Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security incident update

blog.linode.com

Post reply on HN
Print view View original

241–250 of 282 posts

Re: Security incident update

#241

Post by nenolod »

jaxbot wrote: post #83
abalone wrote: post #75

If the hackers got to the ColdFusion source code then it is quite possible they decrypted credit card numbers. The passphrase may not be stored in the database but presumably the decryption key is kept in memory by the app server while running. Otherwise it wouldn't be able to charge anything. And if the hackers could modify the ColdFusion source code, they can get to anything the app server can, including the decryp…

From what HTP said on IRC, the credit card numbers were decrypted within the application context, which would be consistent with what you said. But during the IRC conversation, HTP willingly gave out the last four digits of people's CC#s, but ignored any request for digits before that, which would be more consistent with what Linode is stating. It's all a very confusing world where nobody has a definite answer. Just…

Last 4 is all you need to wreak some serious havoc though. Service cancellations and whatnot...

Re: Security incident update

#242

Post by ig1 »

dangrossman wrote: post #216
ig1 wrote: post #203

Earlier quoted context omitted.

Tens of thousands of credit and debit cards, many of which are likely to be corporate cards with extremely high spending limits ?

Worth no more than $1 a card on the black market. It'd be cheaper to buy cards than to try to crack the key. There's more supply than demand for stolen card numbers.

That's because the black market for credit cards is a lemon market [1] - known good corporate cards are much more valuable.

[1] https://en.wikipedia.org/wiki/The_Market_for_Lemons

Re: Security incident update

#243

Post by robertfw »

sparkinson wrote: post #207
bjterry wrote: post #161

Earlier quoted context omitted.

It's trivial to memorize an entire sonnet. Actors and actresses memorize many times that amount. It's also trivial to write a sonnet. How many bits of entropy do you think a sonnet has?

Are you saying that you are happy to type in an entire sonnet when prompted for a password? Being realistic, to expect someone to type in such a long password regardless of if they can remember it or not is clearly unreasonable.

For a consumer, perhaps, but for protecting thousands of individuals...

Re: Security incident update

#244

Post by nenolod »

dangrossman wrote: post #222
jmillikin wrote: post #221

Earlier quoted context omitted.

The attacker claimed that he compromised their webserver. If he had access to the private key and encrypted numbers, then they were indeed being stored on an internet-facing machine. 07:52 the CCrypter class of the linode application context was accessable from outside the wwwroot using undocumented ColdFusion methods. i was fully able to decrypt the ccs using the in-memory privkey that they supplied the password for…

Let's make this more clear: Linode has two servers. One is a web server that runs their website and contains its source code. One is a database server containing customer information and encrypted credit card numbers. The web server is connected to the internet. The database server is not. They communicate over the private network. The web server is compromised. The attacker has the source code, which includes the IP…

Proof?

Re: Security incident update

#245

Post by mike-cardwell »

eco wrote: post #224
rellik wrote: post #190

Earlier quoted context omitted.

Why won't they just tell us the private key's passphrase, so we can judge for ourselves how secure it is?

Once they give the private key passphrase out there would be no need for us to judge for ourselves. The hackers would have everyones credit card information at that point.

He was joking

Re: Security incident update

#246

Post by steveklabnik »

jmillikin wrote: post #228
dangrossman wrote: post #222

Earlier quoted context omitted.

Let's make this more clear: Linode has two servers. One is a web server that runs their website and contains its source code. One is a database server containing customer information and encrypted credit card numbers. The web server is connected to the internet. The database server is not. They communicate over the private network. The web server is compromised. The attacker has the source code, which includes the IP…

> The web server is compromised. The attacker has the > source code, which includes the IP/host and login > credentials for the database server, since the website > code talks to the database to function. IMO, if internet-facing machine A is storing login credentials to machine B, then machine B should be considered internet-facing. There is no reason for a properly-designed system to be storing passwords or credit c…

> communicating via a small and easily-auditable interface

... isn't that called 'a network'? This seems to contradict your earlier statement about 'machine B should be considered internet-facing.'

Re: Security incident update

#247

Post by nenolod »

bradleyland wrote: post #230
plusbryan wrote: post #208

Earlier quoted context omitted.

I'd recommend reporting your card likely stolen and getting a new number. The slight inconvenience is worth the peace of mind.

I recommend not bothering. Liability for fraudulent CC activity (in the US) is very low (max $500), and banks never enforce the liability for two reasons: 1) it's easier for them to chargeback the transaction to the vendor, thus they're not out of pocket, and 2) it causes customers to leave for a provider that doesn't hold them liable. How much of your time spent chasing down and changing a CC number is worth a maxim…

Since Dodd-Frank, debit cards and credit cards have the same liability protections.

Re: Security incident update

#248

Post by bdowney »

jmillikin wrote: post #221
dangrossman wrote: post #217

Earlier quoted context omitted.

No, they didn't... You have to be able to reach the server over a network somehow to be able to store new cards and charge existing ones. The requirement is not that the server have no NIC, just that it not be internet-facing itself. The DB server was only accessed through the compromised web server, not directly through the public internet.

The attacker claimed that he compromised their webserver. If he had access to the private key and encrypted numbers, then they were indeed being stored on an internet-facing machine. 07:52 the CCrypter class of the linode application context was accessable from outside the wwwroot using undocumented ColdFusion methods. i was fully able to decrypt the ccs using the in-memory privkey that they supplied the password for…

Why would you trust this so called "hacker", it's that Marcan clown after all.

Re: Security incident update

#249

Post by andyhmltn »

This is really annoying for a number of reasons:

1) Well the obvious one is my card info is out there now 2) I really love Linode. Always respond to my tickets within 10 minutes, great prices and an awesome interface. It's such a shame that this has happened.

Re: Security incident update

#250

Post by smacktoward »

redbad wrote: post #138
arc_of_descent wrote: post #100

Earlier quoted context omitted.

> In the meantime, Perl works for us. It's not cool or sexy > but it gets the job done. What is not cool about Perl? You don't need to transition to a new framework outside of Perl. You can upgrade your backend by investing your time in rewriting the Perl code to newer standards.

> What is not cool about Perl? Almost everything is not cool about Perl. Perl felt crufty and ancient even when I was learning it fifteen years ago. It's only gotten weirder, cruftier, and more ancient since then.

I dunno, it's been nearly as long since I learned Perl (or used it much) but the stuff I've seen out of the "modern Perl" movement (http://onyxneon.com/books/modern_perl/index.html) looks a lot cleaner and more, well, modern than the Perl I used to live with. You can still write "crufty and ancient" Perl, in other words, but you don't have to.
Post reply on HN