Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

Post reply on HN
Print view View original

191–200 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#191

Post by 3pt14159 »

dekz wrote: post #63
ben0x539 wrote: post #41

> Although passwords are stored using SHA1 with a salt, Where's the bcrypt/scrypt/whatever police in this comments thread?

Well using SHA1 with a salt is a lot closer to bcrypt than plaintext or encrypting the passwords.

In my opinion it is not. Here is the common use case for people: 66% of them use 8 character or less passwords. Forget about the common longer passwords like "letmeinplz" just doing a brute force would give them 66%. In terms of loss, even 1% of passwords being compromised is bad since many people use the same password for multiple things.

Now, how long would it take for people to take down bcrypt? in the scale of time bcrypt is all the way over there -> from SHA1 and cleartext. Bcrypt will protect you even as computers get faster. SHA1 a couple decades from now will be be compromised for 9 or maybe even 10 characters. No way with bcrypt.

Re: Compromised Linode, thousands of BitCoins stolen

#193

Post by nknight »

marshray wrote: post #145
RLG_RLG wrote: post #133

Earlier quoted context omitted.

I advise you seek the services of a professional sys admin to secure systems.

He's right though. I don't think I've ever met a professional sysadmin who could defeat the evil maid attack. All the ones I've met would refuse to think about an attack vector if it implied they could not boot their servers.

Yep. Classically, we abdicate responsibility as soon as physical security is breached. With virtual machines the problem is mostly the same, but it moves from "true physical" to "virtual physical" -- once the host environment is breached, all bets are off.

Any sysadmin that claims to be able to protect against a physical access attack or its contextual equivalent is either lying or incompetent. In neither case should that sysadmin be considered "professional".

Re: Compromised Linode, thousands of BitCoins stolen

#195

Post by [deleted] »

RLG_RLG wrote: post #133
lsc wrote: post #126

Earlier quoted context omitted.

Yes, but will that help you if the attacker trojans whatever it is that is doing the decryption? I mean, I'm very clearly not a crypto expert, but I do believe that this would be quite a lot like what Bruce Schnier calls 'the evil maid' attack. Instead of having a bootloader, you have a minimal Linux install, then you get a key to that minimal linux install, and that minimal linux install uses that key to decrypt you…

I advise you seek the services of a professional sys admin to secure systems.

[deleted]

Re: Compromised Linode, thousands of BitCoins stolen

#196

Post by jQueryIsAwesome »

wmf wrote: post #88
opendomain wrote: post #43

I know that bit pin is supposed to be annonomous but is there any way to get these back? I mean is there some logs or if they were signed by his account or anything?

All Bitcoin transactions are publicly logged, but they aren't reversible. So you can see who stole your money but you can't do anything about it.

There is a bunch of violent people who would disagree.

Re: Compromised Linode, thousands of BitCoins stolen

#197

Post by larrys »

tylermenezes wrote: post #170
tadfisher wrote: post #138

Earlier quoted context omitted.

I'd say this is more akin to stashing a bunch of money in a self-storage unit instead of a bank account. One explicitly insures against theft, the other does not. The onus is on you as a customer to decide what to go with.

> One explicitly insures against theft, the other does not. I'd take issue with that summary. If I put things in a self-storage unit, and it gets robbed because some employee left his master key under the door mat, regardless of how bad of an idea it was to store my money there, that's still their issue. Think about it this way. I could store my money under a table at McDonald's, in a self-storage unit, or in a bank.…

"So when an attacker gets access through some really trivial method that they really should be protected against, that's their fault"

A good point but keep in mind that courts don't have the level of expertise to judge what in terms of security is trivial and what is not.

The person trying the case and/or the jury may very well be someone who uses "football" as a password.

Also there are multiple cases of the very best companies with supposedly the highest levels of security getting hacked on a regular basis (might be a small percentage but it always makes the news). Consequently any company defending could make an argument that "this stuff happens even with the best and brightest" and it might be believed. (Well anyway that's what I would argue if I was a lawyer..)

So the public could easily be convinced in the case of a technology company something that would never fly as far as a screwup at the self storage - something physical that they can relate to (like leaving a door unlocked which is easy to understand).

Re: Compromised Linode, thousands of BitCoins stolen

#198

Post by larrys »

eli wrote: post #156
larrys wrote: post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

I can put a "not responsible for stolen items" sign in my restaurant, but if the coat check employee bolts out the door when you hand them your coat, I'm buying you a new one.

Sure but there is legal precedent for that as well as it's an easy concept for the everyday man to understand. (Employee and seeing them makes it a open and shut case.)

As an aside, signs like that are the same as ones that appear in auto shops that say "insurance regulations don't allow you in the shop". I owned a company that did manufacturing and said a similar thing because I didn't want anyone in the machine area. I've dealt with insurance companies for many years they don't dictate things like that at least from my experience.

Your example is correct though the restaurant would be liable in the situation you cited because you actually saw an employee steal the coat. If you saw someone else NOT connected to the restaurant AND the coat was expensive you are probably out of luck. It's your property and there is no assumption that a restaurant protects you from acts of god.

The key is was their negligence on the part of the restaurant.

On the other hand if there was a large party at the restaurant and normally a coat check girl that's a different story (devils in the details with this stuff).

Re: Compromised Linode, thousands of BitCoins stolen

#199

Post by larrys »

chc wrote: post #165
bigiain wrote: post #160

Earlier quoted context omitted.

Yeah, but could the (ex) coat owner hold the restaurant's landlord liable? Isn't it the restaurant _managers_ problem? I think there's a _lot_ of "grey areas" here, and while I feel sympathy for the guy who's out ~$13k worth of bitcoins, I can't help but think he was "doing the wrong thing" relying on the security of an inexpensive vps to keep them safe…

What would you recommend? Would you say the same thing if he'd been colocating and a data center employee had stolen his bitcoins? Because that seems far more analogous than any restaurant analogy, and I don't see any reasonable way for somebody who's not a huge corporation to avoid this kind of risk. You have to trust somebody at some point unless you're keeping the server locked in your own closet. It seems really…

Would have to meet several tests. 1) Hosting company knew and agreed to the value of the things they had control over. 2) Employee did it and they were negligent in hiring that individual. 3) Reasonable and customary for that type of stuff to be in that situation given pricing and the practices of others.

With respect for #3 it would be reasonable for a bank safe deposit box to contain a $100,000 ring maybe but not to contain a 10,000,000 ring.

Re: Compromised Linode, thousands of BitCoins stolen

#200

Post by larrys »

dave_sullivan wrote: post #134
larrys wrote: post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

It's certainly a grey area, but at what point is it safe to assume that if you get hacked, it's not going to be because your ISP got hacked? Say this happened to Amazon and it affected a company like Heroku or dropbox, both users of AWS? Regardless of what terms of service says, I'll bet there's some liability somewhere. And if there's a cut off, maybe linode should advertise that? "Hey, we're cheap, but you get what…

"And if there's a cut off, maybe linode should advertise that? "Hey, we're cheap, but you get what you pay for!" rather than "You're getting ripped off if you go with amazon over linode!""

Well of course that's never going to happen and the truth is the contracts of the more expensive provider no doubt also limit liability. (And all of this is in the TOS/contract etc). So what we are really talking about is who will do a better job protecting what you have AND more importantly who has more to loose if they screw up. (Small linode has more to loose but they also don't have deep pockets to pay. Amazon has deep pockets but access to magnitudes greater legal help to prevent having to pay.)

Post reply on HN