Slashdot Mirror
Linode Hacked, Credit Cards and Passwords Leaked
An anonymous reader writes "On Friday Linode announced a precautionary password reset due to an attack despite claiming that they were not compromised. The attacker has claimed otherwise, claiming to have obtained card numbers and password hashes. Password hashes, source code fragments and directory listings have been released as proof. Linode has yet to comment on or deny these claims."
Linode hacked again!? Seriously, for the premium they're charging, beefing up security might do well to be added to their todo list.
Ubuntu: If at first you don't succeed, blindly slap a sudo in front of it
But Linux is impenetrable to hacking. This sounds like M$ FUD to me.
I'd just finished doing a week of research for a VPS and was literally going to sign up for Linode Friday AM when Dreamhost woo'ed me with a better deal. Geez.
Gosh, 4/15 already. I hope you're one of the lucky 49% that gets to pay taxes. Me, I paid $20,000. What's your fair share?
From the link:
05:05 Hey I can tell you
05:05 exact details of the attack
05:05 manager.linode.com was breached with a coldfusion exploit
05:05 it was compromised for a couple of weeks
Some details that people have been able to find so far.
1) The guy claimed to have hacked ColdFusion using some 0-day exploit. He could have just been going off this recent Adobe bulletin. But this bulletin was before the Linode announcement, so who knows. http://www.adobe.com/support/security/bulletins/apsb13-10.html
2) One of the files in the directory list that has a unique name is actually accessible on linode.com: http://www.linode.com/y_key_57284cb2de704e02.html
3) Looks like seclists (nmap people) were targeted by this hack: http://seclists.org/nmap-dev/2013/q2/3
4) It is not clear if credit cards were compromised or not. While this "ryan" guy claims they were, we won't know unless the list is published or Linode admits to it.
Its not what it is, its something else.
There has to come a point in time where the law holds responsible online providers. Security is a process, not a product. It should be law that ALL companies must audit their code and processes at least twice a year. Look at OpenBSD, for example. Yes, it's an operating system, but they have the almost perfect record they have because of audits. Banks have audits. Companies fall under audit regulations. NIST 800-53 needs to be required of every company doing business on the Internet that holds or processes personal data.
1. hacked, owned. "My server was linode."
2. predictably incompetent, esp. when at a level that causes laughter.
Fuck VPS when you can get a i3/8GB server for 39 Canadain.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Title: "credit cards and pass"
TFS: "hashes of passwords leaked
That's a HUGE difference. Proper hashes of proper passwords may as well be public. It'd take billions of years to crack them. Unless of course Linode is still living in 1972 and using DES hashes, which may as well be plain text.
Linode, if you WERE using DES hashes, call me. We have some work to fo on your susyems. The people who designed your systems clearly aren't knowledgeable enough in security that they can be trusted to fix the problems they created.
Seems light on proof and heavy on speculation.
I'm certainly glad when I was looking for a VPS, Linode was quite a bit more expensive than the one I was recommended. For the price they charge, I'd expect better security.
Are you willing to pay higher fees to have that auditing done? What I have seen is that when given a choice a customer chooses the lowest cost option no matter what. They won't pay for security audits and that means if someone else is willing to give up on security they can charge less and you will lose the business.
Computer modeling for biotech drug manufacturing is HARD!
I used to think the same thing until I ended up paying for some charges I didn't make. Capital One's team of investigators concluded that the charges were my responsibility. I've been running Linux on the desktop for over 10 years now so I know it wasn't a trojan or some other malware on my end giving up the card number - it had to be an online service somewere that was hacked. I never found out who or how. I only ended up owing money for iPower Web hosting (would never in a million years use their service to start with), various gourmet coffee that was delivered to my house (ok I do like coffee but still wouldn't have ordered it online), video professor videos on using Microsoft Office (you know, if I should ever go back to Windows this may be handy???) and colon cleanser. WTF? I don't think they really did any investigating - just waited for a bit and then said it was my fault. Capital One offers no protection.
