Compromised Linode, thousands of BitCoins stolen • Hacker News Board

Re: Compromised Linode, thousands of BitCoins stolen

#241

Post by noduerme » Fri, Mar 02, 2012, 8:18 PM UTC

bigiain wrote: post #166

larrys wrote: post #105

" As a respected hosting provider, I hope they do the correct thing and refund me for this liability due to their error. Many people trust Linode, and they have proven themselves as a serious contender for hosting critical sensitive operations on the internet. I would hate to not see them live up to that reputation. " "hosting critical sensitive operations" in particular. If you are doing "critical sensitive operatio…

"please think for a second what liability you would want for any mistakes that you make with your web startup or idea" It seems to me that bitcoin wallets are a relatively new and not well enough understood risk. There are very few other "files" like them, in that an attacker copying them can deprive you of their value in a way that you cant protect with backups. I feel a big part of current "internet security best p…

Still, the amount stolen in Bitcoins here is probably small potatoes next to the value of all the credit cards and personal details stored in other Linode instances. If someone can hack their admin panel and get root access to 8 accounts, they can get access to all the accounts. This time it happened to be done by someone who was going after the Bitcoins. But how can they claim anything in the way of security?

People who host on a VPS typically do so because they want to run complex applications that scale up, and do so without the cost or headaches of adding more physical hardware. Most people who use Linode probably do not do so to host static webpages, which can be done just fine on a shared server for a quarter the price. While Linode might be cheap, they do claim to be secure, and if they didn't it's doubtful people would host their apps there. And most apps do take some personal information; and a large number of them take financial details.

No one would use Linode to host their apps if they thought all accounts were rootable from a master login panel. And no one would use them to host static pages. So who would their customers be if people didn't expect their instances to be secure?

Re: Compromised Linode, thousands of BitCoins stolen

#242

Post by bigbird » Fri, Mar 02, 2012, 9:37 PM UTC

mindstab wrote: post #27

liquidsnake wrote: post #14

The OP's tone clearly indicates that he expects some compensation, Linode's TOS are pretty clear: Therefore, subscriber agrees that Linode.com shall not be liable for any damages arising from such causes beyond the direct and exclusive control of Linode.com. Subscriber further acknowledges that Linode.com's liability for its own negligence may not in any event exceed an amount equivalent to charges payable by subscri…

This especially seems hard to certify. Bitcoin aims to be quasi anonymous. Users could just log into their own systems and transfer coins to another anonymous wallet elsewhere and then try and claim robbery. Or be rooted (by say script kiddies) and then take advantage of that, transfer coins, and try and claim for them. They end result is something like bitcoin would seem nearly impossible to insure for in any reason…

It's actually a bit worse than this -- basically this is analogous to putting the $12k in a storage locker and then posting on the internet the exact location of the locker.

Given that a bitcoin client was almost certainly running on this box, basically anyone could have connected to the bitcoin network and established this guy's IP address as a target.

If you run bitcoin software, you are advertising your IP address as a high value target.

Re: Compromised Linode, thousands of BitCoins stolen

#243

Post by RLG_RLG » Fri, Mar 02, 2012, 11:21 PM UTC

spindritf wrote: post #144

RLG_RLG wrote: post #137

Earlier quoted context omitted.

> but at what point is it safe to assume that if you get hacked, it's not going to be because your ISP got hacked If you co-locate your hardware at a data center and your staff competently secures your systems.

Secure with what? A booby trap? There's always a level of trust you need to have for your provider. Even when you get a cage in their DC.

Set low level passwords and use filesystem encryption. eg: passwords on all networking devices, boot loaders, and BIOS.

Three letter agencies and foreign governments could attack your data if they took it off line, but you monitoring should detect that.

Re: Compromised Linode, thousands of BitCoins stolen

#244

Post by RLG_RLG » Fri, Mar 02, 2012, 11:24 PM UTC

nknight wrote: post #193

marshray wrote: post #145

Earlier quoted context omitted.

He's right though. I don't think I've ever met a professional sysadmin who could defeat the evil maid attack. All the ones I've met would refuse to think about an attack vector if it implied they could not boot their servers.

Yep. Classically, we abdicate responsibility as soon as physical security is breached. With virtual machines the problem is mostly the same, but it moves from "true physical" to "virtual physical" -- once the host environment is breached, all bets are off. Any sysadmin that claims to be able to protect against a physical access attack or its contextual equivalent is either lying or incompetent. In neither case should…

Use BIOS & boot loader passwords. Encrypt the file systems. This will not stop 3 letter agencies, foreign governments, or aliens.

