Linode Hacked, Credit Cards and Passwords Leaked

An anonymous reader writes "On Friday Linode announced a precautionary password reset due to an attack despite claiming that they were not compromised. The attacker has claimed otherwise, claiming to have obtained card numbers and password hashes. Password hashes, source code fragments and directory listings have been released as proof. Linode has yet to comment on or deny these claims."

Comments

Oh FFS

[kernelpanicked]

Linode hacked again!? Seriously, for the premium they're charging, beefing up security might do well to be added to their todo list.

Re:Oh FFS

[Anonymous Coward]

Besides it looks like the breach was beyond their direct control and was a flaw in cold fusion.

Except ryan_ in the chatlogs (which you obviously didn't bother to read) stated that Linode has set up their ColdFusion environment in a very insecure way. They apparently don't follow best practices. Not saying ColdFusion isn't shit, but it's still Linode's fault.

Re:Oh FFS

[SteveSommers]

Based on the limited information released, I'm not sure how anyone could make the claim "was beyond their direct control and was a flaw in cold fusion." I use ColdFusion everyday and most of the "vulnerabilities" reported can be avoided by using best practices -- the biggest being to remap the CFIDE directory to an empty directory and then add a virtual SCRIPTS directory under it pointing it back to the original CFIDE/SCRIPTS location. This one best practice prevents 99+% or the ColdFusion vulnerabilities. Most likely, preventing the breach was in their control.

Re:Oh FFS

[SteveSommers]

...Linux can't be hacked.

@Anonymous Coward, With this statement alone you lost any and all credibility you might have had.

Re:Almost signed up Friday morning, too...

[Anonymous Coward]

Dreamhost

Out of the frying pan...

Well, at least Dreamhost is pretty open about when they fuck up.

Re:Almost signed up Friday morning, too...

[NitzJaaron]

I've used them for shared hosting for years, and it's been a hell of a frustration. That said, however, their VPS service actually has a good record. For the discounted price they offered me (based on the absolutely horrific service for the last few months) I couldn't refuse. It was a really good deal.

Some more details

[Necroman]

Some details that people have been able to find so far.

1) The guy claimed to have hacked ColdFusion using some 0-day exploit. He could have just been going off this recent Adobe bulletin. But this bulletin was before the Linode announcement, so who knows. http://www.adobe.com/support/security/bulletins/apsb13-10.html

This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387).
This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388).

2) One of the files in the directory list that has a unique name is actually accessible on linode.com: http://www.linode.com/y_key_57284cb2de704e02.html

3) Looks like seclists (nmap people) were targeted by this hack: http://seclists.org/nmap-dev/2013/q2/3

4) It is not clear if credit cards were compromised or not. While this "ryan" guy claims they were, we won't know unless the list is published or Linode admits to it.

So-called "Cloud" still not trustworthy

[Anonymous Coward]

There has to come a point in time where the law holds responsible online providers. Security is a process, not a product. It should be law that ALL companies must audit their code and processes at least twice a year. Look at OpenBSD, for example. Yes, it's an operating system, but they have the almost perfect record they have because of audits. Banks have audits. Companies fall under audit regulations. NIST 800-53 needs to be required of every company doing business on the Internet that holds or processes personal data.

Re:Nonsense

[cheater512]

ColdFusion got exploited which is made by our friends at Adobe who just love riddling their products with security flaws.

Re:Nonsense

[Anonymous Coward]

ColdFusion got exploited which is made by our friends at Adobe who just love riddling their products with security flaws.

Your friends at Adobe published a lockdown guide that Linode ignored and patched this exploit months ago (also ignored by Linode) Adobe has done their part, but they can't force admins to secure their servers properly and install patches.

Re:So-called "Cloud" still not trustworthy

[Ambassador Kosh]

Are you willing to pay higher fees to have that auditing done? What I have seen is that when given a choice a customer chooses the lowest cost option no matter what. They won't pay for security audits and that means if someone else is willing to give up on security they can charge less and you will lose the business.

Capital One - not in my wallet!

[dclozier]

I used to think the same thing until I ended up paying for some charges I didn't make. Capital One's team of investigators concluded that the charges were my responsibility. I've been running Linux on the desktop for over 10 years now so I know it wasn't a trojan or some other malware on my end giving up the card number - it had to be an online service somewere that was hacked. I never found out who or how. I only ended up owing money for iPower Web hosting (would never in a million years use their service to start with), various gourmet coffee that was delivered to my house (ok I do like coffee but still wouldn't have ordered it online), video professor videos on using Microsoft Office (you know, if I should ever go back to Windows this may be handy???) and colon cleanser. WTF? I don't think they really did any investigating - just waited for a bit and then said it was my fault. Capital One offers no protection.

Re:Capital One - not in my wallet!

[MyHair]

Have to give props to AMEX here. While traveling for a living I apparently got my card skimmed shortly before a flight home Friday. They called me at my connecting airport, we discussed which charges were mine and which weren't. They canceled my card and had a replacement card ready to pick up within a few miles of my house on Saturday so when I flew out Sunday night I had my new card for the rent car and hotel. (It was a corporate card; I don't know if that makes a difference.) I was briefly concerned when the fraudulent charges showed up on my balance on the website, but they took them off again before I started getting antsy about the fraudulent-claim window.

I suppose it might have helped my case that my travel was on the East coast, I live in TX and the fraudulent charges were in CA.

(And btw...traveling for a living sucks!)

Seriously, whats Linode?

[Gothmolly]

What is Linode? Would it kill an editor to include that in TFS?

Re:Nonsense

[drinkypoo]

Why drop a productive platform when all you need is to configure correctly and stay patched?

Good question. What does it have to do with this case? They're using ColdFusion.

Coincidence... or not.

[angst_ridden_hipster]

Over the weekend, I got a lot of spurious charges on the credit card I use for my Linode account. Charges from several different countries, for various amounts that looked like automated "is this card valid?" type probes. The bank shut it down, but not before I got paged a bunch of times.

Then again, the odds are just as good that a waiter at some restaurant uploaded my number to some IRC channel to get back at me for my guest's order being too complicated or something.