Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked, CCs and passwords leaked

slashdot.org

Post reply on HN
Print view View original

411–418 of 418 posts

Re: Linode hacked, CCs and passwords leaked

#411

Post by ereckers »

FooBarWidget wrote: post #400
ghshephard wrote: post #385

Earlier quoted context omitted.

It depends on how sophisticated the identify theft is. I had a good friend who was taken for about $9000 in credit card fraud in 1998/1999, with Well Fargo. It took him the better part of six months, and endless correspondence with WF to prove all of the purchases were not his. There are lots of stories of people who were financially wiped out, to the point of bankruptcy, because of Credit Card/Identify fraud. With t…

That makes me wonder why the credit card system is so insecure in the first place. Why are credit card systems not secured with a password that the merchant never gets to see? Yet at the same time credit card suppliers keep bragging about how "secure" their cards are.

Funny that you mention that. After a few bouts with fraud (because as i mention I have my CC out to many services), I was wanting a way to track down the offending service.. I was thinking something along the lines of a vendor-specific set of numbers to be run through.

I even wrote a blog post about it. I probably don't know what I'm talking about, but these were my thoughts at the time:

Wishlist – A Method to Pre-Approve and Track Credit Card Transactions

The issue:

A business using a credit card doing business with a relatively small number of vendors wanting to first avoid credit card fraud (stolen numbers) and secondly wanting to easily track down the offending business.

The idea:

The business would like to approve particular vendors to use the credit card with number 0000-0000-0000-0000 with each individual business pre-approved to run the transaction with a 5th set of identifiable numbers, so something like 0000-0000-0000-0000-0001.

If the credit card is used to make a fraudulent transaction, then ideally, they would have had to have used the 5th set of identifying numbers. This 5th set of identifiable numbers would then allow for easy tracking of the offending vendor, which would allow the business to either re-think doing business with them, or to serve as a starting point discuss security issues with the vendor’s credit card transaction processes.

Summary:

Basically, I believe there may be a need for a new or value added credit card type service. This transaction type would require a 5th set of numbers which have been assigned to pre-approved vendors. This 5 number set (ie. 0000-0000-0000-0000-0002) credit card transaction would most likely prevent theft right off (because the vendor is pre-approved and should provide their own private key (ie. CCV) to put through the transaction). Secondly, if and when the credit card number is stolen and used to make a fraudulent purchase, then, at least with the 5th number set a vendor can be identified and security policy with them can be re-evaluated.

http://www.redbridgenet.com/blogging/wishlist-a-method-to-pr...

Re: Linode hacked, CCs and passwords leaked

#412

Post by Evbn »

runeb wrote: post #394
Evbn wrote: post #367

Earlier quoted context omitted.

Sure, but that isn't the former owners problem. Are you thinking of expired cards? That is different.

I can be in some cases. I got mugged and my card was used to pay for parking garages for 1.5 years until it expired even though it was canceled and blocked by the issuing bank. They said that for some transactions, the blocking mechanisms are so expensive its more economically sane to them to refund whatever was drawn.

Ugh. Did that require you to protest each charge? Or did you get a charge and credit on every bill?

Re: Linode hacked, CCs and passwords leaked

#413

Post by pizzeys »

netrixtardis wrote: post #369
nenolod wrote: post #214

Earlier quoted context omitted.

for the record, i am the person who started the WHT thread. there is a mixture of truth and lies on both sides, to be honest. i am annoyed with it, because i reached out to several linode employees privately to given them an opportunity to explain what was going on -- they either said 'no comment' or said my linode was fine. based on the irc log, that is clearly not the case. which is why i decided to raise my concer…

what makes you think you are more special then anyone else? Why would they tell you more details, than the rest of the people? Sorry if you get offended that they didn't tell you much more. But seriously? you are not special. This whole thread is a lynch mob.

Is he more special than other people, or should we ALL have been informed properly?

Re: Linode hacked, CCs and passwords leaked

#414

Post by godgod »

Being a former customer I decided to contact Linode support. I wanted to know if we have anything to worry about as we used to have a credit card on file with them. Notice how they say "Decrypted" which to me is not the same as NOT COMPROMISED.

Here is their response:

Thank you for reaching out to us. We do archive customer credit card details. At this point there is no evidence that customer credit cards have been decrypted.

Re: Linode hacked, CCs and passwords leaked

#415

Post by gtirloni »

eridius wrote: post #266
jbraithwaite wrote: post #238

Earlier quoted context omitted.

If it is indeed true that credit card numbers were compromised, it would behove Linode to tell their customers quickly so they can take the proper action. With this lack of transparency, I feel like I had no choice but to block my card.

There's no lack of transparency here. Linode expressly said in their blog post that no CC details were leaked. > In addition, we have found no evidence that payment information of any customer was accessed. The question isn't transparency, but trustworthiness. Either Linode is telling the truth, and this anonymous IRC person with a pastebin is trolling everyone, or Linode is lying (or alternatively, Linode is incompe…

I'm thinking here why Linode holds CC data on its servers in the first place. Anyone care to weight in here?

Secondly, if they hold that data, it's possible one day someone will find a security breach and will access that data. The best solution is to never hold that data.

Since I don't trust most of the systems I use AND Linode has not denied it holds that data... I'm more inclined to believe in this anonymous IRC guy and err on the side of caution.

If Linode had come out and said "Look, we don't hold your CC number in our database" then I think there would be very little reason to be concerned. However...

Re: Linode hacked, CCs and passwords leaked

#416

Post by gcr »

duskwuff wrote: post #360
gcr wrote: post #293

Earlier quoted context omitted.

Why can't they be stored? Is it a legal requirement to prevent merchants without the CCV from using the credit card? ...oh wait

Because the CVV is used to indicate the "presence" of the customer at a transaction. CVV1 (which is on the magstripe) is used to indicate "card-present" physical transactions, CVV2 (printed on the back) is used for "customer just typed this in" non-physical transactions.

That makes much more sense. Thank you.

Re: Linode hacked, CCs and passwords leaked

#417

Post by gcr »

rgbrenner wrote: post #389
gcr wrote: post #288

Earlier quoted context omitted.

DigitalOcean is new and they fixed the problem the same day the article was written: https://www.digitalocean.com/blog_posts/resolved-lvm-data-is... If I had a choice between a VPS provider who either: - Only has large issues (eg. leaks credit card data) and goes weeks without reporting them to customers, or - Has lots of small issues (eg. forgetting to clean the free space of LVM volumes) but fixes them the same day…

Wait a second.. you consider a provider giving data from your VMs to another random customer a SMALL issue? Maybe you don't have anything of importance on your VMs, but plenty of people do. That data could contain credit card data, passwords, etc, etc, etc. It is very much a large issue.

Sure. My thoughts don't apply to everyone here, and I certainly can't claim to be unbiased since I like DO so much.

According to DigitalOcean, they stated that this impacts 3% of all machines, only the largest and most expensive servers. None of the smaller plans were leaking data.

I don't know how many credit card numbers were leaked from linode, but I'd guess more than 3%.

Second, if security is important to you, you can use 'dd' to clear the machine yourself before shutting it off. (In fact, good data destruction policies mandate the use of 'shred' et al anyway). On Linode, affected users don't even have a workaround (like this) to avoid information compromise.

Re: Linode hacked, CCs and passwords leaked

#418

Post by thaumaturgy »

laxk wrote: post #410
douglasheriot wrote: post #401

Earlier quoted context omitted.

Renaming CSS files with numbers or whatever is one legitimate way to handle cache invalidation (not evidence of not using version control)

It is not the best way to handle cache invalidation. Why not /linode.css?v= ?

This is inconsequential.
Post reply on HN