Compromised Linode, thousands of BitCoins stolen

Post by ajross » Thu, Mar 01, 2012, 10:20 PM UTC

mrb wrote: post #34

jaredstenquist wrote: post #4

Since my $1,000 worth of bitcoins dropped in value to $150 over a period of weeks, I've become significantly less interested in using it as a currency.

You were gullible and invested at the peak of the bubble at $30/BTC (now worth $5/BTC). Any bubble would have crushed you, eg the dotcom stock market frenzy. Your fault. Bitcoin is up 400% over the last year (from $1 to $5/BTC), which has made it an excellent investment for other (smarter) investors not swayed by a bubble.

Post by lawnchair_larry » Thu, Mar 01, 2012, 10:21 PM UTC

3pt14159 wrote: post #24

mindstab wrote: post #16

How did the attackers know what they were looking for. I'm going to assume that it's a small minority of linode users who have bitcoins on their machines. How were just these users targeted so accurately? What tied together knowledge they used bitcoins to those VMs and their linode accounts? Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines…

Simplest answer is probably the right one in this case: Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it…

Post by gravitronic » Thu, Mar 01, 2012, 10:25 PM UTC

ajross wrote: post #36

3pt14159 wrote: post #24

Earlier quoted context omitted.

Simplest answer is probably the right one in this case: Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it…

I'd be very surprised (and suspicious) if they were running any kind of diangostics over their customer's data without an explicit signed contract. The liability worry there alone is scary.

Post by lawnchair_larry » Thu, Mar 01, 2012, 10:29 PM UTC

stevenbrianhall wrote: post #7

nbpoole wrote: post #3

So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind: 1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well? 2. Why can customer service representatives access and update servers without the client being no…

Regarding #1, an update from Linode was just posted: "Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."

Post by nbpoole » Thu, Mar 01, 2012, 10:30 PM UTC

stevenbrianhall wrote: post #7

nbpoole wrote: post #3

So, a customer service interface was compromised via stolen credentials and used to access various Linode instances. A couple questions that immediately come to mind: 1. Can this interface be accessed from anywhere on the Internet? If so, why? If not, does that mean other systems owned by Linode were compromised as well? 2. Why can customer service representatives access and update servers without the client being no…

Regarding #1, an update from Linode was just posted: "Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring."