Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

Post reply on HN
Print view View original

121–130 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#121

Post by darklajid »

TomGullen wrote: post #101
darklajid wrote: post #95

Earlier quoted context omitted.

I'm sorry, but you just said the same thing again that I was arguing against. 'Money' is not as clear cut as you'd like it to be. Bitcoins are no real recognized currency. So you can trade them for USD -> Don't store it? What about this great project I'm working on? All my stuff on the VPS, because that's convenient and accessible from everywhere. I spent a double digit number of days on it. I have a daily rate for w…

Bad comparison in my opinion, BitCoins can be stolen (taken away and become unrecoverable) whilst your project you've been working on is recoverable. Also the value something is worth is what someone else will pay for it. You can't value a project you're working on as your hourly rate * hours worked, it doesn't really work like that.

1) Recoverable: Only if I have backups (which I excluded in my comparison, and would be a fault on my side. But go with me here..). Otherwise I'd need to invest (see the word I used here?) time to create it from scratch. That's equivalent to an amount of money (the exact amount is hard to define, granted).

2) 'You can't value a project you're working on as your hourly rate * hours worked, it doesn't really work like that.' Right. But it's totally okay to value ~worthless~ stuff you have according to market rates, although you didn't sell them yet? Why are we talking about ~12k USD here? That's just a couple of bits and bytes on a disk. Yes, he _could've sold_ that at a specific time for a specific amount equaling ~12k USD. He didn't. Why do you assign this value to a highly fluctuating 'currency' on your disk, but don't like me assigning value to a 'yet to be successful' project on disk?

Re: Compromised Linode, thousands of BitCoins stolen

#122

Post by RLG_RLG »

lsc wrote: post #113
kbuck wrote: post #112

Earlier quoted context omitted.

You memorize it.

how do you transmit it to the server in such a way that it can't be intercepted by someone that compromises the bits of your virtual that boot before the key is uploaded?

By using your public key.

http://www.debian-administration.org/articles/152

You can also require a password AND a cert.

Re: Compromised Linode, thousands of BitCoins stolen

#123

Post by epochwolf »

ceejayoz wrote: post #74
nirvdrum wrote: post #68

Earlier quoted context omitted.

Amazon getting a PCI compliance pass was a big deal. The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised.

> The last time I looked, you needed to be able to ensure secure access to the facility, enumerate who has physical access to the hardware and when, and things of that effect. And you need to be able prove all that in the event you're ever compromised. None of that should be particularly difficult for a VPS provider as large as Linode.

> you needed to be able to ensure secure access to the facility

This part isn't doable if you don't own the datacenter. Slicehost has a problem with this because they never owned the datacenters they used.

Re: Compromised Linode, thousands of BitCoins stolen

#124

Post by RLG_RLG »

lawnchair_larry wrote: post #44
3pt14159 wrote: post #24

Earlier quoted context omitted.

Simplest answer is probably the right one in this case: Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it…

Sorry, there is just no way that this is the case. Please don't throw such a serious allegation out there without any evidence. To even suggest that this is technically possible for an employee to do is a serious allegation, let alone suggesting that someone did it maliciously. This spreads all kinds of FUD. I'll happily eat my words if that turns out to be what happened, but it is definitely not the simplest answer.

Inside job is usually the answer for targeted attacks against inside systems. Inside collusion at a minimum.

I wonder how anyone can trust their linode systems after an admin account being compromised.

It would likely ruin their business to re-install everything, but that is the only way to know root kits have not been installed.

Re: Compromised Linode, thousands of BitCoins stolen

#125

Post by darklajid »

icebraining wrote: post #109
darklajid wrote: post #84

Earlier quoted context omitted.

Two problems. 1) I don't think PCI is relevant here. If you store bitcoins somewhere and they get stolen then this is, in my world, cash. It's your very own digital cash. Not a credit card. That's why I constructed a (probably poorly implemented) example of someone leaving a wallet full of shiny $currency notes out there. 2) 'What state?' WTH? Can I reply with 'What kind of question is that?' The state I'm coming fro…

Oh, FFS. I meant "what state?" as in, "why are you talking about the state?", since you said: (...) something that the state can protect (...) and since the PCI (which was what we were talking about) is private , it doesn't make sense to talk about the State. US-centered mindset The fuck? Firstly, I'm European. Secondly, I assumed you were talking about the State[1], not a particular state. [1]: https://en.wikipedia.…

First and foremost: I'm sorry. We clearly didn't talk about the same thing and I misunderstood what you wrote.

My take: Someone was mocking Bitcoins with "But all that regulation is evil and it's the freedom of bitcoin that gives it the power" and I tried to make a point saying that _no regulation is involved here_ (laws? certainly). This is a wallet, it got stolen. Your credit cards are protected, your cash is gone for good.

