Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

361–370 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#361

Post by offmycloud »

nenolod wrote: post #212
voidlogic wrote: post #188

Earlier quoted context omitted.

If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…

dd if=/dev/sda bs=1M | ssh root@ dd of=/dev/sda bs=1M let SSH handle compression for you instead.

That's a great way to screw up the filesystem on the destination. You'll get mounted fs write combined with low-level block writes, filesystem in a blender.

Re: Linode hacked, CCs and passwords leaked

#362

Post by duskwuff »

iriche wrote: post #334

And right now we got confirmed on IRC that data is out, we do not know how much, 4 last numbers of CCs are out but that doesn't mean that full CCs are out. E-mails and logins are also out it seems.

Last four digits of CC#s are often used to identify them to users ("Visa ending in 1234"), and are specifically OK to store in cleartext. So that's not necessarily a big deal.

Re: Linode hacked, CCs and passwords leaked

#363

Post by Legion »

robomartin wrote: post #267

How about you guys cool it and stop organizing a lynching mob devoid of any real data? It's embarrassing. HN is supposed to be populated with lots of very smart, data-driven analytical folks. Yet, every time something like this happens out of the woodwork come people who would ran you and your children down in the event of an emergency rather than turn around, carefully evaluate the situation, and help you. Don't be…

I am a customer too, and I wield no torch or pitchfork, but I grow increasingly frustrated at the lack of response from Linode.

I understand your point about the idea that they may be unable to speak to the issue due to law enforcement efforts, but for the moment, acknowledgement would be satisfactory. I would be happy with, "We're aware of the rumors regarding the intrusion at Linode this past week. We are working with law enforcement and cannot comment on details at this time. However, we will provide a full postmortem once we are able to do so."

The problem is when the explanation never comes. It's OK if it's not this second, but tell us it's coming, and then follow through. Complete silence is frustrating.

Re: Linode hacked, CCs and passwords leaked

#364

Post by chatmasta »

AlexMuir wrote: post #87

Ah this is so shit. I want to support Linode, I've had nothing but a good experience. But I just had to check my credit card to be sure they hadn't lost my details. I've NEVER had to do that before with anyone - they've got to respond fast here because if I don't trust them with my CC then I can't leave five-figure contracts at jeopardy hosted on their servers. I've been living comfortably on Linode servers for over…

Please do realize: lack of suspicious charges on your credit card is not evidence that it was not stolen.

Re: Linode hacked, CCs and passwords leaked

#365

Post by chatmasta »

voidlogic wrote: post #188
windsurfer wrote: post #136

Earlier quoted context omitted.

Anyone know of any good way to export linode images to other VPS providers? Seems like I'll have to be doing it manually.

If your using lvm you can create a snapshot to do this while online, if not just read from your disk (assuming sda here): 1. (offline) Boot new and old VM servers from live CD 2. old server: dd if=/dev/sda bs=8M | pbzip2 -c | netcat 3. new server: netcat -l | pbzip2 -cd | dd of=/dev/sda bs=8M Compression: You can use something besides pbzip2, maybe pigz of if you only have a single core use bzip2 or gzip. Security: Y…

DigitalOcean should probably put this in their marketing materials.

Re: Linode hacked, CCs and passwords leaked

#366

Post by FireBeyond »

offmycloud wrote: post #361
nenolod wrote: post #212

Earlier quoted context omitted.

dd if=/dev/sda bs=1M | ssh root@ dd of=/dev/sda bs=1M let SSH handle compression for you instead.

That's a great way to screw up the filesystem on the destination. You'll get mounted fs write combined with low-level block writes, filesystem in a blender.

LVM snapshot, that's the way I'd go about it. Is how we do our backups, to maintain a good state. Mount the snapshot, and do the same with it.

Re: Linode hacked, CCs and passwords leaked

#367

Post by Evbn »

joewee wrote: post #357
NewAccnt wrote: post #329

Earlier quoted context omitted.

Wow, four times? You should probably be more careful about who you give your number to. Personally, I usually get a new card every 3-5 months. If someone ever sat on my card number, it's useless to them now. Never had any issues either.

Even old card numbers can be used for transactions in some cases.

Sure, but that isn't the former owners problem.

Are you thinking of expired cards? That is different.

Re: Linode hacked, CCs and passwords leaked

#368

Post by Evbn »

bndr wrote: post #303
nigma wrote: post #263

Earlier quoted context omitted.

So here's what Linode support is actually saying when asked about the breach: Thank you for contacting us. We have no evidence at this time that any payment information was compromised.

I asked about the security measures and they answered with: "We appreciate the response, and we can assure you that we have implemented all appropriate measures to provide the maximum amount of protection to our customers."

That severely underestimates the intelligence and wrath of their highly technical customer base.

Re: Linode hacked, CCs and passwords leaked

#369

Post by netrixtardis »

nenolod wrote: post #214
oinksoft wrote: post #151

Earlier quoted context omitted.

Regarding the "made a deal" assertion, I wouldn't take the IRC log hook-line-and-sinker. There's probably a mixture of truth and lies.

for the record, i am the person who started the WHT thread. there is a mixture of truth and lies on both sides, to be honest. i am annoyed with it, because i reached out to several linode employees privately to given them an opportunity to explain what was going on -- they either said 'no comment' or said my linode was fine. based on the irc log, that is clearly not the case. which is why i decided to raise my concer…

what makes you think you are more special then anyone else? Why would they tell you more details, than the rest of the people?

Sorry if you get offended that they didn't tell you much more. But seriously? you are not special. This whole thread is a lynch mob.

Post reply on HN