Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

theregister.com

Post reply on HN
Print view View original

41–50 of 50 posts

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#41

Post by gnufx »

jtchang wrote: post #27
rkeene2 wrote: post #24

Earlier quoted context omitted.

When I ran a cloud provider, we used a hardware security module on storage systems which had public/private key pair which could be used to decrypt the header on the disk which contained a copy of the symmetric cipher key. Each header had the symmetric cipher key encrypted with multiple different public keys, including a fallback whose private key only existed in on paper in a vault. Each system could reach out to ot…

Is there anything on the consumer level like this?

Purism will sell you a setup with the Librem laptop and hardware key, which has some verification of the system firmware as well as, presumably, supporting disk decryption. I'm not sure how much extra that gives you over fairly generic hardware tokens with LUKS encryption. Apparently LUKS2 supports FIDO2 keys, which may be the cheapest.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#42

Post by gnufx »

jcynix wrote: post #39
Nextgrid wrote: post #26

Earlier quoted context omitted.

It's not trivial when it comes to a server. Sure, you can tick that checkbox you'll enable encryption, but when you reboot you realize that you can't actually SSH in it, as it's waiting for a key to be entered on the physical console. Entering (and managing) that key is the hard part.

That's what Dropbear is supposed to do, it can be included in the initramfs of a server: https://matt.ucc.asn.au/dropbear/dropbear.html Disclaimer: I still didn't try it myself yet, but it's on my (too long) list of things to do.

[I don't think it has to be dropbear specifically.] https://nixos.wiki/wiki/Remote_LUKS_Unlocking has a recipe also including Tor. You still have to be present to unlock the system, unlike with Mandos -- which I wish I'd been able to set up for our office, even before the Great Work From Home.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#43

Post by rasz »

djrogers wrote: post #23
rasz wrote: post #18

Earlier quoted context omitted.

>it was quick-formatted are there OSes that perform quick format without issuing TRIM command to the SSD? TRIM would vanish the data in less than 15 minutes.

Yes, 15 minutes is not 'quick' by most standards - quick formats take seconds, not minutes.

up to ~15 minutes is not the time it takes to quick format, its the number Iv seen during testing of TRIM, the time it took to internally erase translation table after format command.

There should be NO DATA on the drive if it was really formatted on OS supporting TRIM.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#44

Post by fomine3 »

rasz wrote: post #18
terom wrote: post #6

Earlier quoted context omitted.

Based on links in the other hackernews thread, it was quick-formatted, but a filesystem containing qemu disk images was recovered: [1] The YouTube video is in French without English CC subtitles, but there's screenshots of exploring what I assume would be one of the qcow images: [2] * 03:59 `/root/.ssh` with SSH id_rsa (private) keys, (public) authorized_keys and (hashed) known_hosts * 07:14 server binaries * 08:42 s…

>it was quick-formatted are there OSes that perform quick format without issuing TRIM command to the SSD? TRIM would vanish the data in less than 15 minutes.

I believe parted won't issue TRIM for whole disk/partition after erasing partition table or partition. Possibly mkfs.xfs issues TRIM? I don't know.

Anyway, what they should at least is just issue `blkdiscard /dev/sdb`, or betterly Secure Erase (on SATA) or Sanitize (on NVMe).

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#46

Post by madaxe_again »

unilynx wrote: post #17
madaxe_again wrote: post #16

Earlier quoted context omitted.

They say they’re iso27001 compliant and certified. If they aren’t encrypting in transit, it’s hard to see how they actually can be.

Are you sure they're actually saying that? A lot of hosting providers actually say that their data centers are ISO 27001 compliant, but that doesn't make the provider itself compliant (and it seems scaleway is still doing that too on https://www.scaleway.com/en/datacenter/ )

Well, that’s ridiculous - an asset cannot be compliant - an organisation, and their processes and controls are what are meant to be compliant.

If just their data centres are compliant, I guess there’s nothing to stop their staff or contractors just stealing data, as they have here - as compliance purely around physical security for a data centre is 100% meaningless if you’re just ignoring cryptographic controls and human security controls.

