Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story around the Linode hack

straylig.ht

Post reply on HN
Print view View original

41–50 of 175 posts

Re: The story around the Linode hack

#41

Post by VLM »

tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

"because you know, that's a good target to burn registrar access on and all"

No, nearly ideal use. Its like a strategic nuclear weapon. You don't use it sneakily, that's the opposite of the whole point. Always intimidate as publicly as possible and in the tech community messing with linode is about as public as it gets.

The other part is showing off, its like declaring "we have access to them all but we don't care about name.com". Maybe they do...

Re: The story around the Linode hack

#42

Post by conductor »

canttestthis wrote: post #23
conductor wrote: post #17

Earlier quoted context omitted.

Well then you are not a hacker. And I hope FBI can not cause trouble for them, they did not do anything unethical in my POV. The server is not a house. Black hat hacking is a mixture of art and politics (I never support hackers who hack for stealing money), and if you want the analogy, they just spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doo…

Please give me the password to your regular email account so I can read your emails. I won't delete any of them, but your email server is not a house, and I should have the right to read your emails.

A right? I didn't say they have a right. They hacked into. Did the US/Israel have a _right_ to use Stuxnet against Iran? No. They hacked into. When did you accuse the US secret service or hope that they will be punished? Double standards?

I won't give my email or its password to you, but if you can find it, hack it and decrypt my emails, then it would be only my fault, and you will have my respect.

Re: The story around the Linode hack

#43

Post by dermotbrennan »

amitdugar wrote: post #34

Slightly OT, Is it possible to have a web application (using popular tech like RoR, PHP etc.) that cannot be cracked by anyone ?

It's ultimately unknowable but I think it's possible to have a very secure system. You just have to take a holistic approach and look at everything in the stack from top to bottom, keep on top of security updates and use the right security procedures. After all that you'll still never know whether it's secure or not...

Re: The story around the Linode hack

#44

Post by rip747 »

i'll never understand why way back in the day, someone thought that it would be a good idea to put all the scripts for the extension tags (like cfform) under the same parent directory (CFIDE) as the administrator.

Re: The story around the Linode hack

#45

Post by kokey »

mappu wrote: post #11

Definitely worth reading the full zine, some scary stuff in there (including very readable python LFI-based exploits for unpatched MoinMoin and ColdFusion). Highlights: 1900+ days uptime on a sparc box somewhere in sourceforge.net, root on ICANN, root on Debian repositories..

I've seen longer uptimes on Solaris sparc boxes, many times, when they had a board of battery replaced and they booted up with a reset clock which got corrected by NTP after boot.

Re: The story around the Linode hack

#46

Post by antihero »

The ColdFusion hack...wow. How is CF engineered so badly? What person nowadays would still think to take paths of anything at all ever in the request parameters? I can sort of understand pre 2003 or something, but CF10 was released in 2012, for Pete's sakes.

Also makes you wonder, if there are holes like this, how many more holes like this are there? Especially if this is a pattern across the system.

Re: The story around the Linode hack

#47

Post by jstanley »

conductor wrote: post #17
davidw wrote: post #15

Earlier quoted context omitted.

> tried to cause trouble for HTP. Here's hoping the FBI "causes trouble" for the lot of them. Breaking into other people's stuff is not cool. If I leave my door open by mistake, yes, that makes me a bit absent minded, or foolish, but it does not give anyone the right to wander into my house.

Well then you are not a hacker. And I hope FBI can not cause trouble for them, they did not do anything unethical in my POV. The server is not a house. Black hat hacking is a mixture of art and politics (I never support hackers who hack for stealing money), and if you want the analogy, they just spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doo…

"spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doors."

And then collected private information of everybody who works for or is a customer of the institution, and then threatened the owners of the institution if they spoke out about what had happened.

Re: The story around the Linode hack

#48

Post by antihero »

amitdugar wrote: post #34

Slightly OT, Is it possible to have a web application (using popular tech like RoR, PHP etc.) that cannot be cracked by anyone ?

You can monitor exploit sites, but zero days are always possible and what will lead to serious hacks like this. So no, you can never be sure.

The best thing is to keep your eye on the culture of the developers and how seriously they take security - for instance the Ruby on Rails developers ignored exploits/reports until people blew them wide open. Now, if some other hacker had known about that before the disclosure, they could have owned any RoR sites.

From my experience, Django seems to be the best, and has not had any unfixed vulnerabilities for a while (though, due to it's complexity, it's completely possible that 0days exist). However, if I'm running Django sites and some do get owned, I can tell my boss/client/self/whatever that I did everything possible to prevent it happening.

There is no such thing as 100% secure, however, it's fairly reasonable to be hardened to all but the most dedicated crackers.

With an attack like HTP's, there's no fucking way anyone could have been expected to prevent, without running their entire own infrastructure, because they owned registras, Linode's LISH shell (so they get near-physical access to your Linode), and various other crap. If your boss were to fire you for getting owned in this attack, despite it preeetty much being zero of your own fault, they would be in the wrong (unless you have the resources to not depend on anyone).

Post reply on HN