51–60 of 133 posts
I asked them just now if these systems were compromised and they promptly replied:
"The system that stores scans of ids, credit cards and so on was not compromised. In addition to that, we delete that information after 21 days."
FAQ: Bank details are encrypted (two-way) in the database. However, it cannot be excluded that the attacker/s have also been able to obtain access to the key.
Mail: With credit cards, only the last three digits of the card number, the card type and the expiry date are saved in our systems. All other card data is saved solely by our payment service provider and referenced via a pseudo card number. Therefore, as far as we are aware, credit card data has not been compromised.
Full text of the email sent to cutomers: Dear Client At the end of last week, Hetzner technicians discovered a "backdoor" in one of our internal monitoring systems (Nagios). An investigation was launched immediately and showed that the administration interface for dedicated root servers (Robot) had also been affected. Current findings would suggest that fragments of our client database had been copied externally. As…
Just got the email too. I'm quite happy with how clear they are about what happened and how they hash their passwords. Very different from Linode. I just wish that they used bcrypt instead of a salted SHA256 but at least it's salted (and anyway in my case I never reuse passwords so no big deal).
If they fall under PCI:DSS, they might not be able to use bcrypt since it isn't an official recommended standard. (I am of course assuming that they mean PBKDF2 when they say salted SHA256.)
Earlier quoted context omitted.
What if attacker infects unencrypted part used for booting? Do you have protection against that? It's relatively easy on Linux, where /boot is usually not encrypted.
Agreed, but typically /boot isn't automounted when it's a separate partition, which means they would need a root-access compromise already .
Earlier quoted context omitted.
How does this help? The key is still stored in memory which I assume the hypervisor has access to.
Hetzner provide a lot of physical machines too, I believe this is what the other poster was talking about.
Earlier quoted context omitted.
Hetzner provide a lot of physical machines too, I believe this is what the other poster was talking about.
Physical machines don't prevent keys from leaking out. A physical attacker can analyze power usage usage patterns to extract the encryption key. :)
Is the konsoleh login/account something that would have gotten created for me automatically? i.e. do I need to worry about it?
Earlier quoted context omitted.
How does this help? The key is still stored in memory which I assume the hypervisor has access to.
Correct, but hacking into the hypervisor is harder than hacking an administration interface. In the end the only secure server is one in a vault at the bottom of the ocean, but there are ways to prevent certain attack vectors.
I strongly doubt that:
The info in the mail regarding the safety of credit card info contradicts with the linked FAQ. FAQ: Bank details are encrypted (two-way) in the database. However, it cannot be excluded that the attacker/s have also been able to obtain access to the key. Mail: With credit cards, only the last three digits of the card number, the card type and the expiry date are saved in our systems. All other card data is saved solel…
account numbers / routing numbers / company names / po boxes/ physical addresses / account history and other billing info.
I'd assume they're saying some of these might be compromised, but specifically that credit cards aren't.