What is Linode? Would it kill an editor to include that in TFS?
I want to delete my account but Slashdot doesn't allow it.
If you regulate an industry, ALL must do it. There is no cheap alternative because it is mandatory. The free market isn't going to do it because taking the risk is worth pennies to most consumers who are NOT thinking of all the potential risks involved if they even are aware of a couple of the long list of risks.
Making people do something across the board always raising BS opposition but when it is applied uniformly (it usually is) there is no impact on the market (because the added costs are usually too low to matter, especially for large markets.)
Obviously, there are issues of making it FAIR and uniform in this age of global markets and we are not properly addressing these issues because of the propaganda and the resulting dysfunction. Most states lose income from sales tax and regulations because of their interstate commerce limitations. Either fix that or give up and raise revenue by other means.
Oh, BTW, drug lords are "job creators" who are not deterred by a war being waged against their business (can you get more severe than regulating the business is illegal? yeah, you can wage an unconstitutional war against it.) Somebody will want the money bad enough to provide the service to those willing to pay. The only real factor is how many customers will pay what it costs to support the industry. The regulations can be far more severe.
Democracy Now! - uncensored, anti-establishment news
Over the weekend, I got a lot of spurious charges on the credit card I use for my Linode account. Charges from several different countries, for various amounts that looked like automated "is this card valid?" type probes. The bank shut it down, but not before I got paged a bunch of times.
Then again, the odds are just as good that a waiter at some restaurant uploaded my number to some IRC channel to get back at me for my guest's order being too complicated or something.
Eloi, Eloi, lema sabachtani?
www.fogbound.net
I said "proper hashes of proper passwords". You replied "people pick useless passwords". Yeah, if you let them use "password" as their password it'll be cracked. More news at 11:00. That's why I said "proper passwords".
So where is this so called leak? He claims he was going to post the cc details? Has he?
A bit of comment would be nice...
I got the email. It's not enough.
I realize that nobody can or should waste their breath every time someone runs their mouth off on IRC. But for better or worse, this guy is indirectly being quoted on Slashdot. Someone called you out, and it's IN PUBLIC now. Linode needs to either admit or rebut some of the claims "ryan" made, above and beyond the mere fact that a Lish compromise happened.
My monthly emails of the bills only go back to 2007 but I think I've been using Linode since 2004. Not sure. But as much as I want to give them the benefit of the doubt, the lack of comments on specifics, reads like an admission that this "ryan" guy is telling it like it is. Linode, really, you don't want me thinking that. It's been a reliable monthly payment for an almost wastefully-underused VPS, going back literally so many years that I can't remember. Don't let it end like this, with your silence.
According to the linked chat log Linode is storing the lish passwords in plain text!!
I'd suggest you at least change your lish password...
This saddens me a lot, I had much more faith in Linode and make me look like a fool for recently recommending them to others.
I really wish Linode would come forward with the whole facts on this saga, and let us users know what has really been exposed/compromised.
Never happened. True story.
"Full ssh and root access" in the features list
http://blog.linode.com/2013/04/16/security-incident-update/ However I'm not knowledgeable enough wrt security to say if it's just damage control or not.
A CC-licensed illustrated horror novel
I haven't seen ColdFusion mentioned since the early 2000s - people still use it? I thought it had joined CORBA and MicroFocus COBOL in the museum of obsolete technologies from the 90s.
Looks like they've frozen the comments for the breach notification (http://blog.linode.com/2013/04/12/security-notice-linode-manager-password-reset/) -- still no updates from Linode -- Customer Service Fail -- Oh, how I miss Slicehost :(
Why is Linode storing credit card numbers anyway?
With FastSpring, Amazon, PayPal, and all the banks offering payment services rolling your own solution is just inviting trouble.
Linode is overpriced anyway.
Fuck them