5 ms·

Here is what Linode replied to me when I asked them about that chat log in a support ticket: Hello, Thank you for reaching out. We appreciate and unders

• tomjen3 14y ago
  Well the steps I would like to take regarding linode aren't exactly legal. Satisfying yes, but not legal. But I just checked and my credit card haven't been used anywhere I didn't use it.
• icelancer 14y ago
  This is ridiculously unprofessional.
• gburt 14y ago
  These guys are looking totally incompetent at this point. If you believe this Ryan guy, credit cards stored on the same server as the key to decrypt them, Lish passwords stored in plain text, they've known for some time and lied about what actually happened and now they're saying "we won't do anything about it" via email? "You are of course free to take any steps you deem prudent or necessary to ensure the integrity of your online presence." Unbelievable. Edit: not to mention they "made a deal" with the hacker not to tell anyone? What the hell?
  • oinksoft 14y ago
    Regarding the "made a deal" assertion, I wouldn't take the IRC log hook-line-and-sinker. There's probably a mixture of truth and lies.
    • nenolod 14y ago
      for the record, i am the person who started the WHT thread. there is a mixture of truth and lies on both sides, to be honest. i am annoyed with it, because i reached out to several linode employees privately to given them an opportunity to explain what was going on -- they either said 'no comment' or said my linode was fine. based on the irc log, that is clearly not the case. which is why i decided to raise my concerns publically. luckily for me, my linode was not doing anything mission-critical, just some secondary monitoring and running an ircd for a network i like using, but there are others who are using linode for mission-critical work, and they deserve more transparency than this.
      • netrixtardis 14y ago
        what makes you think you are more special then anyone else? Why would they tell you more details, than the rest of the people? Sorry if you get offended that they didn't tell you much more. But seriously? you are not special. This whole thread is a lynch mob.
        • pizzeys 14y ago
          Is he more special than other people, or should we ALL have been informed properly?
  • tmcneal 14y ago
    To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most likely the database containing the CC numbers resides on a separate set of boxes than the web servers.
    • nenolod 14y ago
      the database server is local, read the entire log...
    • danielweber 14y ago
      The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database). What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.
      • lawnchair_larry 14y ago
        Why would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.
  • seandougall 14y ago
    > If you believe this Ryan guy That's a rather key assumption. If you don't believe him, then all you have is a trolling (or at least self-aggrandizing) hacker whose credentials consist solely of logging into an IRC channel, refusing to identify who he was working with, and offering no tangible proof of having compromised any CC info. On the other hand, it's conceivable that if ryan managed to get into the files a customer was hosting on Linode, and that customer was improperly storing CC info, then their customers' info would have been vulnerable, and ryan's claims would be sort of half-true. Even so, that wouldn't directly affect other Linode customers or put liability in Linode's lap.
• yesimahuman 14y ago
  That is not the way to handle this issue. I've found my one problem with Linode is they are arrogant. It comes off pretty strong if you ever ask them questions in chat.
  • keidian 14y ago
    One thing to note is that the irc channel if that is what you mean by chat, is mostly populated by non linode staff. And many of us there tend to be sarcastic as we idle there and chat about all sorts of stuff while we are bored at work or whatever. Unless it's someone with ops, you aren't getting an official reply and even then for something official they usually refer to ticket system.
• tlrobinson 14y ago
  That is an absurd response. I don't care if they believe a specific customer was targeted, I want to know what happened and what information may have been compromised.
• eridius 14y ago
  Despite what the other replies here are saying, this seems like a perfectly acceptable response to me. This comes off to me not as they're refusing to talk about it, but they _can't_ talk about it, presumably because of an ongoing investigation. I'm not sure what else people here are expecting them to say.
  • dale386 14y ago
    Then why not say that?
    • jmilloy 14y ago
      They did. > We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation.
    • Zancarius 14y ago
      The pasted text from Linode appears to say exactly that: > We are unable to release any additional details regarding this incident at this time, as there is an ongoing investigation. Edit: Oops, didn't refresh before replying. jmilloy got it first! Sorry about that.
• farmdawgnation 14y ago
  They probably can't say anything just yet. It's fair to be mad about them not realizing (or worse, covering up) the breadth of this breach, but do keep in mind that if they're working with the FBI, they've probably been asked to keep a lid on their official response for a few hours.