Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

21–30 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#21

Post by pointyhatuk »

jlgreco wrote: post #13
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?

Err no. PCI DSS is basically farts in the wind. Its beyond useless and the testing agencies are all snake oil salesmen.

Re: Linode hacked, CCs and passwords leaked

#22

Post by 127001brewer »

tptacek wrote: post #10
Tomdarkness wrote: post #8

Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day. If the hacker's claims are true (Would appear so, the directory listing checks out) then Linode really need to address this ASAP. Passwords are one thing but to have CC details leaked is even worse. I'm not familiar with CC processing but it seems like bad practice to store the encryption keys on the web se…

It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.

A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion:

"This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387).

"This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)."

http://www.adobe.com/support/security/bulletins/apsb13-10.ht...

Re: Linode hacked, CCs and passwords leaked

#23

Post by toomuchtodo »

jlgreco wrote: post #13
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?

I've done PCI "audits" for several companies I've worked for; it's a checklist you go down yourself. That's why its called a "pci self assessment".

Re: Linode hacked, CCs and passwords leaked

#24

Post by ConceitedCode »

If this is true then all the trust that Linode has built up over the years was just thrown out the window. According to the hacker they've known for 2 weeks and made a deal with the hackers. Ultimately, they were as far from transparent as it gets and on top of that they did a horrible job with their security.

Hopefully, they own up and start being transparent.

If this is true then what alternative hosts should I look at, besides AWS?

Re: Linode hacked, CCs and passwords leaked

#25

Post by FlyingAvatar »

jlgreco wrote: post #13
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?

Most PCI audits are not mandatory unless you have had a breech that compromises data. Before that "self-certification" reigns.

Re: Linode hacked, CCs and passwords leaked

#26

Post by toomuchtodo »

pointyhatuk wrote: post #19
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

That's totally shit. Its also why we invoice and take wire payments rather than storing CC details. There's just so much to go wrong. Also PKI is shit for this sort of thing. As demonstrated, the moment that public key is gone, then the whole system falls like a house of cards. For the non believers of this fact, why else would there be a certificate revocation list and root CA updates for windows periodically...

Using a processor who stores the card number outside of your infrastructure (ie. Stripe) can also be helpful.

Re: Linode hacked, CCs and passwords leaked

#27

Post by thehermit »

The chatlog does provide some evidence that it is indeed the hacker, but does little to convince me that he got CC info and Linode is not telling us the whole truth. The evidence he provides is just simple source code snips and the directory listing, which would be expected based on what Linode has told us.

This could very well be the hackers own submission to /. trying to get more attention for his hack by claiming he has CC numbers which I doubt he has.

Re: Linode hacked, CCs and passwords leaked

#29

Post by gbuckingham89 »

toomuchtodo wrote: post #26
pointyhatuk wrote: post #19

Earlier quoted context omitted.

That's totally shit. Its also why we invoice and take wire payments rather than storing CC details. There's just so much to go wrong. Also PKI is shit for this sort of thing. As demonstrated, the moment that public key is gone, then the whole system falls like a house of cards. For the non believers of this fact, why else would there be a certificate revocation list and root CA updates for windows periodically...

Using a processor who stores the card number outside of your infrastructure (ie. Stripe) can also be helpful.

Until they have a security breach.

Re: Linode hacked, CCs and passwords leaked

#30

Post by Tomdarkness »

danso wrote: post #15
Tomdarkness wrote: post #8

Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day. If the hacker's claims are true (Would appear so, the directory listing checks out) then Linode really need to address this ASAP. Passwords are one thing but to have CC details leaked is even worse. I'm not familiar with CC processing but it seems like bad practice to store the encryption keys on the web se…

Was it a 0-day? The purported linode chatlog makes it sound like poorly configured CF: http://turtle.dereferenced.org/~nenolod/linode/linode-abridg... --------- 05:43 Well linode also had terribly configured coldfusion 05:57 05:57 this code 05:57 It's so dirty I feel bad reading it

I've never used CF so someone correct me if I'm wrong but I just read that code as rendering the navigation bar in the members area?

Also if you check out my reply below I've C&P'ed the chat logs where he claims it is a zero day:

https://news.ycombinator.com/item?id=5552992

Plus another commenter has linked to a security advisory for exploits in CF that was issued a few days ago.

Post reply on HN