (hashed) known_hosts * 07:14 server binaries * 08:42 s…

Note: QB64 (which is mentioned in the video) is a modern-day reimplementation of QBasic. It doesn't have to be legacy. Some people still prefer using Basic as their "scripting language" for quick tasks where other people would be using Python or JS these days.

Although I never cared much for the language itself, I continued to write small programs in QB for many years because of its ability to produce an EXE file that ran in DOS and Windows without any dependencies.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#13

Post by jnwatson »

atonse wrote: post #9
jnwatson wrote: post #8

Why in the world do they ship unencrypted drives around? Drive encryption is pretty standard these days, isn't it?

With the big cloud provides its a trivial checkbox. Can anyone speak to the effort in doing it at the OS level?

It is trivial in the Ubuntu installer.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#14

Post by jsiepkes »

tpxl wrote: post #10
atonse wrote: post #9

Earlier quoted context omitted.

With the big cloud provides its a trivial checkbox. Can anyone speak to the effort in doing it at the OS level?

There's a checkbox to encrypt the disks when installing some linux distros.

> There's a checkbox to encrypt the disks when installing some linux distros.

While I'm not going to defend moving around unencrypted disks it is not as simple as that.

The difficult part is not the encryption. The difficult part is the key management of the encryption. You need to solve issue like ensuring you don't lose access to the keys (and thereby access to the data), securely providing keys to people and machines that need access, dealing with key revocation when people leave the company, etc.

Though I guess in this case using a simple (long enough) passphrase instead of some form of keys could have saved them from this particular threat.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#16

Post by madaxe_again »

jnwatson wrote: post #8

Why in the world do they ship unencrypted drives around? Drive encryption is pretty standard these days, isn't it?

They say they’re iso27001 compliant and certified. If they aren’t encrypting in transit, it’s hard to see how they actually can be.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#17

Post by unilynx »

madaxe_again wrote: post #16
jnwatson wrote: post #8

Why in the world do they ship unencrypted drives around? Drive encryption is pretty standard these days, isn't it?

They say they’re iso27001 compliant and certified. If they aren’t encrypting in transit, it’s hard to see how they actually can be.

Are you sure they're actually saying that?

A lot of hosting providers actually say that their data centers are ISO 27001 compliant, but that doesn't make the provider itself compliant

(and it seems scaleway is still doing that too on https://www.scaleway.com/en/datacenter/)

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#18

Post by rasz »

terom wrote: post #6
terom wrote: post #4

Apparently with plaintext customer data. > Lechelle said Scaleway worked with the YouTuber to recover the disk. The French-language video creator has written to Scaleway with assurances they have not copied the information contained on the disk. It is said some customer data was on the drive, unencrypted, including the source code and SSH keys of an Italian VPS provider.

Based on links in the other hackernews thread, it was quick-formatted, but a filesystem containing qemu disk images was recovered: [1] The YouTube video is in French without English CC subtitles, but there's screenshots of exploring what I assume would be one of the qcow images: [2] * 03:59 `/root/.ssh` with SSH id_rsa (private) keys, (public) authorized_keys and (hashed) known_hosts * 07:14 server binaries * 08:42 s…

>it was quick-formatted

are there OSes that perform quick format without issuing TRIM command to the SSD? TRIM would vanish the data in less than 15 minutes.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#19

Post by vajenetehais »

On their website they refer to multiple certification [0]. One of them is the CISPE and on their website, it is stated:

"Requirement for CISP:

(a) Security measures

The CISP will implement and maintain appropriate technical and organisational measures for the CISP’s data centre facilities, servers, networking equipment and host software systems that are within the CISP’s control and are used to provide the CISP’s service (the CISP Network). Those technical and organisational measures should (a) be designed *to help customers secure personal data against unauthorised processing and accidental or unlawful loss, access or disclosure*, and (b) address the security responsibilities of the CISP as set out in Annex A (Security Responsibilities)." [1]

I do not know about others certifications, but this situation seems to be a clear violation of one of the requirement for CISP. Answer to this requirement is disk encryption. Moreover they are authorized to store medical records and data. I can't imagine that they do this without providing proper disk encryption. in the light of this event, I'm not sure they qualify for all these ceertifications.

[0] https://www.scaleway.com/fr/a-propos/

[1] https://cispe.cloud/code-of-conduct/

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#20

Post by raverbashing »

The things that are not clear to me are:

- Why was the disk being replaced (SMART warnings? HW upgrade? It failed in some way)

- Why was the quick format recoverable? Was TRIM issued or the HW didn't support it?

- As a follow up, I'm guessing the HW didn't support HW encryption?

- Why are they relying on 3rd parties for the destruction of data?

Meanwhile, it seems that HDs don't leave Google datacenters in one piece

Post reply on HN