Linode Resets Passwords After Credentials Leak (linode.com) 55
New submitter qmrq sends news that Linode, a major provider of virtual private servers, has been compromised again. In a blog post, they said, "A security investigation into the unauthorized login of three accounts has led us to the discovery of two Linode.com user credentials on an external machine. This implies user credentials could have been read from our database, either offline or on, at some point. The user table contains usernames, email addresses, securely hashed passwords and encrypted two-factor seeds." The Linode team said it found evidence of unauthorized access to three customer accounts. They don't yet know who is behind the attacks.
An employee for PagerDuty said they were compromised through Linode Manager all the way back in July. "In our situation the attacker knew one of our user's passwords and MFA secret. This allowed them to provide valid authentication credentials for an account in the Linode Manager. It's worth noting that all of our active user accounts had two-factor authentication enabled. ... We also have evidence from access logs provided by Linode that the attackers tried to authenticate as an ex-employee, whose username ONLY existed in the Linode database."
An employee for PagerDuty said they were compromised through Linode Manager all the way back in July. "In our situation the attacker knew one of our user's passwords and MFA secret. This allowed them to provide valid authentication credentials for an account in the Linode Manager. It's worth noting that all of our active user accounts had two-factor authentication enabled. ... We also have evidence from access logs provided by Linode that the attackers tried to authenticate as an ex-employee, whose username ONLY existed in the Linode database."
Sounds like someone really hates them. (Score:3)
Re: (Score:2)
i don't understand why they still haven't made 2 factor authentication mandatory.
Again? (Score:2)
Re: (Score:2)
Tinfoil hat much
Re: (Score:2)
Right of course. The intelligence community was exposed for intercepting every electronic communication they could and were allowed to continue doing so until private businesses were able/compelled to do it for them, and continually compromise and publicly undermine encryption. But imagining that they're actually using the power they've accumulated... that's paranoid and anyone suggesting it should be mocked.
It's not like the old days where you had to pay attention and make inferences, the stuff is public r
Re: (Score:2)
Right of course. The intelligence community was exposed for intercepting every electronic communication they could and were allowed to continue doing so until private businesses were able/compelled to do it for them, and continually compromise and publicly undermine encryption. But imagining that they're actually using the power they've accumulated... that's paranoid and anyone suggesting it should be mocked.
The AC said: "Hacking those systems is worth billions of dollars". That doesn't suggest NSA interception, that suggests a commercial endeavor to hack AWS and Azure. Those are two different things.
Re: (Score:2)
It helps to actually read the thing someone's replying to. Here's the whole thread up to your response, with my emphasis added:
Could public cloud providers be penetrated in such a way that all your data and activities belong to NSA, China, etc?
They probably already are. The reason you won't hear about it is because the people that break in to systems like that are very careful to go unnoticed. Hacking those systems is worth billions of dollars.
Tinfoil hat much
But to your inference, the intelligence community also sees monetary value in their interception and exploit programs, obviously, which is why they've invested in those programs. Bang for buck, investing in electronic intelligence almost certainly pays bigger dividends in aggregate than investing in human intelligence—at least that is what they must assume.
And with that said,
Re: (Score:2)
It helps to actually read the thing someone's replying to. Here's the whole thread up to your response, with my emphasis added:
Could public cloud providers be penetrated in such a way that all your data and activities belong to NSA, China, etc?
They probably already are. The reason you won't hear about it is because the people that break in to systems like that are very careful to go unnoticed. Hacking those systems is worth billions of dollars.
Tinfoil hat much
But to your inference, the intelligence community also sees monetary value in their interception and exploit programs, obviously, which is why they've invested in those programs. Bang for buck, investing in electronic intelligence almost certainly pays bigger dividends in aggregate than investing in human intelligence—at least that is what they must assume.
And with that said, if you were more preoccupied by the mention of China, and for some reason assuming corporate, rather than imperial, espionage... I'm even more at a loss at your accusation of paranoia.
None of this is relevant. The point is that nobody has made billions secretly hacking AWS and Azure. This is just FUD with no basis in reality.
As for China having backdoors to AWS and Azure, that's also absurd and it shows a very poor knowledge of the actual situation in China, where:
1) The government is not one big unified organization, but instead a bunch of small fiefdoms, a lot more similar to the EU than the USA
2) The technical capabilities are just not there; lots of noise and scanning, but still very
Re: (Score:2)
None of this is relevant. The point is that nobody has made billions secretly hacking AWS and Azure. This is just FUD with no basis in reality.
How many businesses do you think run on AWS and Azure? Considering revenue for AWS is at $2.1 billion dollars [time.com]. AWS also offers a cloud computing aimed at the Feds [amazon.com], which certainly wouldn't be of interest to anyone else out there.
Re: (Score:2)
None of this is relevant. The point is that nobody has made billions secretly hacking AWS and Azure. This is just FUD with no basis in reality.
How many businesses do you think run on AWS and Azure? Considering revenue for AWS is at $2.1 billion dollars [time.com]. AWS also offers a cloud computing aimed at the Feds [amazon.com], which certainly wouldn't be of interest to anyone else out there.
So what? That's like saying: there's billions of people driving cars out there so a brand new electric car that cost $500 and that goes 100,000 miles per charge would interest a lot of people. Doesn't mean someone has done it.
Re: (Score:2)
Re: (Score:2)
Here's what you say:
If you look closely at the thread the claim was that it's not worth billions to attempt to hack AWS.
