5 ms·
Security Notice: Linode Manager Password Reset
- mh- 14y agoso every time someone tries to make unauthorized attempts to access a single customer's account.. all customers are to be required to reset their passwords?
- kbar13 14y ago> We have been advised that law enforcement officials are aware of the intrusion into this customer’s systems. I feel like this is probably more than just some dude's account.
- noarchy 14y agoI think this as well. Why did Linode describe themselves as being the ones advised, rather than Linode being the one to inform law enforcement of the breach?
- noarchy 14y agoThat's the part that makes me wonder. The email that I received said, "We have found no evidence that any Linode data of any other customer was accessed." I suspect that they aren't 100% sure, and that this is a precaution. I can live with it, but I hope that they keep their customers in the loop on things, where possible.
- alex_doom 14y agoRight? I don't see how this helps.
- hobs 14y agoIt could be that they are restricted from providing more details due to the nature of the issue? It sounds like a cop-out and is, but if for instance it was under active investigation, and it was something big, they might be able to reset customer passwords while not identifying information to the attacker. On the other hand, this type of action would give it away either way, so maybe even that excuse doesnt smell right.
- spdy 14y agoNow the question is who got hacked? If they take actions like this.
- mh- 14y agoI thought this seemed familiar.. http://status.linode.com/2012/03/manager-security-incident.html http://status.linode.com/2012/03/manager-security-incident.h...
- jeffpalmer 14y agoI wonder if this is another attempt at hacking an account containing bitcoins? Last time the thieves made out with close to 50k BTC if I recall correctly.
- qqqqqq 14y agoIt's good that Linode is taking security seriously, but the pessimist in me wonders; if all it takes to get a password reset site-wide is an attack on a single user, wouldn't that open up a whole new, rather aggravating attack aimed solely at making users fed up with having their password reset all the time?
- JshWright 14y agoI'm not sure I'd describe Linode's security stance as 'serious.' Last I knew, they were running a seriously deprecated OS version for their hosts, and their configuration management systems left a lot to be desired in terms of security. Perhaps more worrying is how opaque they are about everything. Nevermind the security issues, they won't even provide explanations for 'normal' service outages.
- deleted 14y ago[deleted]
- bluetooth 14y ago> It's good that Linode is taking security seriously From what it seems, the only thing they take seriously is responding to incidents like these and letting customers know. If they were actually serious about security, these things wouldn't be happening. It was almost over a year ago since the last event.
- bluetooth 14y agoWelp, it looks like it's time to move to Amazon EC2. It's cheaper and hasn't (to my knowledge) been hacked yet.
- kbar13 14y agoirrelevant argument at best
- flebron 14y agoIt's probably false that "there does not exist a customer of EC2 that has been hacked", and that should be pretty obvious. Furthermore it's false for essentially all nontrivial, large services.
- bluetooth 14y agoBut here, it's not a customer that was hacked. It was linode that was hacked, and used to access a specific customer's data.
- smartwater 14y ago"We have been advised that law enforcement officials are aware of the intrusion into this customer’s systems." sounds like a customer was hacked, not Linode.
- mrb 14y agoI have said it before: I have a hard time trusting Linode after the major March 2012 security incident (HN thread: https://news.ycombinator.com/item?id=3654110 https://news.ycombinator.com/item?id=3654110 ; my comment: https://news.ycombinator.com/item?id=5339799 https://news.ycombinator.com/item?id=5339799) At the time they did not give much information. They did not do a follow up. They did not discuss plans to prevent the same type of breach. I am not surprised that today, they got breached again! sigh And again, they are making the same mistakes. They are not giving much information. They are not going to do a follow up. Etc.
- flebron 14y agoWhy do you think in both cases this was the result of some sort of mistake on Linode's part, versus an oversight on the part of the target? That is, you use the expression 'they {linode} got breached', versus the more correct 'they {the customers} got breached'. How do you know that in both cases this was the case?
- raquo 14y agoIf it was one customer's fault, why reset all Linode users' passwords?
- flebron 14y agoIf you knew there was a cracker actively using your network, would you not take any other precautions other than changing the one password you know he used? One could argue Linode was overzealous in resetting all passwords. Reasonable minds can differ.
- JshWright 14y agoThat depends completely on the method of compromise... If the compromise was due to a weak password that was brute forced, or obtained from the end user in some other way, then there is absolutely no need to reset every user's password. The only time a 'reasonable mind' would think to reset everyone's password is if the attacker exploited some flaw in the underlying system, which could have given them access to arbitrary passwords.
- datadrew 14y agoThe Visa I was using for billing with Linode had an authorized "test charge" earlier this week, and I had the card number replaced. Now I see this, and it makes me wonder.
- citricsquid 14y agoMy Visa (that I use for Linode) was compromised this week too, someone tried to order ~$100 of stuff from Amazon but my bank rejected the charge and now I have to wait another week before I can make payments again (killed my card...). Probably a coincidence but it makes me wonder too...
- mnordhoff 14y agoWas that credit card number used anywhere else? Given Linode's size, it's not surprising for a few customers to have had coincidental CC compromises recently.
- plusbryan 14y agoIt's probably just because they have a large number of customers, but our Linode credit card number was stolen two weeks ago.
- mietek 14y agoMy Linode credit card number was also stolen two weeks ago!
- stock_toaster 14y ago
- ballard 14y agoLinode security notice sent to customers. https://gist.github.com/5376298 https://gist.github.com/5376298
- davidradcliffe 14y agoNot all customers. I didn't receive any notice.
- jebblue 14y agoI'm glad to see Linode is keeping an eye out for its customers, nothing wrong with that.
- cliffbean 14y agoOn one hand, I love Linode. It's a sweet Linux box in the cloud. On the other hand, I have a hard time using it for anything sensitive. Quotes like "We have implemented all appropriate measures to provide the maximum amount of protection to our customers." somehow don't reassure me.
- will_work4tears 14y agoThis is how it should be, IMO. Never trust a service entirely. I also use Linode, fwiw.
- oybektoirov 14y agonice job linode!
- plam 14y agoso what's a good alternative that offers all of security, reliability, good service, about $40 for 2GB/8-cores, multi-locations, etc?
- mwcampbell 14y agoThis incident has got me seriously thinking about switching VPS providers. Does anyone know of a VPS provider that offers two-factor authentication for its management interface?
- lgbr 14y agoAWS provides multi-factor authentication, which I've always used quite successfully. https://aws.amazon.com/mfa/ https://aws.amazon.com/mfa/