Who on earth uses ColdFusion any more? Surely when they re-built it a while back they could have used something more secure like Django?
Security incident update
61–70 of 282 posts
Re: Security incident update
#62Earlier quoted context omitted.
It might have been encrypted, but surely it must be exposed to their system somewhere to enable them to make charges? Is it feasible, if that was the case, that the attackers could use that to exfiltrate decrypted CC info? I suppose this wild speculation isn't helpful or conducive and waiting on more information might be a better idea. I think the reputation damage has already been done, judging by the comments on th…
It depends on how they implemented it. Maybe there's an operator that logs on once a day and enters the passphrase, and then they use it to charge credit cards. So the private key is exposed only for a brief period. Another possibility is that the passphrase is entered when the machine is booted, and then the private key (not the passphrase) is loaded into memory. This is how e.g. ssh-agent[1] works. When this mechan…
It's possible to debug targets running under the current user, so root privileges might not have been needed, if they had an agent running under the same UID as the application.
> However, the private key can be then used to carry out crypto operations.
Surely this is of concern? According to the logs they'd known about the breach for a week - that seems like enough time to decrypt each card one by one and exfiltrate them.
Re: Security incident update
#63"Along with the encrypted credit card, the last four digits are stored in clear text to assist in lookups and for display on things like your Account tab and payment receipt emails."
I really don't see the need for that at all. What sort of credit card "lookup" are they doing exactly?
Re: Security incident update
#64The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the ops folk at Linode to have suffered an attack due to a third party 0-Day exploit. It could happen to any of us really. On a side note, I am not sure of the "some occurrences of plaintext Lish passwords". Seems like quite a goofup on Linode's part.
Adobe stuff is best assumed vulnerable at all times though.
Re: Security incident update
#65The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the ops folk at Linode to have suffered an attack due to a third party 0-Day exploit. It could happen to any of us really. On a side note, I am not sure of the "some occurrences of plaintext Lish passwords". Seems like quite a goofup on Linode's part.
Sorry but having passwords in plaintext is not a "goofup".
It is completely and utterly inexcusable.
Re: Security incident update
#66"Along with the encrypted credit card, the last four digits are stored in clear text to assist in lookups and for display on things like your Account tab and payment receipt emails." I really don't see the need for that at all. What sort of credit card "lookup" are they doing exactly?
I guess it's mainly to display stuff. When you have multiple cards on Amazon you can choose which one to use, however without seeing the last four digits its pretty hard to tell which is which.
Re: Security incident update
#67The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the ops folk at Linode to have suffered an attack due to a third party 0-Day exploit. It could happen to any of us really. On a side note, I am not sure of the "some occurrences of plaintext Lish passwords". Seems like quite a goofup on Linode's part.
> It could happen to any of us really.
Yes, but the whole private key thing and the ability to access the cc numbers from the front-end (unless they hacked the DB server as well, I think they didn't?) reeks of failure.
The only thing standing between the plain text cc numbers and the hackers is the passphrase, better pray that it's a good one.
Re: Security incident update
#68Earlier quoted context omitted.
Devils advocate: preparing a press release from a company after plugging holes and auditing that makes the appropriate admissions and apologies probably takes more time than writing up a successful hit after attacking a page.
Linode didn't just take their time to announce this, just a few hours ago they were apparently telling customers definitively that their credit card information hadn't been accessed.
And that is "still" the case
Re: Security incident update
#69Earlier quoted context omitted.
I feel like there is a fine line between a "cover up" and a "grey hat disclosure". Reading the IRC logs from #linode [0], HTP hacker ryan* seems to say that they made a deal of "we don't tell if you don't tell" but then Linode broke the deal by reporting them to law enforcement. You could see this as a cover up or you could see this as a disclosure from the crackers to Linode. I see it as a cover up, since Linode sho…
Perhaps nitpicking, but looks like HTP might have gained password hashes and encrypted credit card numbers, as well as a passphrase protected private key file . That's if I'm reading between the lines of both ryan and Linode's statement. This is why you build security in layers. If one layer gets broken, there are other layers to protect you. I'm not underestimating the severity of this incident, but I think it's goo…
[deleted]
Re: Security incident update
#70Earlier quoted context omitted.
Perhaps nitpicking, but looks like HTP might have gained password hashes and encrypted credit card numbers, as well as a passphrase protected private key file . That's if I'm reading between the lines of both ryan and Linode's statement. This is why you build security in layers. If one layer gets broken, there are other layers to protect you. I'm not underestimating the severity of this incident, but I think it's goo…
[deleted]
[deleted]