Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

31–40 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#31

Post by jdhore »

thehermit wrote: post #27

The chatlog does provide some evidence that it is indeed the hacker, but does little to convince me that he got CC info and Linode is not telling us the whole truth. The evidence he provides is just simple source code snips and the directory listing, which would be expected based on what Linode has told us. This could very well be the hackers own submission to /. trying to get more attention for his hack by claiming…

I know the /. submitter (As he's the one who told me he submitted it to /. and he had the first /. link I saw), he's definitely NOT the hacker.

Re: Linode hacked, CCs and passwords leaked

#32

Post by tptacek »

127001brewer wrote: post #22
tptacek wrote: post #10

Earlier quoted context omitted.

It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.

A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion: "This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387). "This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)." http://www.adobe.com/support/security/bulletins/a…

Yep that's bad.

Re: Linode hacked, CCs and passwords leaked

#33

Post by ricardobeat »

gbuckingham89 wrote: post #29
toomuchtodo wrote: post #26

Earlier quoted context omitted.

Using a processor who stores the card number outside of your infrastructure (ie. Stripe) can also be helpful.

Until they have a security breach.

Better rely on someone who's sole job is securing that info than doing it yourself.

Re: Linode hacked, CCs and passwords leaked

#34

Post by pibefision »

I had a VPS on linode.

I think that Linode did a big mistake here. Let's wait for a formal communication.

But this is the moment to support them. Yes, maybe sounds crazy.

When you host on any third party datacenter, you take risks that something like this could happen. So, deal with it. Check your credit card, if your receive something wrong, call to your card and that's all. But we need to support also the good work, and this guys do great work in the hosting business. Just my opinion.

Re: Linode hacked, CCs and passwords leaked

#35

Post by lawnchair_larry »

thehermit wrote: post #27

The chatlog does provide some evidence that it is indeed the hacker, but does little to convince me that he got CC info and Linode is not telling us the whole truth. The evidence he provides is just simple source code snips and the directory listing, which would be expected based on what Linode has told us. This could very well be the hackers own submission to /. trying to get more attention for his hack by claiming…

Doubting the claims of a hacker after it's known that they compromised a system is really bad OpSec. Consider everything burned.

Re: Linode hacked, CCs and passwords leaked

#36

Post by dom96 »

danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Here is what Linode replied to me when I asked them about that chat log in a support ticket:

  Hello,
  
  Thank you for reaching out. We appreciate and understand your concerns. At this time the evidence suggest that this activity was targeting a specific customer. We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation.
  
  We have no comment regarding ryan*'s comments in #linode. You are of course free to take any steps you deem prudent or necessary to ensure the integrity of your online presence.
  
  I am sorry that we cannot provide more information at this time. As always feel free to contact us at any time with any future concerns.

  Regards,
  Quintin

Re: Linode hacked, CCs and passwords leaked

#37

Post by akennberg »

Love the whole side discussion about bitcoin from the supposed attacker:

06:07 They say there's no 'central weak point'

06:07 Yeah there is, there's the developers

06:08 There's been bugs in the client that have allowed the blockchain to split previously

06:08 One could just backdoor the bitcoin client binaries, not the source.

06:08 Nobody would figure it out until it's too late

http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Re: Linode hacked, CCs and passwords leaked

#39

Post by pibefision »

ConceitedCode wrote: post #24

If this is true then all the trust that Linode has built up over the years was just thrown out the window. According to the hacker they've known for 2 weeks and made a deal with the hackers. Ultimately, they were as far from transparent as it gets and on top of that they did a horrible job with their security. Hopefully, they own up and start being transparent. If this is true then what alternative hosts should I loo…

Don't be so logical please. This can happend to anyone in the industry.

Re: Linode hacked, CCs and passwords leaked

#40

Post by Thebigcheeze »

jlgreco wrote: post #13
danso wrote: post #6

From a purported abridged chatlog with the alleged hacker: > 05:42 credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security > 06:00 They did try to encrypt them, but using public key encryption doesn't work if you have the public and private key in the same directory http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

Wouldn't doing that be a massive PCI violation? Aren't there extensive audits for this sort of thing?

Companies are split into PCI Levels based on how much money/customers they handle. Level 1 are big companies like amazon, level 2 are medium sized online retailers generally, and level 3 are smaller retailers.

The 'lower' your level, the easier the PCI audits are. If you are level 1 you have mandatory external audits. If you are level 2 you have a 'self assessment' which is basically a checklist which says "Yes, I promise I'm in compliance".

If you have a confirmed breach, you are upgraded to Level 1 merchant audit requirements. This is generally quite costly as the external audit is extensive and must be paid for.

Post reply on HN