Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

Post reply on HN
Print view View original

81–90 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#81

Post by icebraining »

shirro wrote: post #72

Linode compromised! That is important news that concerns me. If the headline didn't mention the BitCoin scam that HN is always pumping would it have made it to the front page? Certainly haven't heard anything from Linode :-(

Sigh. Please give me a definition of 'scam' that fits with bitcoin and not e.g. Apple or Google shares.

Hint: In a scam, there's deceit. The bitcoin devs never deceived anyone. The whole system is transparent, so if there's anyone who bought without understanding the risks, they have no one to blame but themselves.

(Note: No, I don't own any bitcoins).

Re: Compromised Linode, thousands of BitCoins stolen

#83

Post by redthrowaway »

mmaunder wrote: post #28
stevenbrianhall wrote: post #7

Earlier quoted context omitted.

Regarding #1, an update from Linode was just posted: "Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."

I'm a Linode fanboy, but we need maximum transparency on what occurred and what's being done. What support interface? How compromised? Who's credentials, etc.

Hopefully they're working on it, and will give a post mortem once they get it sorted out. I'm inclined to show patience and not demand they do anything other than ascertain the scale of the breach, alert those affected, and secure their systems at this point. Later, they can get into what happened and how they will avoid it in the future.

Re: Compromised Linode, thousands of BitCoins stolen

#84

Post by darklajid »

icebraining wrote: post #70
darklajid wrote: post #60

Earlier quoted context omitted.

Show me your wallet with a good amount of cash and leave the room for a while. Afterwards, let's talk about your comparison. Is 'can be stolen' really something that the state can protect you against? Let's discuss it over dinner. Depending on the contents of the wallet I'd pay. On a more serious note: Your mockery, while amusing, is unrelated to the problem at hand. 'Stealing amounts of $currency from private person…

What state? PCI DSS is private regulation.

Two problems.

1) I don't think PCI is relevant here. If you store bitcoins somewhere and they get stolen then this is, in my world, cash. It's your very own digital cash. Not a credit card. That's why I constructed a (probably poorly implemented) example of someone leaving a wallet full of shiny $currency notes out there.

2) 'What state?' WTH? Can I reply with 'What kind of question is that?' The state I'm coming from is called 'Northrhine-Westfalia' [1]. Now I'm living elsewhere and there are no 'states' here. I can offer the district 'Tel-Aviv'? The point is, 'what state' is invoking aggressive feelings towards your US-centered mindset.

1: https://en.wikipedia.org/wiki/Northrhine-Westfalia

Re: Compromised Linode, thousands of BitCoins stolen

#85

Post by javascriptlol »

polemic wrote: post #75
liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

This is why insurance exists. I wonder if there are any insurance providers who'd be willing to provider coverage for this sort of event.

Exactly. The attitude of pushing more and more trust onto the provider is just going to cause bigger blowups when something inevitably goes wrong.

Re: Compromised Linode, thousands of BitCoins stolen

#86

Post by sgornick »

klodolph wrote: post #80
darklajid wrote: post #39

Earlier quoted context omitted.

I'd argue this isn't about bitcoins. A (popular) VPS provider, according to that article, had a security problem that allowed some idividuals to access the VPS management interface for any machine they cared for. They could've defaced your site in high traffic times. They could've logged in and delete your projects on the VPS. Depending on your setup (they had root) they could've searched for your backups. They could…

It's not about "don't put anything on a VPS", it's about "don't put money on a VPS."

Or passwords, or medical records, or anything confidential or of value?

Re: Compromised Linode, thousands of BitCoins stolen

#87

Post by tlb »

wheels wrote: post #79
luser001 wrote: post #6

Hmm, for a customer of a cloud provider, this sort of thing will be very hard to defend against. Maybe if the customer service system had had two-factor security, this might have been avoided (i.e., customer service can access your account only if you read them your hardware token's code). Requiring SSL/SSH client certificates even for intranet accesses might have deterred this attack. I hope other cloud providers ta…

Actually not. Just use a loopback cypto FS to store the sensitive stuff. The reason they had to reboot the machine is that they just had access to the HDD where they could change the password, as opposed to having live root access.

Indeed. Well-designed money storage systems aren't vulnerable no matter who has console access.

Re: Compromised Linode, thousands of BitCoins stolen

#88

Post by wmf »

opendomain wrote: post #43

I know that bit pin is supposed to be annonomous but is there any way to get these back? I mean is there some logs or if they were signed by his account or anything?

All Bitcoin transactions are publicly logged, but they aren't reversible. So you can see who stole your money but you can't do anything about it.

Re: Compromised Linode, thousands of BitCoins stolen

#89

Post by ohgodthecat »

lawnchair_larry wrote: post #44
3pt14159 wrote: post #24

Earlier quoted context omitted.

Simplest answer is probably the right one in this case: Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it…

Sorry, there is just no way that this is the case. Please don't throw such a serious allegation out there without any evidence. To even suggest that this is technically possible for an employee to do is a serious allegation, let alone suggesting that someone did it maliciously. This spreads all kinds of FUD. I'll happily eat my words if that turns out to be what happened, but it is definitely not the simplest answer.

> To even suggest that this is technically possible for an employee to do is a serious allegation

It is technically possible for an employee to do it because it seems (from the linked pastebin above) that is how it was compromised, an elevated account for linode manage was compromised.

As for an employee being the one that did it, that is probably the least likely cause.

Re: Compromised Linode, thousands of BitCoins stolen

#90

Post by mappu »

pork wrote: post #67
clarkmoody wrote: post #61

Earlier quoted context omitted.

The article mentions salted SHA-1, which is much more resistant to attack. Obviously, more rounds and unique salts per user would yield better results, regardless of the hashing scheme employed.

You can salt all you want, but an 8 character password with a single round is going to fall very, very fast. Salt, being public, has nothing to do with it.

It does however mean you have to spend two days per password, rather than two days for the entire user base, or ten minutes with a pre-existing lookup table.
Post reply on HN