Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story around the Linode hack

straylig.ht

Post reply on HN
Print view View original

81–90 of 175 posts

Re: The story around the Linode hack

#81

Post by druiid »

antihero wrote: post #46

The ColdFusion hack...wow. How is CF engineered so badly? What person nowadays would still think to take paths of anything at all ever in the request parameters? I can sort of understand pre 2003 or something, but CF10 was released in 2012, for Pete's sakes. Also makes you wonder, if there are holes like this, how many more holes like this are there? Especially if this is a pattern across the system.

There is a bunch of holes in CF like this. Look at their bug/security fix list for Coldfusion (Pretty much any version), and half of the security fixes are targeted to CFIDE based vulnerabilities. Any CF admin worth their salt disallows access to CFIDE as a matter of course.

Re: The story around the Linode hack

#82

Post by tiredofcareer »

peterwwillis wrote: post #74
sillysaurus wrote: post #40

Earlier quoted context omitted.

I wasn't speaking theoretically. I don't understand how a pipe read + string compare + pipe write would add 5ms per query. As for detection, that was the reason I brought up CPU power. Modern CPUs are so fast that that it seems like this redirector would hardly generate a blip in any chart (such as top). I don't care about proving anybody wrong. I care about filling my knowledge gaps. I.e. it's interesting to try to…

You'd be using network sockets, not pipes (pipes are slow as fuck btw). And it would add the latency of the network transmission in both directions, plus the processing time, which would add up to much more than 5ms unless you're on the same network segment as your target. And higher CPU load increases latency. Who is going to notice increased latency in DNS queries? Most likely web developers. Nobody else I can thin…

> Unless it's becoming a problem, I think anyone would ignore increased latency because they have ten other work tasks to deal with.

You'd be surprised once you start working with larger, higher-traffic infrastructures. If our average external DNS query rises 200ms, my phone goes off. There's more slack on p99, but it's also monitored.

All of the timings for the various parts of a request to the system that I administer are instrumented from a small libcurl app running in multiple ASNs remotely, because Pingdom and other services do not provide the resolution that we need. They are then rendered on a stacked graph that always lives on my third monitor, and any significant deviation averaged out over five minutes catches my eye.

I know it sounds like overkill, but it's crucial at scale.

Re: The story around the Linode hack

#83

Post by alan_cx »

conductor wrote: post #17
davidw wrote: post #15

Earlier quoted context omitted.

> tried to cause trouble for HTP. Here's hoping the FBI "causes trouble" for the lot of them. Breaking into other people's stuff is not cool. If I leave my door open by mistake, yes, that makes me a bit absent minded, or foolish, but it does not give anyone the right to wander into my house.

Well then you are not a hacker. And I hope FBI can not cause trouble for them, they did not do anything unethical in my POV. The server is not a house. Black hat hacking is a mixture of art and politics (I never support hackers who hack for stealing money), and if you want the analogy, they just spotted a fancy lock on the door of some institution (not a private house), lock-picked it and looked what's behind the doo…

I kinda get where you are coming from. I'm guessing you like the idea of sticking it to the man, as it were. Well, yeah, I like that too, I tend to lean to wards what these guys do, when it suits, but as ever, the problem is with intention and trust. Do you really trust them 100% to only look? The same people who do that could raid my current account, and none of us can be sure they wont. Or, sell on details to raise funds for their "great" works, or cynically line their pockets. We just don't know.

I think quite a number of people tread this fine line between approving of sort of Robin Hood types and criminals. And that can change given the target. So, "fantastic" if they embarrass the FBI, not so comfortable if its our bank.

Re: The story around the Linode hack

#85

Post by tiredofcareer »

VLM wrote: post #41
tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

"because you know, that's a good target to burn registrar access on and all" No, nearly ideal use. Its like a strategic nuclear weapon. You don't use it sneakily, that's the opposite of the whole point. Always intimidate as publicly as possible and in the tech community messing with linode is about as public as it gets. The other part is showing off, its like declaring "we have access to them all but we don't care ab…

They didn't utilize the access to go after Linode. They intended to utilize it to go after SwiftIRC, which nobody gives a shit about. That's where my comments came from. Linode just happened to be a nice prize on the way.

Re: The story around the Linode hack

#86

Post by mcintyre1994 »

tomjen3 wrote: post #67
tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

I don't give a shit about my (former) linode servers and never want to have anything to do with the bastards again. I just want to know one thing: did or didn't they leak the credit cards?

Not publicly, as far as I know. They claim to have deleted them, but I don't think it's exactly possible to prove you've deleted every copy of digital data. You should probably assume they're compromised.

Re: The story around the Linode hack

#87

Post by ikawe »

tomjen3 wrote: post #67
tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

I don't give a shit about my (former) linode servers and never want to have anything to do with the bastards again. I just want to know one thing: did or didn't they leak the credit cards?

Allegedly no, the deleted the breached data on the condition that Linode mention them in the security release (from the article).

Re: The story around the Linode hack

#88

Post by jeffasinger »

jrockway wrote: post #8
robk wrote: post #4

That seems somewhat scary if they've compromised domain registrars and are intercepting login data from client sites that way.

It's more scary if they've compromised a SSL CA. A simple DNS attack won't stop your browser from displaying a broken certificate warning. (Though they can always not redirect from http to https and most users won't notice, sadly.)

A 'simple' DNS attack would get them access to the mail servers too.

There are plenty of CAs out there who will give out a (non-EV) cert to anyone who can receive emails to webmaster@example.com.

Re: The story around the Linode hack

#89

Post by zoul »

tomjen3 wrote: post #67
tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

I don't give a shit about my (former) linode servers and never want to have anything to do with the bastards again. I just want to know one thing: did or didn't they leak the credit cards?

> I just want to know one thing: did or didn't they leak the credit cards?

Does it really matter? If your card was used with Linode, it should have been blocked by now anyway.

Re: The story around the Linode hack

#90

Post by ak217 »

tiredofcareer wrote: post #12

Some hopefully-helpful clarifications of the inside baseball talk from just the overview (I haven't read the full zine), enhanced with inside and general knowledge I've gained in my travels on this mortal coil: - HTP claims to have{, had} access to name.com, which Linode currently uses. This access enables an unauthorized party to update authoritative nameservers for your domain; i.e., if you host at Amazon, very lik…

Thanks for the overview.

> All it takes is one zero-day, and you will all be hit by one in your career, so cut Linode a little slack.

Actually, the biggest lesson I'm taking away from this is to never trust any one piece of software, and to always have multiple lines of defense/alerting sitting on independent software stacks.

Post reply on HN