Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story around the Linode hack

straylig.ht

Post reply on HN
Print view View original

141–150 of 175 posts

Re: The story around the Linode hack

#141

Post by sbank »

jrockway wrote: post #130
crisnoble wrote: post #110

Earlier quoted context omitted.

Everyone bitching about HTP or AnonOps or any other hacking group that likes bragging should at least be thankful that they talk about their hacks. I would bet that the crime syndicates have better hacks and keep their mouths shut about them. Those vulnerabilities don't get patched, those customers never get notified. I am not defending HTP or the like, just saying, at least they boast.

I worry more about governments than organized crime these days.

Honestly, the two are very often synonymous.

Re: The story around the Linode hack

#142

Post by peghead201305 »

peterwwillis wrote: post #59

I can't think of a better classification for a terrorist than people who sit around all day working to destroy credibility of corporations and expose personal and financial information for the sake of their own fucked up moral code and amusement. It would be nice if we had internet role models. IRC is full of low-life degenerates who perpetuate the vitriol that reinforces this way of life as an acceptable pastime. If…

Yaa, when I watch those American soldiers laughing as they force Abu Ghraib prisoners to masturbate for their sadistic amusement, as I look at the pictures of the dead children at My Lai, or some latest US drone attack, I think geez, these script kiddies who owned Linode, they're really terrorists man. They try to destroy the credibility of corporations, can you imagine? My ass gets tight around the stick I have shoved up it when I think of "terrorist" hackers trying to "destroy credibility of corporations" for "amusement" (lulz?) And it's not like I never had to make the effort clean up a companies systems after they got hacked. I have, more than once.

Reading the HTP zines right now gave me a good laugh, and made me think of a time many years ago where I would smoke pot, cruise around the neighborhood in a car and would havr thought how cool the HTP guys are. My coding efforts nowadays are a bit more productive than these HTP kids, but to each his own, they'll get older some day and have to slog to work to keep a roof over their heads too. Now they are young and enjoying life, and laugh at old fools worried about rowdy kids who "destroy credibility of corporations".

Re: The story around the Linode hack

#143

Post by tiredofcareer »

jrochkind1 wrote: post #138
tiredofcareer wrote: post #37

Earlier quoted context omitted.

I didn't say it would be technically impossible, I said it would be noticed. If you make it a theoretical problem, and it most certainly isn't (there are a lot more practicalities involved), you're adding at least another string compare to every query. That's enough of a latency shift for me to notice in my graphs -- I notice when the Internet reroutes itself and my DNS latency goes up by 5 milliseconds. This isn't a…

Okay, so, when you notice your DNS latency going up by 5ms... how much investigation do you then do to confirm exactly what caused this, and have a very high confidence (how high?) of ruling out it being caused by a MitM on the DNS? Really?

Without getting too far into specific operational security -- the same reason that I hate there's an entire branch off my thread discussing this specific attack, which I think is detrimental to the discussion -- we have monitoring in place to tell me if this exact attack happens. Within seconds. The latency would just be a clue.

Think about the dumbest way you would do that. Then implement it. That's how simple our system is.

Re: The story around the Linode hack

#144

Post by plaguuuuuu »

crisnoble wrote: post #110
davidw wrote: post #15

Earlier quoted context omitted.

> tried to cause trouble for HTP. Here's hoping the FBI "causes trouble" for the lot of them. Breaking into other people's stuff is not cool. If I leave my door open by mistake, yes, that makes me a bit absent minded, or foolish, but it does not give anyone the right to wander into my house.

Everyone bitching about HTP or AnonOps or any other hacking group that likes bragging should at least be thankful that they talk about their hacks. I would bet that the crime syndicates have better hacks and keep their mouths shut about them. Those vulnerabilities don't get patched, those customers never get notified. I am not defending HTP or the like, just saying, at least they boast.

Yep. Knowing various people who have done security work for banks and similar organisations, I've heard a few hair-raising stories.

They never ever disclose when they get hacked. And they do get hacked.

Re: The story around the Linode hack

#145

Post by nikcub »

tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

re: your first paragraph, there is a way to jack an entire DNS record and not miss anything. It involves writing a custom DNS server. Once you become the primary, as the queries come in, if you are queried for a record that you don't know, you simply forward the query to the old primary and then store it yourself. Works all the time.

Domains are jacked and proxied a lot more than people know. The hackers have custom tools (rather than Squid + BIND etc.) that perform these tasks and keep them hidden.

Even better, you could host spoofed DNS for a number of Linode's on a single small 128-256MB virtual machine. The infrastructure required is tiny. Definitely possible, definitely happens all the time.

Re: The story around the Linode hack

#146

Post by TheSwordsman »

graue wrote: post #92
bstpierre wrote: post #39

Earlier quoted context omitted.

It said " not redirect from http to https" -- meaning that when someone requests http://example.com they would normally be redirected by the site owner to https://example.com , but the attacker could just leave the original request alone. The point is that most people wouldn't notice. HTTPS Everywhere or similar browser plugin would probably pop up an alert if this did happen.

HTTP Strict Transport Security[1] is designed specifically to prevent that attack. Unfortunately, Linode's manager doesn't seem to use it: $ curl -I https://manager.linode.com/ HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Tue, 07 May 2013 16:23:07 GMT Content-Type: text/html;charset=UTF-8 Connection: keep-alive Vary: Accept-Encoding If they were, there would be a line like this: $ curl -sI https://github.com | fgrep St…

Nginx 0.7.65 is packaged by Ubuntu for 10.04 LTS. Should still get security updates.

Re: The story around the Linode hack

#147

Post by Dylan16807 »

jstanley wrote: post #47
conductor wrote: post #17

Earlier quoted context omitted.

Well then you are not a hacker. And I hope FBI can not cause trouble for them, they did not do anything unethical in my POV. The server is not a house. Black hat hacking is a mixture of art and politics (I never support hackers who hack for stealing money), and if you want the analogy, they just spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doo…

"spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doors." And then collected private information of everybody who works for or is a customer of the institution, and then threatened the owners of the institution if they spoke out about what had happened.

If they spoke out within two weeks. That's not very long. Hell, you can take down sites for two weeks just by filing a DMCA notice.

Re: The story around the Linode hack

#150

Post by gingerlime »

tiredofcareer wrote: post #133
lelandbatey wrote: post #126

Earlier quoted context omitted.

I give Linode a lot of slack. When people say "Oh, they should be more secure" I often say "Really?" In an ideal world, yes, they should be more secure. However, as in this case, they got taken advantage of via a zero-day attack, with others planned well outside the scope of what Linode could have planned for. Which is insane. Can you even name something, anything that they could have done to protect themselves? Addi…

While what you say has merit, Linode's actions demonstrate an ambivalence toward security. Public key encryption for card numbers (yay!). The private key stored on the same machine and the key loaded in memory (boo!). ColdFusion was not properly secured (simply preventing access to /CFIDE would have neutralized this vector) and they focused first on preserving themselves. I've also been personally annoyed when there…

I tend to agree with you. We don't see much transparency in the industry as a whole.

When a security incident happens, I believe most security professionals would advise to keep details to the minimum necessary. I can imagine how misleading info can cause panic and dire consequences (to both linode and its customers). In Linode's case this could have been mandated by the FBI even, giving Linode no choice.

For me, linode is still one of the more transparent providers out there. I doubt AWS or any other provider would be more forthcoming if something similar happens.

Of course, there's a lot of security improvements to be made. I hope Linode would shake-up and improve and signs are they're doing that.

I'm still curious to hear some brand names that are better in that respect (hence my question about). From what I read there really is no better alternative currently at this price range.

Post reply on HN