7 ms·

I wonder if this is a diversion to keep Linode's security team busy so they won't notice someone compromising the Xen nodes with XSA-185/6/7/8?

Scarbutt 10y ago
They switched to KVM.
- kawsper 10y ago
  As far as I know, not all VPSs are running KVM yet. I migrated my last VPS to KVM just yesterday.
  - stenius 10y ago
    They recently incentivized customers to switch to KVM again by doubling the ram but they haven't required a switch yet.
HappyTypist 10y ago
This happened last time.
mappu 10y ago
Fascinating, seems believable. XSAs are released alarmingly frequently. I've always wondered if KVM is really more secure or if it just gets less scrutiny (certainly there's a class of qemu vulnerabilities that impact both hypervisors).
- rodgerd 10y ago
  KVM is a much smaller code base, which probably helps.
technion 10y ago
I've noted the AWS security bulletins[0] list nearly every Xen advisory with "AWS customers' data and instances are not affected by these issues, and there is no customer action required." It would appear? you'd need to go back for quite a few months of being unpatched to find a genuine issue. Unless something about Amazon's mitigations don't apply universally. [0] https://aws.amazon.com/security/security-bulletins/ https://aws.amazon.com/security/security-bulletins/
- lmz 10y ago
  AWS (and other large hosts: https://www.xenproject.org/security-policy.html https://www.xenproject.org/security-policy.html search for predisclosure) get notified before the public.
- exhilaration 10y ago
  Amazon and other big cloud providers get xen security fixes first, there was an HN discussion about it. Some they've probably already implemented the fix.
mratzloff 10y ago
Apparently they came to the same conclusion—just a bit late. https://status.linode.com/incidents/frq9sz7dyb1x https://status.linode.com/incidents/frq9sz7dyb1x
- hyperpape 10y ago
  What in that article makes you think that? I don't see it. They do say "we'll have to upgrade Xen nodes", but they don't mention the DDoS or link them.
  - mratzloff 10y ago
    Why would they? Timing and the fact that it has happened before make it seem likely.
    - warbiscuit 10y ago
      The XEN update was a scheduled thing -- I got an email about it weeks ago (had one linode I hadn't moved to KVM), and it was already scheduled for this weekend. That said, I don't disagree that the attackers might be trying to distract the team while they exploit that... though I don't see what it gets them compared to quietly exploiting the XEN issues before they were common knowledge on 9/8.
    - hyperpape 10y ago
      You're the one who linked to the piece. I think it's your job to be clear that it doesn't say that, it's your conclusion.

Scarbutt 10y ago

They switched to KVM.

kawsper 10y ago
As far as I know, not all VPSs are running KVM yet. I migrated my last VPS to KVM just yesterday.
- stenius 10y ago
  They recently incentivized customers to switch to KVM again by doubling the ram but they haven't required a switch yet.

HappyTypist 10y ago

This happened last time.

mappu 10y ago

Fascinating, seems believable. XSAs are released alarmingly frequently. I've always wondered if KVM is really more secure or if it just gets less scrutiny (certainly there's a class of qemu vulnerabilities that impact both hypervisors).

rodgerd 10y ago
KVM is a much smaller code base, which probably helps.

technion 10y ago

I've noted the AWS security bulletins[0] list nearly every Xen advisory with "AWS customers' data and instances are not affected by these issues, and there is no customer action required." It would appear? you'd need to go back for quite a few months of being unpatched to find a genuine issue. Unless something about Amazon's mitigations don't apply universally. [0] https://aws.amazon.com/security/security-bulletins/ https://aws.amazon.com/security/security-bulletins/

lmz 10y ago
AWS (and other large hosts: https://www.xenproject.org/security-policy.html https://www.xenproject.org/security-policy.html search for predisclosure) get notified before the public.
exhilaration 10y ago
Amazon and other big cloud providers get xen security fixes first, there was an HN discussion about it. Some they've probably already implemented the fix.

mratzloff 10y ago

Apparently they came to the same conclusion—just a bit late. https://status.linode.com/incidents/frq9sz7dyb1x https://status.linode.com/incidents/frq9sz7dyb1x

hyperpape 10y ago
What in that article makes you think that? I don't see it. They do say "we'll have to upgrade Xen nodes", but they don't mention the DDoS or link them.
- mratzloff 10y ago
  Why would they? Timing and the fact that it has happened before make it seem likely.
  - warbiscuit 10y ago
    The XEN update was a scheduled thing -- I got an email about it weeks ago (had one linode I hadn't moved to KVM), and it was already scheduled for this weekend. That said, I don't disagree that the attackers might be trying to distract the team while they exploit that... though I don't see what it gets them compared to quietly exploiting the XEN issues before they were common knowledge on 9/8.
  - hyperpape 10y ago
    You're the one who linked to the piece. I think it's your job to be clear that it doesn't say that, it's your conclusion.