Compromised Linode, thousands of BitCoins stolen • Hacker News Board

Re: Compromised Linode, thousands of BitCoins stolen

#21

Post by codexon » Thu, Mar 01, 2012, 10:05 PM UTC

sgornick wrote: post #9

jaredstenquist wrote: post #4

Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.

You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up. A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.

This is unfortunately untrue. Bitcoin has been subject to huge 30% swings in a matter of minutes.

Re: Compromised Linode, thousands of BitCoins stolen

#22

Post by eli » Thu, Mar 01, 2012, 10:06 PM UTC

liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

This is somewhat off topic, but just because the TOS says something doesn't necessarily make it true.

Re: Compromised Linode, thousands of BitCoins stolen

#23

Post by tantalor » Thu, Mar 01, 2012, 10:06 PM UTC

If this was sensitive data why was it not encrypted?

Replace "bitcoin wallet" with "medical history" or "credit card numbers".

Re: Compromised Linode, thousands of BitCoins stolen

#24

Post by 3pt14159 » Thu, Mar 01, 2012, 10:07 PM UTC

mindstab wrote: post #16

How did the attackers know what they were looking for. I'm going to assume that it's a small minority of linode users who have bitcoins on their machines. How were just these users targeted so accurately? What tied together knowledge they used bitcoins to those VMs and their linode accounts? Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines…

Simplest answer is probably the right one in this case:

Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it should be really really hard).

Re: Compromised Linode, thousands of BitCoins stolen

#25

Post by doublec » Thu, Mar 01, 2012, 10:07 PM UTC

mindstab wrote: post #16

How did the attackers know what they were looking for. I'm going to assume that it's a small minority of linode users who have bitcoins on their machines. How were just these users targeted so accurately? What tied together knowledge they used bitcoins to those VMs and their linode accounts? Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines…

They could have looked at the ip's of bitcoin services and noted those running on a linode. Or collected ip's from bitcoin nodes that their own node has seen and looked up those allocated to linode.

Re: Compromised Linode, thousands of BitCoins stolen

#26

Post by clarkmoody » Thu, Mar 01, 2012, 10:07 PM UTC

liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

That is very interesting indeed. Holding Bitcoins in a wallet on your server is the equivalent of having actual cash on your server. When someone takes it, there is a definite value of the damages vs. ID theft where the damage could be drawn out over a period of time.

As I consider launching my own Bitcoin business, I have wondered about where to host the bitcoind that serves as my business bank account. This event certainly makes me reconsider just any VPS.

Re: Compromised Linode, thousands of BitCoins stolen

#27

Post by mindstab » Thu, Mar 01, 2012, 10:08 PM UTC

liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

This especially seems hard to certify. Bitcoin aims to be quasi anonymous. Users could just log into their own systems and transfer coins to another anonymous wallet elsewhere and then try and claim robbery. Or be rooted (by say script kiddies) and then take advantage of that, transfer coins, and try and claim for them.

They end result is something like bitcoin would seem nearly impossible to insure for in any reasonable way.

Isn't this akin a bit to storing a bag with $12K in a storage locker in a public space and then asking to reimbursed after robbers broke into the locker and stole the bag.

I think the author is hoping for way too much. The world doesn't work that way, nor probably can or should it.

Re: Compromised Linode, thousands of BitCoins stolen

#28

Post by mmaunder » Thu, Mar 01, 2012, 10:09 PM UTC

stevenbrianhall wrote: post #7

nbpoole wrote: post #3

So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind: 1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well? 2. Why can customer service representatives access and update servers without the client being no…

Regarding #1, an update from Linode was just posted: "Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."

I'm a Linode fanboy, but we need maximum transparency on what occurred and what's being done. What support interface? How compromised? Who's credentials, etc.

Re: Compromised Linode, thousands of BitCoins stolen

#29

Post by [deleted] » Thu, Mar 01, 2012, 10:10 PM UTC

sgornick wrote: post #9

jaredstenquist wrote: post #4

Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.

You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up. A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.

[deleted]

Re: Compromised Linode, thousands of BitCoins stolen

#30

Post by KaeseEs » Thu, Mar 01, 2012, 10:12 PM UTC

sgornick wrote: post #9

jaredstenquist wrote: post #4

Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.

You mean less interested in using it as a way to profit from speculation. As a currency it is not as critical that the value only goes up. A person or merchant receiving bitcoins can easily convert them out to USDs and still lose less in fees than the same transaction would cost compared to accepting a credit card or debit card payment. For example, BTC -> USD at most exchanges is around half a percent.

Well, no. Currencies as we know them are not only for exchange, but also are supposed to be reasonable stores of value. If a currency loses 85% of its worth in a period of weeks, it has failed at this fundamental task.

Now, for merchants this might not seem to matter, as they might be able to always convert bitcoins to a real currency immediately and never hold them long enough for depreciation to matter, but if the currency is excessively volatile there will never be a buyer at the exchange besides speculators, which prevents the currency from ever being really useful.