Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security incident update

blog.linode.com

Post reply on HN
Print view View original

91–100 of 282 posts

Re: Security incident update

#91

Post by corford »

dchest wrote: post #35
nfm wrote: post #34

Earlier quoted context omitted.

"Linode Manager user passwords are not stored in our database, but their salted and cryptographically hashed representations are." Sounds like it's not stored in plaintext.

"There were occurrences of Lish passwords in clear text in our database."

Also (and correct me if my understanding of this is wrong since I've never used it), LISH is just a remote terminal service. You still need to know the VM's root password. And frankly, if you're doing it right, the root password should be a long, unique random string that you store somewhere safe and never use since you should be using keys to login to your box on a day to day basis.

Re: Security incident update

#92

Post by jrockway »

seabee wrote: post #71
[deleted] wrote: post #69

Earlier quoted context omitted.

[deleted]

Even if they have a passphrase it has to be strong enough to withstand brute force for months. If you're not smart enough to keep the private key separate from the crap you're trying to protect, why should I think you're smart enough to ensure your passphrase is good enough?

why should I think you're smart enough to ensure your passphrase is good enough

Key strengthening.

Re: Security incident update

#93

Post by ig1 »

I've canceled the card I used with Linode, the hacker may or may not have got access to the card number, but given the level of uncertainty I'd just rather cancel my card and get a new one reissued. I imagine my bank feels the same way.

Remember that depending on where you're based / your agreement with your bank that you might lose any standard "protection" for any fraudulent transactions that occur after you learn your cards been compromised.

Re: Security incident update

#94

Post by vrta »

troels wrote: post #74
vrta wrote: post #51

Earlier quoted context omitted.

It was 0-day when they got hit. Sad thing is that they do not tell how much time has passed since the hack.

Yeah, maybe you're right. The text is a bit unclear about that.

Yeah, they didn't tell us when they got hacked, but seclist did (3/31/2013): http://seclists.org/nmap-dev/2013/q2/3

Re: Security incident update

#95

Post by corford »

thaumaturgy wrote: post #81
entropy_ wrote: post #73

Earlier quoted context omitted.

That doesn't make any sense. It's exactly like saying: "Oh sure, the credit card numbers were encrypted but if the encryption key is brute-forced then it's game over". The CC numbers were encrypted using a public key. The corresponding private key was itself encrypted using "[a] complex passphrase [that] is not stored electronically". They could be lying, but if they are not then this is perfectly valid security. Usi…

> When you want to bill your customers you'd input the passphrase which wouldn't be stored anywhere, would be used to temporarily decrypt the CC numbers and bill everyone. I've had account changes billed to my card within minutes, even (and especially) in the middle of the night (when I do most of that stuff). I'm having a little bit of trouble imagining that someone's sitting in front of a terminal and typing a pass…

Interesting. Whenever I make changes that affect how much I'll be billed, the amounts get added or removed and take effect when the card next gets charged (which happens once a month). At least that's how I remember it... going to dig through some old statements now to verify this as its been a while since I last changed anything that would alter what they charge me.

Re: Security incident update

#96

Post by sveiss »

jpallen wrote: post #5

I know Linode has been getting hammered for not being trustable or that they don't respond well when contacted, but in my experience they have been extremely responsive to any issues I have raised. I don't just mean technical issues either, we had what looked like a security breach on our account and it kicked of a small frenzy in their support staff and supervisory team to track down the problem. They figured out wh…

I've always had an excellent experience when dealing with Linode one-on-one, via email or support ticket, but their one-to-many communication sometimes seems to be lacking.

I'm glad they posted a more detailed update regarding this issue publicly.

Re: Security incident update

#97

Post by webmonkeyuk »

corford wrote: post #89
thaumaturgy wrote: post #77

They reset the passwords on Friday. Even assuming that they've been working for the last four days on discovering the extent of the intrusion, there's a pretty big gap between Friday's announcement: "This activity appears to have been a coordinated attempt to access the account of one of our customers. This customer is aware of this activity and we have determined its extent and impact. We have found no evidence that…

This is what Caker (founder of Linode IIRC?) has to say about the strength of the passphrase: "our private key is stored only in encrypted format. The passphrase is not guessable, sufficiently long and complex, not based on dictionary words, and not stored anywhere but in our heads." [1] [1] http://blog.linode.com/2013/04/16/security-incident-update/c...

At least if someone tries cracking the passwords they won't have to bother with a dictionary based attack or short strings ;)

Re: Security incident update

#98

Post by hellweaver666 »

rjknight wrote: post #90
mekoka wrote: post #85

The one thing that puzzles me above anything else about this whole thing is: "Linode uses ColdFusion". I mean, you have this Linux company that's pretty much an open source champion to us Linux guys and then... Adobe ColdFusion. Really? I know nothing about ColdFusion, don't get me wrong, I just find it an incredibly odd choice for a Linux company. That having been said, I think Linode just learnt a really unpleasant…

Linode is a Linux company, but it's also a company founded in 2002-3. Back then, there weren't many great options for web programming and ColdFusion would have made a degree of sense (PHP 4.0 was released in 2000, and Ruby on Rails 1.0 didn't appear until 2004; Django was released in 2005). A modern, reasonably-secure web stack in those days really did mean "PHP with register_globals=Off". (Facebook and YouTube were…

Also, if it works for them, it may not be financially viable to rewrite all of their code. For example, I work for a large company that uses Perl for all the backend stuff on our website. If we were to change to a more "modern" stack, we would have to stop and focus on that for a period of time instead of pushing the company forward and improving the customer experience etc.

In the meantime, Perl works for us. It's not cool or sexy but it gets the job done. Probably a similar situation at Linode.

Re: Security incident update

#99

Post by sparkinson »

regecks wrote: post #76
markbao wrote: post #52

Earlier quoted context omitted.

Sorry, 6am here, that's what I mean. It is good to see Linode adopting this layered approach, though it is what you're supposed to do . The other route would be storing the private key file unencrypted, which, thank goodness that wasn't the case. Knowing Linode, I'm fairly confident it's a strong passphrase; it would be imprudent to secure credit card details with something like "swordfish".

Well, the official statement re: the passphrase is: > @Eivind – our private key is stored only in encrypted format. The passphrase is not guessable, sufficiently long and complex, not based on dictionary words, and not stored anywhere but in our heads.

> in our heads

So it's short enough to remember and likely has some sort of pattern. There's a limit to what a person can remember, lower if there are several people that have to remember it.

Re: Security incident update

#100

Post by arc_of_descent »

hellweaver666 wrote: post #98
rjknight wrote: post #90

Earlier quoted context omitted.

Linode is a Linux company, but it's also a company founded in 2002-3. Back then, there weren't many great options for web programming and ColdFusion would have made a degree of sense (PHP 4.0 was released in 2000, and Ruby on Rails 1.0 didn't appear until 2004; Django was released in 2005). A modern, reasonably-secure web stack in those days really did mean "PHP with register_globals=Off". (Facebook and YouTube were…

Also, if it works for them, it may not be financially viable to rewrite all of their code. For example, I work for a large company that uses Perl for all the backend stuff on our website. If we were to change to a more "modern" stack, we would have to stop and focus on that for a period of time instead of pushing the company forward and improving the customer experience etc. In the meantime, Perl works for us. It's n…

> In the meantime, Perl works for us. It's not cool or sexy > but it gets the job done.

What is not cool about Perl? You don't need to transition to a new framework outside of Perl. You can upgrade your backend by investing your time in rewriting the Perl code to newer standards.

Post reply on HN