Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security incident update

blog.linode.com

Post reply on HN
Print view View original

131–140 of 282 posts

Re: Security incident update

#131

Post by shadowfox »

InclinedPlane wrote: post #45
derefr wrote: post #10

Earlier quoted context omitted.

I think a lot of people are failing to understand how credit card processing works. The private key needs to live on some machine, if you actually want to have any CC requests processed at some point. If the private key itself isn't on the frontend/user-facing server, then instead, when the frontend node is hacked, the hacker will find a shared secret or signing key to auth the frontend node against the backend node…

CC data however does NOT have to live on any machine that anyone except your merchant bank owns. If you are writing against billing APIs in the 21st century then you only need to store a token which you use for recurring billing. Not everyone does this, but it's a reasonably good practice, especially if you have had intrusions in the past.

Out of curiosity, is this token generation sufficiently general or is it tied to a specific bank/credit card provider? (Basically is it easy to switch providers without having all your customers enter their cc information again?)

Re: Security incident update

#132

Post by tbatterii »

rjknight wrote: post #90
mekoka wrote: post #85

The one thing that puzzles me above anything else about this whole thing is: "Linode uses ColdFusion". I mean, you have this Linux company that's pretty much an open source champion to us Linux guys and then... Adobe ColdFusion. Really? I know nothing about ColdFusion, don't get me wrong, I just find it an incredibly odd choice for a Linux company. That having been said, I think Linode just learnt a really unpleasant…

Linode is a Linux company, but it's also a company founded in 2002-3. Back then, there weren't many great options for web programming and ColdFusion would have made a degree of sense (PHP 4.0 was released in 2000, and Ruby on Rails 1.0 didn't appear until 2004; Django was released in 2005). A modern, reasonably-secure web stack in those days really did mean "PHP with register_globals=Off". (Facebook and YouTube were…

>Facebook and YouTube were both created later, and in PHP

youtube was always done in python as far as I understand. http://www.youtube.com/watch?v=G-lGCC4KKok

But yeah, back in 2002-3 coldfusion was an option.

Re: Security incident update

#133

Post by porker »

mosburger wrote: post #123
rjknight wrote: post #90

Earlier quoted context omitted.

Linode is a Linux company, but it's also a company founded in 2002-3. Back then, there weren't many great options for web programming and ColdFusion would have made a degree of sense (PHP 4.0 was released in 2000, and Ruby on Rails 1.0 didn't appear until 2004; Django was released in 2005). A modern, reasonably-secure web stack in those days really did mean "PHP with register_globals=Off". (Facebook and YouTube were…

There was a heck of a lot of Java out there used for web development around that time. But your point still stands - Java probably would've been a lot more difficult to setup and maintain than CF.

Although if I remember rightly it wasn't in 2004, isn't CF now Java-powered under the surface?

Re: Security incident update

#134

Post by moondowner »

mosburger wrote: post #123
rjknight wrote: post #90

Earlier quoted context omitted.

Linode is a Linux company, but it's also a company founded in 2002-3. Back then, there weren't many great options for web programming and ColdFusion would have made a degree of sense (PHP 4.0 was released in 2000, and Ruby on Rails 1.0 didn't appear until 2004; Django was released in 2005). A modern, reasonably-secure web stack in those days really did mean "PHP with register_globals=Off". (Facebook and YouTube were…

There was a heck of a lot of Java out there used for web development around that time. But your point still stands - Java probably would've been a lot more difficult to setup and maintain than CF.

I beg to differ. If it was a Java based solution maybe they would have migrated more easily.

For example, Struts was released around 2000 (now we have much more choices regarding Java Web frameworks). Since then they could've migrated to Struts 2, and after that for example migrate to Spring MVC, or even stick with Struts 2.

Re: Security incident update

#135

Post by zorbo »

codeulike wrote: post #86
vrta wrote: post #51

Earlier quoted context omitted.

It was 0-day when they got hit. Sad thing is that they do not tell how much time has passed since the hack.

