3 ms·

Aren't we jumping the gun a bit by saying, "DigitalOcean Root Vulnerability in the Wild"? I'm not yet comfortable with that conclusion...

by gregd 14y ago

readme 14y ago
I agree. To me it sounds more like root vulnerability on OPs system. He did not change his password after using the automated password reset, knowing the password was sent in plain text.
- goodwink 14y ago
  No I didn't change the password. Instead I rebuilt the machine from the base OS image. Would you expect that a new system with the disk wiped would retain the old root password? I certainly wouldn't. Where were they keeping it?
  - bpicolo 14y ago
    Whenever I do a rebuild on a droplet it sends me a new root password in the email.
    - goodwink 14y ago
      I have ssh keys set up so it doesn't do this. Instead what it seems to do is reuse your old root password for the new image.
  - readme 14y ago
    Sorry -- my fault. I skimmed your article and I guess I missed this part. That is a bit ridiculous that they retained your password. Still though, logging in after rebuilding and configuring your system would have been a sane move.
  - wfn 14y ago
    > No I didn't change the password. Instead I rebuilt the machine from the base OS image. Probably not strictly related (it would seem the attack in question was via a compromised (on whoever's end) ssh password), but in any case good practice: always regenerate ssh keys after installation from a base image. Some OS images may contain pregenerated keypairs (private key is usually at ~/.ssh/id_rsa ), which should always be regenerated. (This bit is most probably not actually related to the issue at hand, but IAC should not be forgotten.)
nlh 14y ago
Agreed. I think it's also unfair to DigitalOcean. Could a mod perhaps change the title to something slightly less accusatory? (No affiliation with DO here, just hate to see any company unfairly attacked...)

Aren't we jumping the gun a bit by saying, "DigitalOcean Root Vulnerability in the Wild"? I'm not yet comfortable with that conclusion...

by gregd 14y ago

Aren't we jumping the gun a bit by saying, "DigitalOcean Root Vulnerability in the Wild"? I'm not yet comfortable with that conclusion...

readme 14y ago

I agree. To me it sounds more like root vulnerability on OPs system. He did not change his password after using the automated password reset, knowing the password was sent in plain text.

goodwink 14y ago
No I didn't change the password. Instead I rebuilt the machine from the base OS image. Would you expect that a new system with the disk wiped would retain the old root password? I certainly wouldn't. Where were they keeping it?
- bpicolo 14y ago
  Whenever I do a rebuild on a droplet it sends me a new root password in the email.
  - goodwink 14y ago
    I have ssh keys set up so it doesn't do this. Instead what it seems to do is reuse your old root password for the new image.
- readme 14y ago
  Sorry -- my fault. I skimmed your article and I guess I missed this part. That is a bit ridiculous that they retained your password. Still though, logging in after rebuilding and configuring your system would have been a sane move.
- wfn 14y ago
  > No I didn't change the password. Instead I rebuilt the machine from the base OS image. Probably not strictly related (it would seem the attack in question was via a compromised (on whoever's end) ssh password), but in any case good practice: always regenerate ssh keys after installation from a base image. Some OS images may contain pregenerated keypairs (private key is usually at ~/.ssh/id_rsa ), which should always be regenerated. (This bit is most probably not actually related to the issue at hand, but IAC should not be forgotten.)

nlh 14y ago

Agreed. I think it's also unfair to DigitalOcean. Could a mod perhaps change the title to something slightly less accusatory? (No affiliation with DO here, just hate to see any company unfairly attacked...)