4 ms·

This is at least the fifth time I can count that linode has been hacked, really? Maybe it's time to ditch that coldfusion stack? Edit: 1.The bitcoin hacks, Ma

by ryanlol 11y ago

This is at least the fifth time I can count that linode has been hacked, really? Maybe it's time to ditch that coldfusion stack? Edit: 1.The bitcoin hacks, March 2012 2.HTP hack, April 15, 2013 (CF exploit) 3.Second HTP hack April 16, 2013 (Another CF exploit) 4.MySQL server that allowed anonymous logins (?!?!) January 19, 2014 5.This hack I'm not counting their domain name and various other parts of their infrastructure provided by third parties being compromised, but if I was the list would be significantly longer.

ddevault 11y ago
>Maybe it's time to ditch that coldfusion stack? [Linode developer here] Been working on (re)writing things in Python since I started. It takes a while, but I think everyone recognizes that the CF codebase is difficult to maintain. The good news is that significant progress is being made and we're still doing routine audits of the existing stuff.
- ryanlol 11y ago
  >we're still doing routine audits of the existing stuff. This doesn't work, auditing coldfusion code is impossible without auditing the entire platform. The whole platform is so full of bugs and strange behaviour that it's actually impossible to produce secure coldfusion code.
  - Sir_Cmpwn 11y ago
    I can't really deny that CF is that bad, but it'd be irresponsible to just let the codebase rust as we rewrite it - and we are rewriting it.
    - ryanlol 11y ago
      When did you start rewriting it? It doesn't take years to replace this stuff.
      - ddevault 11y ago
        I was hired in July and have been driving most of this effort and we're shipping rewritten versions of some parts of our infra soon™
        StavrosK 11y ago
        That sounds good, at least, thanks for letting us know.
      - deleted 11y ago
        [deleted]
mapgrep 11y ago
I was just thinking the same thing. I've been a customer for >10 years but this is getting ridiculous. First 2013 attack was apparently exacerbated by cleartext password storage for LISH (their management shell) and API tokens https://marco.org/2013/04/16/linode-hacked https://marco.org/2013/04/16/linode-hacked The 2012 Bitcoin attack involved a breach of Linode's customer service portal http://arstechnica.com/business/2012/03/bitcoins-worth-228000-stolen-from-customers-of-hacked-webhost/ http://arstechnica.com/business/2012/03/bitcoins-worth-22800... Today's attack is some kind of unspecified or unknown breach involving Linode manager. I guess the obvious commonality here is that all the attacks target the "soft" Linode layers AROUND managing deploys of Linux and Xen/KVM/UML rather than the "hard" targets of those widely used systems. This also happens to be the layer where Linode should be adding value (as opposed to the cheaper VPS providers out there) and I think it's increasingly troublesome that they continue to have such severe security issues. Is this company (CEO - Christopher Aker) not investing in security staff, security training, best practices etc, or are they investing tons and just getting breached because they host so many sites? Unclear. But it's easy to imagine it's the former, from the outside, given all these incidents.
- ryanlol 11y ago
  Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.
  - sarciszewski 11y ago
    For those not in the know, ryanlol was one of the people on the team involved in the 2013 hacks.
    - throway-not-909 11y ago
      Really? Thomas Asaro told us they were all in jail.
      - ryanlol 11y ago
technion 11y ago
MySQL server that allowed anonymous logins Has anyone got more information on this? Various Google searches keep pointing me at the other four hacks.
- ryanlol 11y ago
  https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/ https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-... They try to downplay it pretty hard.
  - technion 11y ago
    Thanks for this link. Although it talks about: database accessed using old forum credentials So I'm not sure "anonymous login" would be an entirely accurate description.
    - ryanlol 11y ago
      The server would in fact accept any credentials as it had been started with --skip-grant-tables. Tested it myself.
    - deleted 11y ago
      [deleted]

by ryanlol 11y ago

ddevault 11y ago

>Maybe it's time to ditch that coldfusion stack? [Linode developer here] Been working on (re)writing things in Python since I started. It takes a while, but I think everyone recognizes that the CF codebase is difficult to maintain. The good news is that significant progress is being made and we're still doing routine audits of the existing stuff.

ryanlol 11y ago
>we're still doing routine audits of the existing stuff. This doesn't work, auditing coldfusion code is impossible without auditing the entire platform. The whole platform is so full of bugs and strange behaviour that it's actually impossible to produce secure coldfusion code.
- Sir_Cmpwn 11y ago
  I can't really deny that CF is that bad, but it'd be irresponsible to just let the codebase rust as we rewrite it - and we are rewriting it.
  - ryanlol 11y ago
    When did you start rewriting it? It doesn't take years to replace this stuff.
    - ddevault 11y ago
      I was hired in July and have been driving most of this effort and we're shipping rewritten versions of some parts of our infra soon™
      - StavrosK 11y ago
        That sounds good, at least, thanks for letting us know.
    - deleted 11y ago
      [deleted]

mapgrep 11y ago

I was just thinking the same thing. I've been a customer for >10 years but this is getting ridiculous. First 2013 attack was apparently exacerbated by cleartext password storage for LISH (their management shell) and API tokens https://marco.org/2013/04/16/linode-hacked https://marco.org/2013/04/16/linode-hacked The 2012 Bitcoin attack involved a breach of Linode's customer service portal http://arstechnica.com/business/2012/03/bitcoins-worth-228000-stolen-from-customers-of-hacked-webhost/ http://arstechnica.com/business/2012/03/bitcoins-worth-22800... Today's attack is some kind of unspecified or unknown breach involving Linode manager. I guess the obvious commonality here is that all the attacks target the "soft" Linode layers AROUND managing deploys of Linux and Xen/KVM/UML rather than the "hard" targets of those widely used systems. This also happens to be the layer where Linode should be adding value (as opposed to the cheaper VPS providers out there) and I think it's increasingly troublesome that they continue to have such severe security issues. Is this company (CEO - Christopher Aker) not investing in security staff, security training, best practices etc, or are they investing tons and just getting breached because they host so many sites? Unclear. But it's easy to imagine it's the former, from the outside, given all these incidents.

ryanlol 11y ago
Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.
- sarciszewski 11y ago
  For those not in the know, ryanlol was one of the people on the team involved in the 2013 hacks.
  - throway-not-909 11y ago
    Really? Thomas Asaro told us they were all in jail.
    - ryanlol 11y ago

technion 11y ago

MySQL server that allowed anonymous logins Has anyone got more information on this? Various Google searches keep pointing me at the other four hacks.

ryanlol 11y ago
https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/ https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-... They try to downplay it pretty hard.
- technion 11y ago
  Thanks for this link. Although it talks about: database accessed using old forum credentials So I'm not sure "anonymous login" would be an entirely accurate description.
  - ryanlol 11y ago
    The server would in fact accept any credentials as it had been started with --skip-grant-tables. Tested it myself.
  - deleted 11y ago
    [deleted]