6 ms·
Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.
by ryanlol 11y ago
Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.
- sarciszewski 11y agoFor those not in the know, ryanlol was one of the people on the team involved in the 2013 hacks.
- throway-not-909 11y agoReally? Thomas Asaro told us they were all in jail.
- ryanlol 11y agoNobody went to jail, I'm the only person being prosecuted. I won't go to jail.
- sarciszewski 11y agoI know of at least one other of the alleged HTP members who is not only not arrested, but still actively involved in the information security community. Then there are other personalities that went dark, whom are presumably also not arrested. Unless Thomas Asaro can name names, that was a bluff.
- throway-not-909 11y agoA customer warned Linode team about the exposed CF folder. CEO aggressively shrugged it off. "That doesn't matter, it's nothing, that's a non issue." Dev who was a bit of a suck up parroted the same telling support to shut up about it. This was six months before HTP happened.
- ryanlol 11y agoWe were aware of it for probably an year before anyone bothered to spend 10 minutes looking at coldfusion source. That's all the time it took.
- mapgrep 11y agoV interesting. Do any of the other VPS providers strike you as more secure alternatives?
- ryanlol 11y agoI'd avoid VPS providers in general, but AWS is on a whole different level than linode. They actually understand what they're doing well enough to do live xen patching etc. But yeah, people get hacked through their hosts all the time. Best approach is colo with minimum access for the dc staff.
- nickpsecurity 11y agoThat's been my recommend for a long time. Plus, I liked obfuscating with unusual CPU choices and network guards (esp for protocol layers). Worked wonders with about no effort outside setting up guards. Opponents throw so much x86 shellcode at your Alpha, etc boxes while never quite getting stuff to run.
- threeseed 11y agoThe best thing about the 2013 hack was that news of it was on Slashdot days before it was mentioned to customers. I've been consistently saying this for years. Linode is a joke and you would be crazy to use them for anything other than toy/non-critical use cases.