Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security incident update

blog.linode.com

Post reply on HN
Print view View original

111–120 of 282 posts

Re: Security incident update

#111

Post by merlincorey »

webmonkeyuk wrote: post #97
corford wrote: post #89

Earlier quoted context omitted.

This is what Caker (founder of Linode IIRC?) has to say about the strength of the passphrase: "our private key is stored only in encrypted format. The passphrase is not guessable, sufficiently long and complex, not based on dictionary words, and not stored anywhere but in our heads." [1] [1] http://blog.linode.com/2013/04/16/security-incident-update/c...

At least if someone tries cracking the passwords they won't have to bother with a dictionary based attack or short strings ;)

Unless of course it's a double-bluff.

Re: Security incident update

#112

Post by mjs »

vrta wrote: post #94
troels wrote: post #74

Earlier quoted context omitted.

Yeah, maybe you're right. The text is a bit unclear about that.

Yeah, they didn't tell us when they got hacked, but seclist did (3/31/2013): http://seclists.org/nmap-dev/2013/q2/3

3/31/2013 is the backup they're reverting to, not when they got hacked though, right? (The email refers to "downtime over the last week", so I guess the hack happened around 6th April or later.

Re: Security incident update

#113

Post by threeseed »

Confusion wrote: post #87
dchest wrote: post #47

Earlier quoted context omitted.

Right, we don't know because they failed to disclose this.

Wouldn't you rather have them working on assessing, containing and repairing the damage rather than catering to the impatient internet crowd that is so used to immediate updates on everything that they can't fathom putting together a responsible, useful, correct response might actually take a while? Honestly, these people don't understand what it takes to run a company and handle such an incident. As far as i'm conce…

I don't understand where you are coming from here.

Why do you think companies can only do one thing at a time ? And where have you worked where software engineers are drafting press releases or conducting security audits ? And why shouldn't keeping customers (who have their own apps) informed be their top priority ?

Re: Security incident update

#114

Post by kijin »

facorreia wrote: post #106

As a computer user, I'm thoroughly tired of Adobe's products constant stream of security vulnerabilities. Flash, Adobe Reader, ColdFusion. I avoid their products mostly for this reason. Flash, which I can't avoid completely, I have set up to only run when I say so, which I only do for a couple websites I trust. And why should a static document reader be able to run arbitrary code completely eludes me. Many companies…

> why should a static document reader be able to run arbitrary code

Because PDF was never meant to be a static format, and Adobe Reader was never meant to be a static document reader.

However, since most PDFs are static anyway, I think it would be a very good idea for PDF reader softwares to treat every PDF as a static document by default, and only allow scripting after the user clicks Yes on a scary-looking warning.

Re: Security incident update

#115

Post by sparkinson »

mynameisvlad wrote: post #102
sparkinson wrote: post #99

Earlier quoted context omitted.

> in our heads So it's short enough to remember and likely has some sort of pattern. There's a limit to what a person can remember, lower if there are several people that have to remember it.

You can't assume this. It could be ridiculously strong, and, with a lot of use, has become remembered.

I'd argue that actually it's better to assume the worst case here, not what it potentially could be.

That and the fact that an offline attack can be run on this key is not promising.

Re: Security incident update

#116

Post by threeseed »

mark_lee wrote: post #105

I don't know why so many guys here who obviously are not customers of linode care about this case so much, I've been a user of linode for 5 years, it's a company that you know you can trust, that's simply what I can tell from my experience.

I am a former customer who was burned the last time they were hacked and were less than truthful. Now it has happened again and nothing has changed. Clearly non existent security audits (cleartext passwords ?) and still lots of unanswered questions.

It should be crystal clear by now that Linode is fundamentally untrustworthy.

Re: Security incident update

#117

Post by ScottWhigham »

scottjad wrote: post #28

What isn't in this post: - Any mention of the claim that they had made a deal with the hackers. No attempt to deny the claim. - Any mention of when the systems were compromised or when they discovered that they were compromised. The post starts with "Yesterday," mentions working "around the clock" and mentions Friday, giving the impression that this is all very recent, when according to the hacker Linode has known fo…

If it was your company and you had decided to make a deal with the hackers, would you publicize or publicly address that fact? My thinking is that doing so would incentivize others to do similar acts because you are an easy mark.

Re: Security incident update

#118

Post by UnoriginalGuy »

corford wrote: post #89
thaumaturgy wrote: post #77

They reset the passwords on Friday. Even assuming that they've been working for the last four days on discovering the extent of the intrusion, there's a pretty big gap between Friday's announcement: "This activity appears to have been a coordinated attempt to access the account of one of our customers. This customer is aware of this activity and we have determined its extent and impact. We have found no evidence that…

This is what Caker (founder of Linode IIRC?) has to say about the strength of the passphrase: "our private key is stored only in encrypted format. The passphrase is not guessable, sufficiently long and complex, not based on dictionary words, and not stored anywhere but in our heads." [1] [1] http://blog.linode.com/2013/04/16/security-incident-update/c...

A single private key passphrase is all that stands between a bad guy and everyone's credit card information... Well I know I feel better...

But jokes aside, there is a huge gap between the strongest and weakest algorithms used to passphrase protect a private key. I wish they gave us more information about the certificates.

Including: is it ONE private certificate for everyone? Or one per client/customer? How was the key pair generated? When was the key pair generated? Which algorithms does it utilise and at what key length?

Re: Security incident update

#119

Post by laumars »

arc_of_descent wrote: post #100
hellweaver666 wrote: post #98

Earlier quoted context omitted.

Also, if it works for them, it may not be financially viable to rewrite all of their code. For example, I work for a large company that uses Perl for all the backend stuff on our website. If we were to change to a more "modern" stack, we would have to stop and focus on that for a period of time instead of pushing the company forward and improving the customer experience etc. In the meantime, Perl works for us. It's n…

> In the meantime, Perl works for us. It's not cool or sexy > but it gets the job done. What is not cool about Perl? You don't need to transition to a new framework outside of Perl. You can upgrade your backend by investing your time in rewriting the Perl code to newer standards.

It's hard to find good Perl developers and even harder to run multi-language libraries for the same online portal (ie same site, domain, database, hosting environment: hardware, OSs....and so on).

Re: Security incident update

#120

Post by facorreia »

kijin wrote: post #114
facorreia wrote: post #106

As a computer user, I'm thoroughly tired of Adobe's products constant stream of security vulnerabilities. Flash, Adobe Reader, ColdFusion. I avoid their products mostly for this reason. Flash, which I can't avoid completely, I have set up to only run when I say so, which I only do for a couple websites I trust. And why should a static document reader be able to run arbitrary code completely eludes me. Many companies…

> why should a static document reader be able to run arbitrary code Because PDF was never meant to be a static format, and Adobe Reader was never meant to be a static document reader. However, since most PDFs are static anyway, I think it would be a very good idea for PDF reader softwares to treat every PDF as a static document by default, and only allow scripting after the user clicks Yes on a scary-looking warning.

Correct. I wasn't clear, so let me clarify: I regard every PDF I read as a static document. That's how I see them and that's how I read them, with readers that treat them as static. I have no use for a PDF document that wants to acts as software and I wouldn't use a bug-nest of a piece of software to run it.
Post reply on HN