7 ms·

I've now heard from a number of people using Linode that have suspicious activities on the cc which they used with Linode. I just called up my bank to tell the

by clicks 14y ago

I've now heard from a number of people using Linode that have suspicious activities on the cc which they used with Linode. I just called up my bank to tell them to 'block' it as a precaution (I will now have to give them a visit later today to get a new card). I encourage all other Linode customers to do the same, because it'll be easier to just spend half an hour doing this instead of spending hours upon hours disputing specific transactions. Linode customer support keeps saying they have "no comment" on this issue (which I suppose does make sense -- I'm assuming they've been ordered by law enforcement persons to not share details), so as we're not being given much information to work with... just treat this as a worst-case scenario (all names, addresses, credit card numbers, etc. have been compromised). Do operate now with the assumption that all of this data has been compromised and may very well be public soon.

deleted 14y ago
[deleted]
eridius 14y ago
I would be utterly shocked if nobody using Linode had suspicious activity on their CC. Linode has lots of customers, and at any given time, some of them probably have suspicious activity going on.
- clicks 14y ago
  There's baseless speculation and then there's I have some information speculation. I'm operating on heuristics which rely on information that is handily available. Yes, in the end you're right, I'm just speculating. But hey, it's better to err on the side of caution.
  - jbraithwaite 14y ago
    If it is indeed true that credit card numbers were compromised, it would behove Linode to tell their customers quickly so they can take the proper action. With this lack of transparency, I feel like I had no choice but to block my card.
    - eridius 14y ago
      There's no lack of transparency here. Linode expressly said in their blog post that no CC details were leaked. > In addition, we have found no evidence that payment information of any customer was accessed. The question isn't transparency, but trustworthiness. Either Linode is telling the truth, and this anonymous IRC person with a pastebin is trolling everyone, or Linode is lying (or alternatively, Linode is incompetent and simply didn't detect the CC access). At the moment I'm going with Linode is telling the truth, because honestly, am I going to believe an anonymous person on IRC over a company I do business with?
      - gtirloni 13y ago
        I'm thinking here why Linode holds CC data on its servers in the first place. Anyone care to weight in here? Secondly, if they hold that data, it's possible one day someone will find a security breach and will access that data. The best solution is to never hold that data. Since I don't trust most of the systems I use AND Linode has not denied it holds that data... I'm more inclined to believe in this anonymous IRC guy and err on the side of caution. If Linode had come out and said "Look, we don't hold your CC number in our database" then I think there would be very little reason to be concerned. However...
  - trotsky 14y ago
    Credit card numbers are of pretty low value. Like way less than a buck in medium volume and still just a few bucks for the super premium ones. And there is way, way more inventory of them than interested buyers. The likelyhood of a coordinated break in of a large hosting service with the intention of stealing credit cards is pretty low, and the chance that they'd be exploited so quickly is even lower. Unless the attacker dumped them all (semi) publicly, the more likely explanation is that the breakin caused people to check their accounts and a statistically normal percentage of them showed fraud from another origin. But anybody who sees it will be sure to get online and find others in a similar situation. Everybody would be doing themselves a big favor if they stopped treating CC info as the #1 scary OMG data theft. The banks programmed you to care because congress made sure they're liable instead of you. Theoretically you might owe $50 due to fraud but practically you never pay a dime. Sure it's a bit of a pain in the ass to get resolved, but it's not worth stressing about until it happens. I'd be way more concerned if my hoster lost my contact info, ip logs and identity challenge questions & answers.
    - clicks 14y ago
      You bring up very good points, thanks. I contacted Linode support and they've said in clear terms that they have no evidence that payment information of customers was accessed. I initially signed up for Linode because my friends spoke highly of the tech people working at Linode. Right now amidst all the commotions it's ryan's words (some anonymous dude who joined #linode/irc.oftc.net) vs. an established company's. I'm just going to now stop worrying and get back to my work. On an interesting note, the big target who actually incurred identifiable damage was seclists.org: http://seclists.org/nmap-dev/2013/q2/3 http://seclists.org/nmap-dev/2013/q2/3
      - jimktrains2 14y ago
        >I contacted Linode support and they've said in clear terms that they have no evidence that payment information of customers was accessed. Well that's a first. They were very evasive about it earlier.
      - makomk 14y ago
- raverbashing 14y ago
  No weird activity here (no declined transactions or anything) Mine is not a CC or a debit card, it's a 'prepayed card' so liability is limited. Still, I'm considering calling the lost/stolen line of the card.
- deleted 14y ago
  [deleted]
- ak3nat0n 14y ago
  No weird activities on mine either but I will give a call to my CC company anyway. I have had to cancel the card I use on linode twice in the past few months because of suspicious activities. I just didn't think it would be coming from Linode
jervisfm 14y ago
What about for people who did not use a credit card to pay for linode but instead relied on PayPal. Should they follow the same steps? What about other cautious steps?
- level09 14y ago
  I don't think they allow paypal as a payment method
  - bpatrianakos 14y ago
    I've got a PayPal business mastercard which is connected to PayPal Smart Connect. They may not allow PayPal proper but you could pay using PayPal by way of their card. I use my PayPal card hooked into Smart Connect for a good number of recurring payments like this. So I guess the answer would be, if you ended up hooking your PayPal account up to Linode in the way I described, yeah follow the same steps as other cards, otherwise it's not even possible to have a problem.
pw7 14y ago
Yeah I did the same thing, but new card takes 5-7 days in my case. Very disappointed that I had to find out about this incident here, imagine all the customers who dont happen to look on slashdot or hacker news.
ereckers 14y ago
"because it'll be easier to just spend half an hour doing this instead of spending hours upon hours disputing specific transactions." I live on the internet. Put my credit card out on many services. Over the last 5 to 8 years I've had my credit card numbers taken I believe 4 times. Never had to dispute it once. These Credit Card companies and Banks have a stake in not allowing your account to be drained. I think it would be a waste of time to go out and cancel our CC until hearing from Linode that yes, CC information was taken.
- oinksoft 14y ago
  I did it, not worth the worrying. But then again I only bill two things to this CC, one of which is annual.
- NewAccnt 14y ago
  Wow, four times? You should probably be more careful about who you give your number to. Personally, I usually get a new card every 3-5 months. If someone ever sat on my card number, it's useless to them now. Never had any issues either.
  - danneu 14y ago
    I also do that, but it's because I'm scared of recurring subscriptions that I've forgotten about, especially those that decide to sneak into my pocket after I've deliberately canceled them.
  - kansface 14y ago
    This is bad for your credit report I believe.
    - JshWright 14y ago
      He's not tearing down and setting back up the entire credit line, just the card number associated with it. It won't be reflected on any credit reports.
  - zallen 14y ago
nigma 14y ago
So here's what Linode support is actually saying when asked about the breach: Thank you for contacting us. We have no evidence at this time that any payment information was compromised.
- bndr 14y ago
  I asked about the security measures and they answered with: "We appreciate the response, and we can assure you that we have implemented all appropriate measures to provide the maximum amount of protection to our customers."
  - Evbn 14y ago
    That severely underestimates the intelligence and wrath of their highly technical customer base.
j_s 14y ago
Do this immediately if it is a debit card!
- eridius 14y ago
  If it's a debit card that can be used as a credit card (and it must be, otherwise it couldn't have been used to pay for Linode), then it enjoys the same protection as regular credit cards when it's used as one.
  - mbreese 14y ago
    Yeah, but it's one thing to deal with a line of credit that is maxed out by fraud and another to deal with an empty checking account.
    - analog 14y ago
      Very true. If your bank gives you a separate savings account you can transfer the bulk of your money there and just use the card from the current account to limit your exposure.

