Fortunately my CC information on file is expired.
Linode hacked, CCs and passwords leaked
211–220 of 418 posts
Re: Linode hacked, CCs and passwords leaked
#212Earlier quoted context omitted.
Anyone know of any good way to export linode images to other VPS providers? Seems like I'll have to be doing it manually.
If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…
dd if=/dev/sda bs=1M | ssh root@ dd of=/dev/sda bs=1M
let SSH handle compression for you instead.
Re: Linode hacked, CCs and passwords leaked
#213Earlier quoted context omitted.
Anyone know of any good way to export linode images to other VPS providers? Seems like I'll have to be doing it manually.
If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…
There's very nice utility called Ghost 4 Unix that makes the whole thing even easier: http://www.feyrer.de/g4u/
Re: Linode hacked, CCs and passwords leaked
#214Earlier quoted context omitted.
These guys are looking totally incompetent at this point. If you believe this Ryan guy, credit cards stored on the same server as the key to decrypt them, Lish passwords stored in plain text, they've known for some time and lied about what actually happened and now they're saying "we won't do anything about it" via email? "You are of course free to take any steps you deem prudent or necessary to ensure the integrity…
Regarding the "made a deal" assertion, I wouldn't take the IRC log hook-line-and-sinker. There's probably a mixture of truth and lies.
for the record, i am the person who started the WHT thread.
there is a mixture of truth and lies on both sides, to be honest.
i am annoyed with it, because i reached out to several linode employees privately to given them an opportunity to explain what was going on -- they either said 'no comment' or said my linode was fine.
based on the irc log, that is clearly not the case. which is why i decided to raise my concerns publically.
luckily for me, my linode was not doing anything mission-critical, just some secondary monitoring and running an ircd for a network i like using, but there are others who are using linode for mission-critical work, and they deserve more transparency than this.
Re: Linode hacked, CCs and passwords leaked
#215Earlier quoted context omitted.
If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…
Woah woah woah isn't this just transferring the contents of /dev/sda in the clear over the wire? Shouldn't you at least do this over SSH?
>>Shouldn't you at least do this over SSH?
Yeah, I mentioned that at the bottom of my post. Using ssh or some other inline encryption would be a good idea if it is a system you care about. If you have a site to site VPN tunnel between your systems, you can skip adding the encryption.
Re: Linode hacked, CCs and passwords leaked
#216FYI, I just learned from Linode support that accounts have both a default LISH password AND a default API key, which means that even if you've never set a LISH password or generated an API key before , you still should still go and reset them. This is not what I would consider expected or desirable behavior.
I've never generated an API key, and Linode showed it as blank. I generated a new one anyway, but I can't imagine how they'd have a default key and somehow not show it in the UI.
Re: Linode hacked, CCs and passwords leaked
#217Earlier quoted context omitted.
If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…
dd if=/dev/sda bs=1M | ssh root@ dd of=/dev/sda bs=1M let SSH handle compression for you instead.
That is one (good) way to handle the encryption.
You don't want to leave out the compression or block size however, so add those back in. Most WAN links are low bandwidth enough that compression will not slow things down (this is usually true even on 1 GBE LAN links for pigz) and in my experience the speed-up is substantial.
pigz is much faster than using ssh compression as it is multicore. apt-get it or http://zlib.net/pigz/
Re: Linode hacked, CCs and passwords leaked
#218Earlier quoted context omitted.
Sigh, really? Ok, you typed your credit card number into a web browser at some point. If your sole reason for doing so was "I absolutely trust the people on the other end of this socket not to do what 99% of all people handling credit card data do whether they pretend otherwise or not", instead of something like "hmm that reminds me, I haven't scanned last month's statement yet", then the problem lies squarely with y…
So because companies A through X are irresponsible with data, customers should regard that as acceptable and give company Y a free pass to do the same? I don't understand how a reasonable analysis of the situation can come to that conclusion.
"Because Nigerian princes A through X are irresponsible with your cash, budding lottery winners should regard that as acceptable and give Nigerian prince Y a free pass to do the same?"
Of course not, and this drives to the very core of risk management. I've signed up for some very shady online services in my time, doing so in the full knowledge that should a product or service not be rendered as advertised, I am guaranteed to be able to reverse the relevant charge. Even when I the consumer am doing something shady (in a case last month, attempting to import goods I knew weren't certified for the EU), the system still works for me. This is the sole reason I use a credit card rather than, say, my current account's Visa number.
It's not even about assessing the risk of whether or not you're going to get ripped off, but whether or not a particular company will cause you the inconvenience of the aforementioned phone calls.
If you work on the assumption that you card data is safe, you quite simply aren't safe enough to be in possession of a computer or card. Credit cards aren't built on that assumption, instead their entire motivation is based on risk profiling both the consumer and merchant, and terminating agreements when various thresholds are reached. In return the industry guarantees that in the minority of cases where things go wrong for the consumer, the problem can be corrected swiftly.
It's understandably upsetting that their customer database might have leaked, and I can genuinely understand peoples' concern over that. But as 4chan has taught us, there are very few people left in the west whose address and telephone number aren't available within even an hour's Googling.
As for locating confidential data on machines shared with other customers and managed by a piece of unaudited software, I have no sympathy for that. That's the price of a VPS, and why it's so heavily discounted compared to real hardware.
Re: Linode hacked, CCs and passwords leaked
#219Just like I can have application-specific passwords for my Google account, I wish I could have application-specific credit card numbers from my CC issuer. If I had these, I would immediately cancel my Linode-specific CC# and reissue a new one. I would not have to worry that my other recurring bills will go unpaid, or spend hours dealing with tracking them down and changing them.
Either this, or a assignable CVV codes. Something like that would be awesome.
That wouldn't work since CVV codes aren't sent with recurring transactions (they can't, since they cannot be stored).
Re: Linode hacked, CCs and passwords leaked
#220Just like I can have application-specific passwords for my Google account, I wish I could have application-specific credit card numbers from my CC issuer. If I had these, I would immediately cancel my Linode-specific CC# and reissue a new one. I would not have to worry that my other recurring bills will go unpaid, or spend hours dealing with tracking them down and changing them.
[deleted]