Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

181–190 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#181

Post by kintamanimatt »

msbarnett wrote: post #135
xhrpost wrote: post #83

Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? The one number that uniquely identifies your account and everyone you want to re-use it has to keep a copy. Couldn't the credit card company issue some unique ID to each vendor for recurrent payments? Ex. the vendor issues your CC# to the CC Company for charge and recurring process. The CC Co…

> Off topic but still relevant, but doesn't it seem a bit primitive that companies have to store you CC# for recurring payments? You really really don't have to. Any payment processor that isn't horribly incompetent does the unique token authorization scheme. Storing CC #s for recurring payments is solely the domain of incompetents who have no business accepting payments from anyone.

What if you want to change processors? If you weren't storing the CC details, wouldn't you have to have customers enter all their details again? I imagine this could cause a drop in revenues due to people either forgetting, procrastinating, or just not bothering.

It's never cool to be actually- or quasi-locked into a vendor.

Re: Linode hacked, CCs and passwords leaked

#183

Post by inetsee »

xr09 wrote: post #90
stefantalpalaru wrote: post #51

Earlier quoted context omitted.

That's pretty much how trust works.

I'd give another trust vote to Linode, anyway this could happen to anyone.

It seems to me that the fundamental problem is not that they got hacked (although it seems that storing a decryption key in the same directory as the encrypted data is over the top careless), but their response to the disclosure that they got hacked. I realize that there may be limitations on exactly what they can say, but they should be as open as possible on what may have happened, what they are doing to protect their customers, and what their customers should do to protect themselves. Customers taking action when there wasn't a breach is less of a problem than not taking action when there was, in fact, a breach.

Re: Linode hacked, CCs and passwords leaked

#185

Post by carbocation »

biot wrote: post #159
sergiotapia wrote: post #45

So what happens now to all the goodwill Linode has amassed through the years? Does it all turn to shite, almost overnight? This sounds very very bad, and as a customer it's very off-putting.

[Warning: imperfect analogy follows.] It's one thing if Linode is like someone who gets drunk and crashes their vehicle. That's 100% their fault and they've burned any goodwill. In this case, however, Linode is like someone who was carjacked. Perhaps Linode shouldn't have been driving that type of vehicle in an area known to have people attempting to carjack every single vehicle that drives by. Perhaps they should ha…

This analogy is more confusing than illuminating.

If the allegations are true, then Linode was keeping encrypted CC numbers, with the decryption key in nearly the same place.

Trying to make the analogy more sufficient by incorporating this type of fact would only make the carjacking analogy more absurd. At the end of the day, an analogy is not needed.

Re: Linode hacked, CCs and passwords leaked

#186

Post by larrys »

psychometry wrote: post #97
tptacek wrote: post #18

Earlier quoted context omitted.

Extensive PCI audits. Heh.

That compliance web form I absentmindedly clicked through sure had a lot of buttons.

Can't think of the exact word to describe that practice (what you did in response to the long list of questions which I've seen) but on the part of the company requesting you to answer the questions it's more or less a "absence of malice" type of thing that allows them to appear that they are doing the right thing while fully knowing that people are doing what you are doing. It's a "we will look the other way until we need to show that it's not our fault because we have passed the liability to you - look you acknowledge doing all the right things".

Re: Linode hacked, CCs and passwords leaked

#187

Post by VMG »

tomjen3 wrote: post #58

To those of you who have claimed that your CCs have been abused -- I checked mine (which I used to pay for Linode) and it hasn't been used to do anything funny.

(not knowing anything) - wouldn't it be possible to give the cc company a white list of clients that can continue to use it and block all other requests?

Re: Linode hacked, CCs and passwords leaked

#188

Post by voidlogic »

windsurfer wrote: post #136
AlexMuir wrote: post #87

Ah this is so shit. I want to support Linode, I've had nothing but a good experience. But I just had to check my credit card to be sure they hadn't lost my details. I've NEVER had to do that before with anyone - they've got to respond fast here because if I don't trust them with my CC then I can't leave five-figure contracts at jeopardy hosted on their servers. I've been living comfortably on Linode servers for over…

Anyone know of any good way to export linode images to other VPS providers? Seems like I'll have to be doing it manually.

If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here):

   1. (offline) Boot new and old VM servers from live CD
   2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat  
   3. new server: netcat -l  | pbzip2 -cd | dd of=/dev/sda bs=8M
Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: You probably want to add encryption to this pipeline.

Re: Linode hacked, CCs and passwords leaked

#189

Post by austengary »

umsm wrote: post #179
austengary wrote: post #79

Earlier quoted context omitted.

Oh, and the years of Linode assessment were adequate?

Every site can be hacked. It's just a matter of time. You just have to properly react: call your CC provider, check for any charges on your bill, and move on.

I do not think anyone here is actually worried about their funds; as mentioned below, any reputable provider will have such charges promptly reversed. The problem is instead with their response to the situation.

Linode has addressed the breach, but assured customers nothing of value had been compromised. This infers two thoughts. One: they knew of the breach and lied, thereby unveiling a unforthcoming and dishonest nature. Or two: they did not properly investigative the severity of the issue, thereby suggesting incompetence. Both equally reprehensible.

Re: Linode hacked, CCs and passwords leaked

#190

Post by tmcneal »

gburt wrote: post #89
dom96 wrote: post #36

Earlier quoted context omitted.

Here is what Linode replied to me when I asked them about that chat log in a support ticket: Hello, Thank you for reaching out. We appreciate and understand your concerns. At this time the evidence suggest that this activity was targeting a specific customer. We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation. We have no comment regarding ryan*'s…

These guys are looking totally incompetent at this point. If you believe this Ryan guy, credit cards stored on the same server as the key to decrypt them, Lish passwords stored in plain text, they've known for some time and lied about what actually happened and now they're saying "we won't do anything about it" via email? "You are of course free to take any steps you deem prudent or necessary to ensure the integrity…

To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most likely the database containing the CC numbers resides on a separate set of boxes than the web servers.
Post reply on HN