Here's what was said in the thread:
Hacking those systems is worth billions of dollars.
I guess I'm not reading things closely enough.
Re: (Score:2)
None of this is relevant.
Then why the fuck did you reply to it?
Re: (Score:2)
None of this is relevant.
Then why the fuck did you reply to it?
Don't get your panties in a bunch. My point was that it's absurd to think that someone is making billions with their secret hacking of AWS and Azure, not that someone wouldn't make money if they did hack AWS or Azure.
You can agree or not with that, but saying that the NSA is evil or that AWS is making money doesn't shed any more light on the matter.
Re: (Score:2)
I still don't understand why you're shoving your random thoughts into a thread where you don't think the discussion is relevant. And gendering my underpants isn't any more enlightening.
Meh (Score:2)
I still don't understand why you're shoving your random thoughts into a thread where you don't think the discussion is relevant. And gendering my underpants isn't any more enlightening.
Here's my parting gift to you. Either nobody ever cared enough about you to let you know, or you're just too self-centered to acknowledge critics, but dude, you're not funny. You're obviously smarter than average, but you're not as clever and witty as you think. Odds are that when you walk away from a discussion (online or in real life) feeling like high-fiving yourself, you actually came out lame and smug.
I enjoy an entertaining flame war once in a while but that's just not happening with you.
Re: (Score:2)
I wasn't actually trying to be funny? I was trying to sincerely discuss the actual discussion that was actually happening around your comment, and I repeatedly asked why you weren't. But if personal attacks is your thing, don't let me stand in the way. I do actually have better things to do.
another spam hosting isp gets bit in the ass (Score:3)
I always find it amusing when a big spammy hosting provider gets pwned. Companies that ignore their spam problems usually tend to ignore their security problems too.
http://www.spamhaus.org/sbl/li... [spamhaus.org]
Re:another spam hosting isp gets bit in the ass (Score:4, Interesting)
The relationship between hosting companies and spammers is fascinating. I strongly recommend Krebs book on this topic, it makes for an entertaining and educating read (book is called "Spam Nation").
Checkout this post on his blog about spammers and IBM:
Last month, anti-spam group Spamhaus.org listed Softlayer as the “#1 spam hosting ISP,” putting Softlayer at the very top of its World’s Worst Spam Support ISPs index. Spamhaus said the number of abuse issues at the ISP has “rapidly reached rarely previously seen numbers.”
http://krebsonsecurity.com/201... [krebsonsecurity.com]
Re: (Score:2)
I'd take Spamhaus more seriously if many of their actions weren't just as bas as the spammers.
Like what?
Re: (Score:2)
"Without going into detail..."
In other words, you don't offer any evidence to evaluate. You don't like them, that is fine. Many spammers do not.
Re: (Score:2)
"Without going into detail..."
In other words, you don't offer any evidence to evaluate.
Yeah, just like my ex who kept accusing me of disrespecting her, but could never come up with a single specific incident because "there's too many of them"
Re: (Score:1)
only 8 listed ip's out of how many 10s of thousands they have? that's not a horrible track record compared to many hosts.
Re:another spam hosting isp gets bit in the ass (Score:4, Informative)
I always find it amusing when a big spammy hosting provider gets pwned. Companies that ignore their spam problems usually tend to ignore their security problems too.
http://www.spamhaus.org/sbl/li... [spamhaus.org]
As a Linode customer, this post was news to me and cause for concern.
But then I saw that Rackspace had 12:
http://www.spamhaus.org/sbl/listings/rackspace.com
and I was glad to have left for Linode after Rackspace bought Slicehost.
And saw that others were worse, with Dreamhost at 25:
http://www.spamhaus.org/sbl/listings/dreamhost.com
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
>I always find it amusing when a big spammy hosting provider gets pwned. Companies that ignore their spam problems usually tend to ignore their security problems too.
Seriously? If any of my users does anything even remotely annoying, like running Nmap, I'd immediately get a notification from their netops people. I'd shut the user down, and they'd write back and thank me.
I can't imagine a spammer lasting very long at all in an environment like that. They take their stuff very seriously there.
Re: (Score:2)
Re: (Score:2)
I have a Linode, as should be obvious from the context, and their netops people are very aggressive on clamping down bad behavior coming from their nodes.
Re: (Score:2)
Re: (Score:2)
>Ok so the users are people who pay you to run things on your linode? Why wouldn't they just get their own?
They're computer science students. I host a UNIX server for them on my own nickel because I don't want to graduate CS majors who don't know an ls from an rm. But being CS majors they occasionally do goofy things that need to be clamped.
And I do hope they get their own - a number have installed Linux on their PCs, or bought a RPi or whatever.
Anyhow, my point is that Linode doesn't seem to be the kind
Re: (Score:2)
Yes, spam they have to take seriously, but I'm surprised that they're contacting you about running Nmap.
Re: (Score:2)
Linode isn't one of those. You want real spam? Go look at ColoCrossing and its subsidiaries/resellers.
Where I work (Score:2)
Re: (Score:2)
I got our notification at 11:10am.
"
Hello,
As a precaution, Linode has expired Linode Manager passwords. You will be prompted to set a new password the next time you log into . If you haven't already done so, you should do this now.
For more information, please read our blog post:
We apologize for this inconvenience.
Thank you,
The Linode Team
"