Re: Compromised Linode, thousands of BitCoins stolen

#245

Post by dekz » Fri, Mar 02, 2012, 11:40 PM UTC

3pt14159 wrote: post #191

dekz wrote: post #63

Earlier quoted context omitted.

Well using SHA1 with a salt is a lot closer to bcrypt than plaintext or encrypting the passwords.

In my opinion it is not. Here is the common use case for people: 66% of them use 8 character or less passwords. Forget about the common longer passwords like "letmeinplz" just doing a brute force would give them 66%. In terms of loss, even 1% of passwords being compromised is bad since many people use the same password for multiple things. Now, how long would it take for people to take down bcrypt? in the scale of ti…

Your second point makes no sense, bcrypt factors are manually increased and require a new write for every item in the store. If we time capsule the SHA1 hashed db of passwords and the Bcrypt db for 10 years you cannot prove that the SHA1 database will be more easily compromised than the Bcrypt database. There may be a cryptographic break in blowfish in the time.

They don't mention a work factor for their SHA1 hash storage, they could be using PBKDF2 for all we know.

If you're looking for something to pick on about Linode here, go after something else, this isn't the worst thing to come out today.

Re: Compromised Linode, thousands of BitCoins stolen

#246

Post by lawnchair_larry » Sat, Mar 03, 2012, 12:14 AM UTC

RLG_RLG wrote: post #124

lawnchair_larry wrote: post #44

Earlier quoted context omitted.

Sorry, there is just no way that this is the case. Please don't throw such a serious allegation out there without any evidence. To even suggest that this is technically possible for an employee to do is a serious allegation, let alone suggesting that someone did it maliciously. This spreads all kinds of FUD. I'll happily eat my words if that turns out to be what happened, but it is definitely not the simplest answer.

Inside job is usually the answer for targeted attacks against inside systems. Inside collusion at a minimum. I wonder how anyone can trust their linode systems after an admin account being compromised. It would likely ruin their business to re-install everything, but that is the only way to know root kits have not been installed.

Or just check if your instance was restarted and your root password was changed. If it wasn't, you were not exploited this way.

Re: Compromised Linode, thousands of BitCoins stolen

#247

Post by nknight » Sat, Mar 03, 2012, 12:42 AM UTC

RLG_RLG wrote: post #244

nknight wrote: post #193

Earlier quoted context omitted.

Yep. Classically, we abdicate responsibility as soon as physical security is breached. With virtual machines the problem is mostly the same, but it moves from "true physical" to "virtual physical" -- once the host environment is breached, all bets are off. Any sysadmin that claims to be able to protect against a physical access attack or its contextual equivalent is either lying or incompetent. In neither case should…

Use BIOS & boot loader passwords. Encrypt the file systems. This will not stop 3 letter agencies, foreign governments, or aliens.

It won't stop a private individual, either, not even one with a budget of approximately $0. Cold boot and similar attacks, even just yanking the memory or forcing a CMOS reset, are trivial. Please tell me you don't do this for a living.

Re: Compromised Linode, thousands of BitCoins stolen

#248

Post by tomp » Tue, Mar 06, 2012, 2:08 PM UTC

jrockway wrote: post #238

tomp wrote: post #217

Earlier quoted context omitted.

What if they steal the key?

The key is encrypted with a long and key-strengthened passphrase, so the Universe will run out of energy long before their computers get the key.

But then, you're back where you started. Why not just use a password in the first place?

Re: Compromised Linode, thousands of BitCoins stolen

#249

Post by RLG_RLG » Sat, Mar 10, 2012, 4:18 PM UTC

nknight wrote: post #247

RLG_RLG wrote: post #244

Earlier quoted context omitted.

Use BIOS & boot loader passwords. Encrypt the file systems. This will not stop 3 letter agencies, foreign governments, or aliens.

It won't stop a private individual, either, not even one with a budget of approximately $0. Cold boot and similar attacks, even just yanking the memory or forcing a CMOS reset, are trivial. Please tell me you don't do this for a living.

We are talking about live servers. Monitoring should detect server going down, raising suspicion of a physical attack.

The evil maid attack would be useful against the system admin's workstation. Securing NOCs is beyond the scope of this discussion, but it is not difficult.