Compromised Linode, thousands of BitCoins stolen
bitcoinmedia.com
Compromised Linode, thousands of BitCoins stolen
1–10 of 249 posts
Re: Compromised Linode, thousands of BitCoins stolen
#2Forum thread regarding this: https://bitcointalk.org/index.php?topic=66916.40;all
Re: Compromised Linode, thousands of BitCoins stolen
#3So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind:
1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well?
2. Why can customer service representatives access and update servers without the client being notified and with minimal logging?
Re: Compromised Linode, thousands of BitCoins stolen
#4Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.
Re: Compromised Linode, thousands of BitCoins stolen
#5I'm not really sure why people are trying to store bitcoins on a VPS in the first place. You can't process credit cards on a VPS and be PCI compliant (it's against the rules), but any moron can do what they want with bitcoins.
Re: Compromised Linode, thousands of BitCoins stolen
#6Hmm, for a customer of a cloud provider, this sort of thing will be very hard to defend against.
Maybe if the customer service system had had two-factor security, this might have been avoided (i.e., customer service can access your account only if you read them your hardware token's code).
Requiring SSL/SSH client certificates even for intranet accesses might have deterred this attack.
I hope other cloud providers take note of this incident. This is a very interesting incident.
Re: Compromised Linode, thousands of BitCoins stolen
#7So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind: 1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well? 2. Why can customer service representatives access and update servers without the client being no…
Regarding #1, an update from Linode was just posted:
"Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."
Re: Compromised Linode, thousands of BitCoins stolen
#8Hmm, for a customer of a cloud provider, this sort of thing will be very hard to defend against. Maybe if the customer service system had had two-factor security, this might have been avoided (i.e., customer service can access your account only if you read them your hardware token's code). Requiring SSL/SSH client certificates even for intranet accesses might have deterred this attack. I hope other cloud providers ta…
> customer service can access your account only if you read them your hardware token's code
At the very least, I'd hope Linode implements two-factor authentication for their own logins. A customer-provided OTP would be great but you'd need a customer service reset tool for that when people forget, which would put you back where you started...
Re: Compromised Linode, thousands of BitCoins stolen
#9Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.
You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up.
A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.
Re: Compromised Linode, thousands of BitCoins stolen
#10The writeup of this is rather suspect. What happened is someone guessed slush's Linode account password, and used the root password reset feature from there.
What I don't understand is why does such a feature exist, why doesn't Linode require >16 character length passwords that are sufficiently random (or eschew password auth altogether), and why does slush (apparently from what I can tell) allow password auth for ssh AND allow root to login on ssh.