5 ms·
I'd like to understand the what actions will be taken to prevent similar attacks in the future. Also, what can I as a linode customer to prevent my host from be
by orofino 15y ago
I'd like to understand the what actions will be taken to prevent similar attacks in the future. Also, what can I as a linode customer to prevent my host from being compromised in a similar fashion.
Implementation of two factor authentication for your customers and requiring it for a root password reset would go a ways to preventing similar attacks.
- eli 15y agoTwo-factor authentication for their support personnel you mean?
- brown9-2 15y agoAlso, is this customer service portal available via a public URL? Shouldn't some sort of VPN access be required to even get on the network hosting these things?
- ErneX 15y agoIt is public yes, this is it: http://manager.linode.com/ http://manager.linode.com/
- eli 15y agoI think there is some confusion here. That's the link to the customer portal, which needs to be pretty public. I have no idea how Linode's support team access accounts, but I would hope it is less public.
- ErneX 15y agoThe title of their blog post is: "Linode Manager Security Incident" and that's exactly the name of the customer website where you can manage your instance, billing, etc. I think someone found a way to gain access to any Linode customer account through the customer website and from there shut down the instance, changed root password and rebooted (you can do that from there).
- RossM 15y agoI think it's just poorly worded - from the OP and what I've read elsewhere someone accessed the portal used for customer service employees that has access to options/all hosts.
- davidw 15y agoIn any event, it's not very clear, which adds to my confusion/worries as a Linode customer.
- josephb 15y agoYes the notes in the original pastebin post kind of indicated it was an issue with a "customer support" control panel, maybe it's just another method or area using the Linode Manager. I just wish they posted a little more, it feels vague.
- larrys 15y agoCan additionally restrict by IP which. That is also the way Verisign protects the registry system that registrars use (as well as two factor authentication).
- orofino 15y agoIt should be required for their personnel and an option for me to enable for my account/specific Linodes.
- harshreality 15y agoThe only excuse for this incident is if they did have 2-factor for their admin portal (which, from the discussion, is presumably separate from manager.linode.com) and someone conducted a targeted attack on a linode employee to compromise/steal both her token (either separate or a totp oath app like googleauthenticator or similar) AND her password. If someone went to that much effort just to steal some bitcoins, they set their sights too low. Linode must host more valuable stuff.
- kylebrown 15y ago> Linode must host more valuable stuff. Such as? bitcoins are valuable and easy to run away with. Stolen credit card numbers are such a hassle to monetize that they can be bought with only $2 or $3 of e-currency.
- PsyVisions 15y agoSee my reply here http://news.ycombinator.com/item?id=3655308 http://news.ycombinator.com/item?id=3655308 Now crawl back under your rock... Reality must be really harsh to you, hence your username.
- maaku 15y agoSomeone got off scot-free with a quarter million USD in anonymous currency. I'm not sure how that's setting sights too low...
- weaksauce 15y agoYes they are free a day after the event. There are bound to be logs and with that the possibility of capture. The person or people who did this are not quite resting easy, well unless it was a foreign entity that did it... That would change things considerably.
- ukd1 15y agoIt would be interesting to get a report on what actually happened - I've not seen anything official from Linode yet