Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Compromised Linode, thousands of BitCoins stolen

bitcoinmedia.com

Post reply on HN
Print view View original

101–110 of 249 posts

Re: Compromised Linode, thousands of BitCoins stolen

#101

Post by TomGullen »

darklajid wrote: post #95
klodolph wrote: post #80

Earlier quoted context omitted.

It's not about "don't put anything on a VPS", it's about "don't put money on a VPS."

I'm sorry, but you just said the same thing again that I was arguing against. 'Money' is not as clear cut as you'd like it to be. Bitcoins are no real recognized currency. So you can trade them for USD -> Don't store it? What about this great project I'm working on? All my stuff on the VPS, because that's convenient and accessible from everywhere. I spent a double digit number of days on it. I have a daily rate for w…

Bad comparison in my opinion, BitCoins can be stolen (taken away and become unrecoverable) whilst your project you've been working on is recoverable.

Also the value something is worth is what someone else will pay for it. You can't value a project you're working on as your hourly rate * hours worked, it doesn't really work like that.

Re: Compromised Linode, thousands of BitCoins stolen

#102

Post by noarchy »

aidenn0 wrote: post #54
ben0x539 wrote: post #41

> Although passwords are stored using SHA1 with a salt, Where's the bcrypt/scrypt/whatever police in this comments thread?

I already asked in the comments of the original article how many rounds of sha1 are used. SHA-1 still isn't the best, since it yields to FPGA attacks, but a single round can brute-force all 8 character passwords in less than 2 days on a GPU. My guess is that 10k rounds of sha-1 would probably not be feasible for non-dictionary attacks without specialized hardware.

GPUs that Bitcoin miners would certainly have around. Not saying that this is what happened, but it got me wondering.

Re: Compromised Linode, thousands of BitCoins stolen

#103

Post by darklajid »

slig wrote: post #100
darklajid wrote: post #91

Earlier quoted context omitted.

>Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets? The way I understand it the attackers were able to get access to the admin panel and invoked some kind of 'change root password' emergency stuff. The machines were rebooted it seems, which makes sense: The interface of Linode has probably/hopefully no access to t…

I disabled root login when I was setting up the server. Could my server be affected too? Also admins that only log with ssh keys and don't use root won't be able to notice that, will they?

1) No idea, that's something Linode needs to answer. I only guessed what it takes to change a root password of a VPS system.

2) Very good point. In that case it might work undetected for quite a while..

Re: Compromised Linode, thousands of BitCoins stolen

#104

Post by noarchy »

polemic wrote: post #75
liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

This is why insurance exists. I wonder if there are any insurance providers who'd be willing to provider coverage for this sort of event.

I've never heard of one, but there may very well be a market for that sort of thing. The problem with Bitcoins will be the legal jurisdictions involved, since these services are regulated nearly everywhere, right?

Re: Compromised Linode, thousands of BitCoins stolen

#105

Post by larrys »

"As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation."

"hosting critical sensitive operations" in particular. If you are doing "critical sensitive operations" you need a more secure solution and process which will cost you more money.

Under no circumstances can a hosting provider assume the liability for something like this.

The tradeoff you make for the low cost you pay is that you might have an issue like this because someone screws up.

You pay more for a safe to store your money (and for a safe deposit box to store your valuables) because it's important and you understand the risk involved in not doing that. If you have valuable jewelry many times the insurance company will only insure if you keep it in the safe when you are not wearing it and even the amount of days is specified when it can be out of the safe.

It's unreasonable to expect (and linode's contract clearly states as other's have mentioned) a hosting provider to have a liability over what you are paying them. Edit Add: Unless you specifically have an agreement in advance or that is what they promised or charged you for.

Before anyone reacts to this with any harsh criticism please think for a second what liability you would want for any mistakes that you make with your web startup or idea. You could either be charging zero or charging a small $5 to $20 per month charge. You might make a mistake. Are you willing to accept and even be able to insure for thousands or even millions in liability for those mistakes?

Re: Compromised Linode, thousands of BitCoins stolen

#106

Post by shirro »

icebraining wrote: post #81
shirro wrote: post #72

Linode compromised! That is important news that concerns me. If the headline didn't mention the BitCoin scam that HN is always pumping would it have made it to the front page? Certainly haven't heard anything from Linode :-(

Sigh. Please give me a definition of 'scam' that fits with bitcoin and not e.g. Apple or Google shares. Hint: In a scam, there's deceit. The bitcoin devs never deceived anyone. The whole system is transparent, so if there's anyone who bought without understanding the risks, they have no one to blame but themselves. (Note: No, I don't own any bitcoins).

Perhaps I am just cynical. I did not mean to suggest the devs were scammers. But I still believe the ecosystem as a whole reeks of pyramids and other scams and I am sick of reading about it. I also think Scientology and MLM are scams but there are people who think they are not and we can't all agree. But then I also think casinos and lotteries are scams so I am kind of outside mainstream opinion on a few things I guess.

Re: Compromised Linode, thousands of BitCoins stolen

#107

Post by res0nat0r »

darklajid wrote: post #95
klodolph wrote: post #80

Earlier quoted context omitted.

It's not about "don't put anything on a VPS", it's about "don't put money on a VPS."

I'm sorry, but you just said the same thing again that I was arguing against. 'Money' is not as clear cut as you'd like it to be. Bitcoins are no real recognized currency. So you can trade them for USD -> Don't store it? What about this great project I'm working on? All my stuff on the VPS, because that's convenient and accessible from everywhere. I spent a double digit number of days on it. I have a daily rate for w…

Then this conversation should be about the security breach and the BitCoin aspect should be a side note. The data lost is not what is important, just how the breach should be resolved and prevented in the future yes?

Re: Compromised Linode, thousands of BitCoins stolen

#108

Post by RLG_RLG »

Please people (not corporations w/ staffs), do not run critical systems in the cloud.

Get a dedicated server (not cheapest you can find) and secure it with:

(install in this order)

APF - http://www.rfxn.com/projects/advanced-policy-firewall/

BFD - http://www.rfxn.com/projects/brute-force-detection/

rkhunter

Ideally, install rkhunter on fresh system, right after updates, APF, & BFD. Then update the binary check-sums with this command, if you know server is secure:

Update file properties: # rkhunter --propupd --sk

Run a system check to make sure it is known clean: # rkhunter --check --sk

Lastly, sign up for the security alert mailing list for your version of linux on your server.

If you want maximum security, be sure to password protect your boot loader and use an encrypted file system. This will make it very difficult for ISP to work on your server however!

Re: Compromised Linode, thousands of BitCoins stolen

#109

Post by icebraining »

darklajid wrote: post #84
icebraining wrote: post #70

Earlier quoted context omitted.

What state? PCI DSS is private regulation.

Two problems. 1) I don't think PCI is relevant here. If you store bitcoins somewhere and they get stolen then this is, in my world, cash. It's your very own digital cash. Not a credit card. That's why I constructed a (probably poorly implemented) example of someone leaving a wallet full of shiny $currency notes out there. 2) 'What state?' WTH? Can I reply with 'What kind of question is that?' The state I'm coming fro…

Oh, FFS. I meant "what state?" as in, "why are you talking about the state?", since you said:

    (...) something that the state can protect (...)
and since the PCI (which was what we were talking about) is private, it doesn't make sense to talk about the State.

US-centered mindset

The fuck? Firstly, I'm European. Secondly, I assumed you were talking about the State[1], not a particular state.

[1]: https://en.wikipedia.org/wiki/State_(polity)

Post reply on HN