First mistake: using Coldfusion. Second mistake: keeping it.
The story around the Linode hack
91–100 of 175 posts
Re: The story around the Linode hack
#92Earlier quoted context omitted.
[deleted]
It said " not redirect from http to https" -- meaning that when someone requests http://example.com they would normally be redirected by the site owner to https://example.com , but the attacker could just leave the original request alone. The point is that most people wouldn't notice. HTTPS Everywhere or similar browser plugin would probably pop up an alert if this did happen.
HTTP Strict Transport Security[1] is designed specifically to prevent that attack. Unfortunately, Linode's manager doesn't seem to use it:
$ curl -I https://manager.linode.com/
HTTP/1.1 200 OK
Server: nginx/0.7.65
Date: Tue, 07 May 2013 16:23:07 GMT
Content-Type: text/html;charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
$ curl -sI https://github.com | fgrep Strict
Strict-Transport-Security: max-age=2592000
Not sure why Linode isn't using HSTS — lack of awareness? The super-old version of Nginx is also a little scary.
[1] https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
Re: The story around the Linode hack
#93Earlier quoted context omitted.
You'd be using network sockets, not pipes (pipes are slow as fuck btw). And it would add the latency of the network transmission in both directions, plus the processing time, which would add up to much more than 5ms unless you're on the same network segment as your target. And higher CPU load increases latency. Who is going to notice increased latency in DNS queries? Most likely web developers. Nobody else I can thin…
> Unless it's becoming a problem, I think anyone would ignore increased latency because they have ten other work tasks to deal with. You'd be surprised once you start working with larger, higher-traffic infrastructures. If our average external DNS query rises 200ms, my phone goes off. There's more slack on p99, but it's also monitored. All of the timings for the various parts of a request to the system that I adminis…
That monitoring sounds awesome. What is it? Is it available to the public? Which method do you use to graph the data?
Re: The story around the Linode hack
#94Earlier quoted context omitted.
It's also a machine that generates dumbed-down conversation. The natural slant on IRC is away from intelligent discourse and toward a cross between texting and one-line jokes with friends. There's nothing inherently wrong with this. But it does foster negativity much of the time. I know hundreds of people who dedicate their lives to the drama and bullshit that is spawned solely by being in an IRC channel. If it went…
The natural slant on IRC is away from intelligent discourse and toward a cross between texting and one-line jokes with friends. What? I could name 20 channels of the top of my head this is not true for.
tech-oriented channels? Care to name any?
Re: The story around the Linode hack
#95Earlier quoted context omitted.
> The access that HTP obtained does not, full stop, lead to root on Linode instances without at least one shutdown job or change of root password job showing up in your Linode's history that you did not ask for. If they had access to the database, it may have been possible to delete malicious jobs from people's histories. Even if the user had email notifications turned on, an attacker with full access to the database…
That's a good point and I hadn't considered it. It still reboots your Linode, though; worth considering a 'echo "I just rebooted! Did you expect that?" | mail' in your rc.local for this reason, since a reboot should be an infrequent event.
yeah, but will likely reboot it into recovery mode so they can remove anything like that from your boot sequence anyway, and if they don't notice it, they will be done by the time it goes out anyway. External monitoring is the best way to notice the node went down.
Re: The story around the Linode hack
#96Here's an attempt at an explanation/translation: HTP ("Hack The Planet") is a group that likes to break into things. Another (unnamed) group of people impersonated a third group of people ("ac1db1tch3z") and tried to cause trouble for HTP. The impersonators located HTP by examining one of HTP's botnets (a collection of compromised computers that are used to launch things like denial of service attacks). Botnets have…
This translation makes more sense.
If this is all true, this is a great story and I want to make a movie out of this.
Also, who cares that Linode got hacked. Facebook/Twitter have more information on you than Linode, and they share it with the Gov. The only thing that I wouldn't want is my data to be lost (if i didn't have any backups)
Just a personal opinion.
Re: The story around the Linode hack
#97Here's an attempt at an explanation/translation: HTP ("Hack The Planet") is a group that likes to break into things. Another (unnamed) group of people impersonated a third group of people ("ac1db1tch3z") and tried to cause trouble for HTP. The impersonators located HTP by examining one of HTP's botnets (a collection of compromised computers that are used to launch things like denial of service attacks). Botnets have…
lol i think this story can be filmed.
Re: The story around the Linode hack
#98Earlier quoted context omitted.
The natural slant on IRC is away from intelligent discourse and toward a cross between texting and one-line jokes with friends. What? I could name 20 channels of the top of my head this is not true for.
tech-oriented channels? Care to name any?
Thousands of them actually http://irc.netsplit.de/channels/?net=freenode
Re: The story around the Linode hack
#99Earlier quoted context omitted.
A right? I didn't say they have a right. They hacked into. Did the US/Israel have a _right_ to use Stuxnet against Iran? No. They hacked into. When did you accuse the US secret service or hope that they will be punished? Double standards? I won't give my email or its password to you, but if you can find it, hack it and decrypt my emails, then it would be only my fault, and you will have my respect.
You're not getting it. No one is saying that Stuxnet was "right". That conversation is set in an entirely different context than the Linode hack. Iran is seeking to produce a nuclear weapon with the openly stated goal of launching it against another country. There is no segue from Stuxnet to this Linode hack. "Fault" is not in question here either. Let's say I leave my front door unlocked. If you enter my home withou…
[deleted]
Re: The story around the Linode hack
#100Earlier quoted context omitted.
A right? I didn't say they have a right. They hacked into. Did the US/Israel have a _right_ to use Stuxnet against Iran? No. They hacked into. When did you accuse the US secret service or hope that they will be punished? Double standards? I won't give my email or its password to you, but if you can find it, hack it and decrypt my emails, then it would be only my fault, and you will have my respect.
You're not getting it. No one is saying that Stuxnet was "right". That conversation is set in an entirely different context than the Linode hack. Iran is seeking to produce a nuclear weapon with the openly stated goal of launching it against another country. There is no segue from Stuxnet to this Linode hack. "Fault" is not in question here either. Let's say I leave my front door unlocked. If you enter my home withou…
Offtopic, but have you got a source for "Iran is seeking to produce a nuclear weapon with the openly stated goal of launching it against another country."
I had a quick look on the Wikipedia page but couldn't see anything there.