I'm not sure, their wording around it is a bit convoluted "... previously unknown zero-day vulnerability in Adobe’s ColdFusion application server. The vulnerabilities have only recently been addressed in Adobe’s APSB13-10 hotfix (CVE-2013-1387 and CVE-2013-1388) which was released less than a week ago." To me that reads like 'it was a former zero-day exploit", as all exploits are.

Not all exploits are zero-day exploits. As I understand it, a zero-day exploit is one that is used in the wild before it is disclosed. Plenty (most) vulnerabilities are only disclosed once a fix has been implemented.

Re: Security incident update

#136

Post by jtolj »

corford wrote: post #91
dchest wrote: post #35

Earlier quoted context omitted.

"There were occurrences of Lish passwords in clear text in our database."

Also (and correct me if my understanding of this is wrong since I've never used it), LISH is just a remote terminal service. You still need to know the VM's root password. And frankly, if you're doing it right, the root password should be a long, unique random string that you store somewhere safe and never use since you should be using keys to login to your box on a day to day basis.

I'm pretty sure this is correct. The LISH passwords just give you console access via ssh (as an alternative to the web-based terminal in Linode Admin), which is essentially the equivalent of getting to an ssh prompt. A login/password would still be required to access the machine.

It doesn't appear that you can reboot or enter single user mode from the LISH console login prompt.

Re: Security incident update

#137

Post by JshWright »

inopinatus wrote: post #130
sparkinson wrote: post #99

Earlier quoted context omitted.

> in our heads So it's short enough to remember and likely has some sort of pattern. There's a limit to what a person can remember, lower if there are several people that have to remember it.

You've assumed that everyone involved has the entire passphrase.

They were storing LISH passwords in the clear... Does it really sounds like they care enough to use some sort of multi-party brokered passphrase accountability system?

Re: Security incident update

#138

Post by redbad »

arc_of_descent wrote: post #100
hellweaver666 wrote: post #98

Earlier quoted context omitted.

Also, if it works for them, it may not be financially viable to rewrite all of their code. For example, I work for a large company that uses Perl for all the backend stuff on our website. If we were to change to a more "modern" stack, we would have to stop and focus on that for a period of time instead of pushing the company forward and improving the customer experience etc. In the meantime, Perl works for us. It's n…

> In the meantime, Perl works for us. It's not cool or sexy > but it gets the job done. What is not cool about Perl? You don't need to transition to a new framework outside of Perl. You can upgrade your backend by investing your time in rewriting the Perl code to newer standards.

    > What is not cool about Perl?
Almost everything is not cool about Perl. Perl felt crufty and ancient even when I was learning it fifteen years ago. It's only gotten weirder, cruftier, and more ancient since then.

Re: Security incident update

#139

Post by JshWright »

mekoka wrote: post #85

The one thing that puzzles me above anything else about this whole thing is: "Linode uses ColdFusion". I mean, you have this Linux company that's pretty much an open source champion to us Linux guys and then... Adobe ColdFusion. Really? I know nothing about ColdFusion, don't get me wrong, I just find it an incredibly odd choice for a Linux company. That having been said, I think Linode just learnt a really unpleasant…

>That having been said, I think Linode just learnt a really unpleasant lesson and will become an even more secure provider for it. I believe that moving my sites away from them at this moment would be like selling stocks when they're about to go up.

What concerns me is that the would have been perfectly happy to sweep most of this under the rug if Ryan hadn't forced their hand.

The security lesson is one thing (hacks happen). I'm far more concerned with the lesson in transparency, as that speaks to the character of the company.

Re: Security incident update

#140

Post by sparkinson »

inopinatus wrote: post #130
sparkinson wrote: post #99

Earlier quoted context omitted.

> in our heads So it's short enough to remember and likely has some sort of pattern. There's a limit to what a person can remember, lower if there are several people that have to remember it.

You've assumed that everyone involved has the entire passphrase.

Not really, just more than one person as is implied in the grammar.

Edit: Theses "making an assumption" arguments are silly. It is good practice to assume the worst case, to assume the best in this situation is bad.

Post reply on HN