You invoked PCI and I was (and am) unable to make the connection, maybe again because of a misunderstanding? I'm talking cash. Bitcoins are cash in my world (or - at least their value is equivalent to cash, if you choose to sell them).

From there we went downhill and I overreacted. Yes, for me 'state' is exactly what you posted. Again, sorry for the lapse.

Re: Compromised Linode, thousands of BitCoins stolen

#126

Post by lsc »

RLG_RLG wrote: post #122
lsc wrote: post #113

Earlier quoted context omitted.

how do you transmit it to the server in such a way that it can't be intercepted by someone that compromises the bits of your virtual that boot before the key is uploaded?

By using your public key. http://www.debian-administration.org/articles/152 You can also require a password AND a cert.

Yes, but will that help you if the attacker trojans whatever it is that is doing the decryption?

I mean, I'm very clearly not a crypto expert, but I do believe that this would be quite a lot like what Bruce Schnier calls 'the evil maid' attack. Instead of having a bootloader, you have a minimal Linux install, then you get a key to that minimal linux install, and that minimal linux install uses that key to decrypt your encrypted disk.

I believe that if that minimal linux install that does the decrypting is compromised before you log in, in theory, the attacker could then insert something in the code that runs after the data is decrypted to, say, send some of that data elsewhere, or, say, open a back door for them to log in and examine the decrypted data.

I mean, certainly, you are making the attacker wait for you to log in (assuming that they've only compromised the admin interface and don't have full root on the dom0) and that's another step you are forcing the attacker to take, and you do at least have a chance then of detecting the compromise and /not/ sending the key, so I'm not saying that it's worthless.

Of course, this is all protecting against a compromise of the admin tools that does not lead to a compromise of the dom0. If the attacker compromises the dom0 without rebooting it or otherwise disturbing the guests? they have access to your ram. They can snapshot both the ram and the disk and take apart the system at their leisure.

Re: Compromised Linode, thousands of BitCoins stolen

#128

Post by nknight »

lawnchair_larry wrote: post #44
3pt14159 wrote: post #24

Earlier quoted context omitted.

Simplest answer is probably the right one in this case: Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it…

Sorry, there is just no way that this is the case. Please don't throw such a serious allegation out there without any evidence. To even suggest that this is technically possible for an employee to do is a serious allegation, let alone suggesting that someone did it maliciously. This spreads all kinds of FUD. I'll happily eat my words if that turns out to be what happened, but it is definitely not the simplest answer.

You can't secure against God. Of course it's technically possible for a Linode employee to do.

Re: Compromised Linode, thousands of BitCoins stolen

#129

Post by devicenull »

slig wrote: post #100
darklajid wrote: post #91

Earlier quoted context omitted.

>Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets? The way I understand it the attackers were able to get access to the admin panel and invoked some kind of 'change root password' emergency stuff. The machines were rebooted it seems, which makes sense: The interface of Linode has probably/hopefully no access to t…

I disabled root login when I was setting up the server. Could my server be affected too? Also admins that only log with ssh keys and don't use root won't be able to notice that, will they?

Probably. You disabled root login how, via the sshd_config file? If so, you're still screwed.

Even if you fully disable root, that's not going to stop the init=/bin/sh script.

Even if you fix that (securing grub?) you're still screwed because it's a virtual machine, and they can just mount the partition to another VM, and pull all your data/reset root that way.

So, maybe if you have an encrypted partition, no root access, secure grub, and real hardware (it's probably possible to dump the VMs memory by snapshotting it, then pulling the key out that way), you would be secure against attacks like this.

With a VM? No, it's not nearly secure enough for very important things.

Re: Compromised Linode, thousands of BitCoins stolen

#130

Post by draebek »

darklajid wrote: post #91
mindstab wrote: post #16

How did the attackers know what they were looking for. I'm going to assume that it's a small minority of linode users who have bitcoins on their machines. How were just these users targeted so accurately? What tied together knowledge they used bitcoins to those VMs and their linode accounts? Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines…

>Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets? The way I understand it the attackers were able to get access to the admin panel and invoked some kind of 'change root password' emergency stuff. The machines were rebooted it seems, which makes sense: The interface of Linode has probably/hopefully no access to t…

I would not be surprised if the Linode "reset root password" function shuts down your VM, mounts the filesystem directly on the host, and edits /etc/shadow, and maybe the PAM configs if they're feeling real nice. Using something we can't mount (e.g. encrypted)? Not using /etc/shadow nor PAM? Sorry, we can't help you beyond advising you try and reboot in single user and ssh in to your VM console.
Post reply on HN