I’m guessing their certification body isn’t themselves certified. Actually, the fact that they neither say who their certifying body is nor include a link to their certificate, suggests to me that they are lying - which is far more common than you would think.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#47

Post by madaxe_again »

throwaway382985 wrote: post #31

I worked at scaleway. This whole post is basically bullshit, "secure" transporation meant taking a random electric car (renault zoe) at the company headquarters or at DC5 and throwing hardware in the trunk. No security in place whatsoever, servers laying in datacenter hallways fully loaded with disks, accessible to anyone. Most of the company had access to the back office where they could just access customers' data…

But they’re ISO27001 certified? Didn’t they have security controls for transit of protected information? What about human resource security?

What about their access control policy and network access control policy?

Do you know who their certifier is, as they don’t say, so I can ensure I never, ever trust them?

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#48

Post by madaxe_again »

vajenetehais wrote: post #19

On their website they refer to multiple certification [0]. One of them is the CISPE and on their website, it is stated: "Requirement for CISP: (a) Security measures The CISP will implement and maintain appropriate technical and organisational measures for the CISP’s data centre facilities, servers, networking equipment and host software systems that are within the CISP’s control and are used to provide the CISP’s ser…

It’s a total violation of about a third of the controls in ISO27001 Annex A. Whoever certified them needs looking at, as their certifications are valueless.

It’s possible scaleway aren’t certified, and are lying about it. Maybe they had an auditor in, maybe not, maybe they have a boatload of nonconformities that they’re not documenting (which you must, if you have them).

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#49

Post by throwaway293290 »

madaxe_again wrote: post #47
throwaway382985 wrote: post #31

I worked at scaleway. This whole post is basically bullshit, "secure" transporation meant taking a random electric car (renault zoe) at the company headquarters or at DC5 and throwing hardware in the trunk. No security in place whatsoever, servers laying in datacenter hallways fully loaded with disks, accessible to anyone. Most of the company had access to the back office where they could just access customers' data…

But they’re ISO27001 certified? Didn’t they have security controls for transit of protected information? What about human resource security? What about their access control policy and network access control policy? Do you know who their certifier is, as they don’t say, so I can ensure I never, ever trust them?

Another person that worked at scaleway here.

The whole ISO27001 thing is false advertisement, the scope is very restricted and scaleway, online.net, dedibox or whatever are NOT ISO27001 certified.

The certification only applies to a very restricted range of products which are not even pubicly available.

> What about their access control policy and network access control policy?

A joke, many critical services were only firewalled to the outgoing ip address of their corporate wifi network which practically anyone entering the building was given the password.

The private network on online.net dedibox offering was just ACLs that were applied with a loop on every switch without much error handling it happened that what was displayed on the console was not the real configuration applied to a switch. What a joke.

And this is just a starter, this kind of things goes on and on. Scaleway is a terrible company.

Re: SSD belonging to Euro-cloud Scaleway was stolen,then turned up on YouTube

#50

Post by unilynx »

madaxe_again wrote: post #46
unilynx wrote: post #17

Earlier quoted context omitted.

Are you sure they're actually saying that? A lot of hosting providers actually say that their data centers are ISO 27001 compliant, but that doesn't make the provider itself compliant (and it seems scaleway is still doing that too on https://www.scaleway.com/en/datacenter/ )

Well, that’s ridiculous - an asset cannot be compliant - an organisation, and their processes and controls are what are meant to be compliant. If just their data centres are compliant, I guess there’s nothing to stop their staff or contractors just stealing data, as they have here - as compliance purely around physical security for a data centre is 100% meaningless if you’re just ignoring cryptographic controls and h…

I assume they don't mean to refer to the physical building, but to the organisation responsible for the building and its physical security. Anyway that's a thing for auditors to have fun with (so you say you're hosting provider is certified, can you show me their certificate?) as you're not supposed to lean on their website information anyway.

I don't think many of the competitors in this space (eg Linode and DigitalOocean) own their datacenters either.

As Linode put it: Linode as an entity is not ISO27001 and we rely on the data centers we colocate with to obtain and maintain these certifications

Or DigitalOcean in 2017: Our FRA1 facility is ISO9001:2008, ISO27001:2005, and ISO22301:2012 certified.

(DigitalOcean later got their own certification)

Post reply on HN