Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OVH Security Incident

status.ovh.net

Post reply on HN
Print view View original

21–30 of 55 posts

Re: OVH Security Incident

#21

Post by Tobu »

Robin_Message wrote: post #13
eli wrote: post #11

Earlier quoted context omitted.

It doesn't matter; you should assume your password is lost. Follow their advice: "we advise you to change the password for your user name."

It matters a great deal (well, not to me, I don't use the service). Password reuse is common, and the way to fix that is good quality password hashing. If I used OVH, I'd need to change my password everywhere now. If I used someone competent (i.e. they still have bugs but they use bcrypt), they'd have lost: $2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa which is a bcrypt hash of my most secure password.…

Password reuse is still bad, your password doesn't have to be breached through a database dump. You could be accessing a compromised site, or get caught by any number of network attacks from stripping to mixed scripting to dumping a stream that doesn't have forward secrecy. https://www.imperialviolet.org/2012/07/19/hope9talk.html

Re: OVH Security Incident

#22

Post by agsamek »

Robin_Message wrote: post #13
eli wrote: post #11

Earlier quoted context omitted.

It doesn't matter; you should assume your password is lost. Follow their advice: "we advise you to change the password for your user name."

It matters a great deal (well, not to me, I don't use the service). Password reuse is common, and the way to fix that is good quality password hashing. If I used OVH, I'd need to change my password everywhere now. If I used someone competent (i.e. they still have bugs but they use bcrypt), they'd have lost: $2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa which is a bcrypt hash of my most secure password.…

> I'm happy to publish that

foolhardiness is not bravery ;)

Re: OVH Security Incident

#23

Post by aroch »

hahainternet wrote: post #19
aroch wrote: post #9

Earlier quoted context omitted.

Your interactions are pretty much opposite of mine. OVH is constantly doing stupid things to their network (like updating all their BGP reflectors at the same time last week and then falling out of BGP because of it). What they have in transparency and they lose in being a bunch of asshats to deal with. They've taken a week to replace a blown PSU (caused by their own inability to wire a rack); they've dumped my serve…

> a blown PSU (caused by their own inability to wire a rack); Please explain. I spotted the BGP failure but this happens from time to time with basically everyone.

A set of dedi's a bought as soon as BHS opened were on a rack that wasn't wired properly, an electrical short blew a PSU.

Re: OVH Security Incident

#24

Post by jessaustin »

nnwa wrote: post #14

"After internal investigations, it appeared that a hacker was able to obtain access to an email account of one of our system administrators." That translates to password reuse, or an insecure password.

...or a client attack, or XSS, or poorly secured tokens, or whatever. If we always blame the user first, we're bound to miss something. Even if the fault were an insecure password, the admin site would still be to blame for not throttling and locking down the account in response to repeated attack.

Re: OVH Security Incident

#25

Post by tptacek »

hbbio wrote: post #5
Robin_Message wrote: post #3

If I was a customers, I'd be asking if "based on SHA-512" means some kind of iterated algorithm, or if have they lost my password?

Maybe SHA-512, salted?

Salted SHAx passwords are basically the entire reason GPU John The Ripper and oclHashcat exist, although SHA2-512 is significantly slower than SHA2-256, so if you're going to use a terrible SHA-based password hash, SHA2-512 is your best bet.

Re: OVH Security Incident

#26

Post by Robin_Message »

Tobu wrote: post #21
Robin_Message wrote: post #13

Earlier quoted context omitted.

It matters a great deal (well, not to me, I don't use the service). Password reuse is common, and the way to fix that is good quality password hashing. If I used OVH, I'd need to change my password everywhere now. If I used someone competent (i.e. they still have bugs but they use bcrypt), they'd have lost: $2a$10$NkYCXBjWeVP0rJUlfl0VL.d66EvJjbVUA/YEsmBSyTZOnbY0/anxa which is a bcrypt hash of my most secure password.…

Password reuse is still bad, your password doesn't have to be breached through a database dump. You could be accessing a compromised site, or get caught by any number of network attacks from stripping to mixed scripting to dumping a stream that doesn't have forward secrecy. https://www.imperialviolet.org/2012/07/19/hope9talk.html

My point was, if they hash properly, a simple db dump is not a big deal (although obviously considering the password compromised is sensible, and password reuse is a bad idea which is not a proof people don't do it).

I'm signing out of this thread as my point seems to have been lost somewhere. Thanks for the interesting link though.

Re: OVH Security Incident

#27

Post by nnwa »

jessaustin wrote: post #24
nnwa wrote: post #14

"After internal investigations, it appeared that a hacker was able to obtain access to an email account of one of our system administrators." That translates to password reuse, or an insecure password.

...or a client attack, or XSS, or poorly secured tokens, or whatever. If we always blame the user first, we're bound to miss something. Even if the fault were an insecure password, the admin site would still be to blame for not throttling and locking down the account in response to repeated attack.

Fair point Jess.

Re: OVH Security Incident

#29

Post by Karunamon »

jacquesm wrote: post #15

OVH has come a long way. They used to be cheap and bad at service and totally incommunicado about any issues. Then a few years back something changed and they started to work on their image. Their still cheap, but their service is good and getting better and they seem to have nailed the communications angle. Good for them. Between OVH, Hetzner and Leaseweb the EU hosting space is doing fine.

I might add that OVH has a US arm as well - prices are competitive with Hetzner at least.

Re: OVH Security Incident

#30

Post by peterkelly »

at-fates-hands wrote: post #28
peterkelly wrote: post #10

This is how you do a security incident disclosure. I hope Apple is taking notes.

Are you referring to the recent disclosure, or just in general how they do it?

I'm just referring to this specific post from OVH (who I hadn't heard of until today). In reading it, I get the impression that they've handled the situation extremely professionally, and are setting a great example.
Post reply on HN