Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linode hacked again?

vpsboard.com

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Linode hacked again?

#31

Post by taf2 »

notastartup wrote: post #28
ary wrote: post #16

So I switched to Digital Ocean after the last Linode security fiasco and I can't say I regret it. Should you decide to switch to another VPS provider I strongly recommend you cite the security problems when they ask you why you're closing your account. The only reliable way to get the security message across to technical managers and business people alike is to make it about money. That said the fact that this has ha…

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

curious, what do use the $5 servers for?

Re: Linode hacked again?

#32

Post by cthor »

notastartup wrote: post #28
ary wrote: post #16

So I switched to Digital Ocean after the last Linode security fiasco and I can't say I regret it. Should you decide to switch to another VPS provider I strongly recommend you cite the security problems when they ask you why you're closing your account. The only reliable way to get the security message across to technical managers and business people alike is to make it about money. That said the fact that this has ha…

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

A lot of merchants (e.g. Amazon) don't use PayPal because is isn't a real bank, and so isn't beholden by laws associated with banks. The terms of service state that you cannot seek any legal recourse from them should your account be shut down.

How could this affect a VPS provider? Say a customer hosts a porn site, or a gun-selling site, or something else PayPal disagrees with. PayPal shuts the merchant's account down for it. Now the merchant's funds are frozen for an indeterminate amount of time till the issue can be resolved, if at all, and there's nothing they can do about it short of appealing to PayPal.

Re: Linode hacked again?

#33

Post by infosecslave »

anaphor wrote: post #30
ary wrote: post #16

So I switched to Digital Ocean after the last Linode security fiasco and I can't say I regret it. Should you decide to switch to another VPS provider I strongly recommend you cite the security problems when they ask you why you're closing your account. The only reliable way to get the security message across to technical managers and business people alike is to make it about money. That said the fact that this has ha…

Stop acting so dramatic. There's no evidence that there was any security breach. People on IRC are saying this is FUD. zectorpt: no zectorpt: nothing was "hacked", but old stuff got posted again

Which is blatantly false, if it was "old stuff being posted again" then the mysql credentials wouldn't have been working 60 minutes ago.

Re: Linode hacked again?

#34

Post by [deleted] »

cthor wrote: post #32
notastartup wrote: post #28

Earlier quoted context omitted.

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

A lot of merchants (e.g. Amazon) don't use PayPal because is isn't a real bank, and so isn't beholden by laws associated with banks. The terms of service state that you cannot seek any legal recourse from them should your account be shut down. How could this affect a VPS provider? Say a customer hosts a porn site, or a gun-selling site, or something else PayPal disagrees with. PayPal shuts the merchant's account down…

[deleted]

Re: Linode hacked again?

#35

Post by [deleted] »

infosecslave wrote: post #4
markwillis82 wrote: post #2

I try to stay away from databases run by other companies, for this reason. Seems to be safer to run my own and block access than the convenience of db as a service. Obviously if you don't have the experience in this, your susceptible to this kind of leak.

theshore==linode

[deleted]

Re: Linode hacked again?

#36

Post by notastartup »

cthor wrote: post #32
notastartup wrote: post #28

Earlier quoted context omitted.

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

A lot of merchants (e.g. Amazon) don't use PayPal because is isn't a real bank, and so isn't beholden by laws associated with banks. The terms of service state that you cannot seek any legal recourse from them should your account be shut down. How could this affect a VPS provider? Say a customer hosts a porn site, or a gun-selling site, or something else PayPal disagrees with. PayPal shuts the merchant's account down…

yeah but when I couldn't use my credit card anymore paypal was the only option.

Re: Linode hacked again?

#37

Post by notastartup »

taf2 wrote: post #31
notastartup wrote: post #28

Earlier quoted context omitted.

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

curious, what do use the $5 servers for?

the same way I used linode for but at 4 times the less cost.

Re: Linode hacked again?

#38

Post by anaphor »

infosecslave wrote: post #33
anaphor wrote: post #30

Earlier quoted context omitted.

Stop acting so dramatic. There's no evidence that there was any security breach. People on IRC are saying this is FUD. zectorpt: no zectorpt: nothing was "hacked", but old stuff got posted again

Which is blatantly false, if it was "old stuff being posted again" then the mysql credentials wouldn't have been working 60 minutes ago.

It seems like the data in this is identical to the stuff that was leaked last time. My guess is that someone was able to gain (user level) access to one of the servers hosting the forums, and the best they were able to do is leak an old database that was around from the last breach. It smells like skiddies trying to stir up drama to me. The names of the people posting this crap on IRC are "SABU", "<ryan____", "robertlevin", and "illegal". Yeah they're fucking troll idiots.

Re: Linode hacked again?

#39

Post by kyrra »

infosecslave wrote: post #9

Found a copy of some of the DBs. ra.pe/linode2.sql

This looks like their forum server (phpbb). I'm not listed on here (been a customer of linode for a few years, and on the forums). I see no posts or anything with my info (or text from posts I've made).

Also, looking through the post data on there, it's all from 2003. And I can't find any of the posts listed in this sql dump on their active DB. I see nothing exciting here.

Re: Linode hacked again?

#40

Post by infosecslave »

eli wrote: post #22
infosecslave wrote: post #13

Earlier quoted context omitted.

Same mysql server also appeared to accept * as the password for the root user.

That doesn't really make any sense. That's not a MySQL default, so you're saying they intentionally set the root user password to '*'? I'm not sure I buy that.

They're also running MySQL 3.
Post reply on HN