by clicks 14y ago

deleted 14y ago

[deleted]

eridius 14y ago

I would be utterly shocked if nobody using Linode had suspicious activity on their CC. Linode has lots of customers, and at any given time, some of them probably have suspicious activity going on.

clicks 14y ago
There's baseless speculation and then there's I have some information speculation. I'm operating on heuristics which rely on information that is handily available. Yes, in the end you're right, I'm just speculating. But hey, it's better to err on the side of caution.
- jbraithwaite 14y ago
  If it is indeed true that credit card numbers were compromised, it would behove Linode to tell their customers quickly so they can take the proper action. With this lack of transparency, I feel like I had no choice but to block my card.
  - eridius 14y ago
    There's no lack of transparency here. Linode expressly said in their blog post that no CC details were leaked. > In addition, we have found no evidence that payment information of any customer was accessed. The question isn't transparency, but trustworthiness. Either Linode is telling the truth, and this anonymous IRC person with a pastebin is trolling everyone, or Linode is lying (or alternatively, Linode is incompetent and simply didn't detect the CC access). At the moment I'm going with Linode is telling the truth, because honestly, am I going to believe an anonymous person on IRC over a company I do business with?
    - gtirloni 13y ago
      I'm thinking here why Linode holds CC data on its servers in the first place. Anyone care to weight in here? Secondly, if they hold that data, it's possible one day someone will find a security breach and will access that data. The best solution is to never hold that data. Since I don't trust most of the systems I use AND Linode has not denied it holds that data... I'm more inclined to believe in this anonymous IRC guy and err on the side of caution. If Linode had come out and said "Look, we don't hold your CC number in our database" then I think there would be very little reason to be concerned. However...
- trotsky 14y ago
  Credit card numbers are of pretty low value. Like way less than a buck in medium volume and still just a few bucks for the super premium ones. And there is way, way more inventory of them than interested buyers. The likelyhood of a coordinated break in of a large hosting service with the intention of stealing credit cards is pretty low, and the chance that they'd be exploited so quickly is even lower. Unless the attacker dumped them all (semi) publicly, the more likely explanation is that the breakin caused people to check their accounts and a statistically normal percentage of them showed fraud from another origin. But anybody who sees it will be sure to get online and find others in a similar situation. Everybody would be doing themselves a big favor if they stopped treating CC info as the #1 scary OMG data theft. The banks programmed you to care because congress made sure they're liable instead of you. Theoretically you might owe $50 due to fraud but practically you never pay a dime. Sure it's a bit of a pain in the ass to get resolved, but it's not worth stressing about until it happens. I'd be way more concerned if my hoster lost my contact info, ip logs and identity challenge questions & answers.
  - clicks 14y ago
    You bring up very good points, thanks. I contacted Linode support and they've said in clear terms that they have no evidence that payment information of customers was accessed. I initially signed up for Linode because my friends spoke highly of the tech people working at Linode. Right now amidst all the commotions it's ryan's words (some anonymous dude who joined #linode/irc.oftc.net) vs. an established company's. I'm just going to now stop worrying and get back to my work. On an interesting note, the big target who actually incurred identifiable damage was seclists.org: http://seclists.org/nmap-dev/2013/q2/3 http://seclists.org/nmap-dev/2013/q2/3
    - jimktrains2 14y ago
      >I contacted Linode support and they've said in clear terms that they have no evidence that payment information of customers was accessed. Well that's a first. They were very evasive about it earlier.
    - makomk 14y ago
raverbashing 14y ago
No weird activity here (no declined transactions or anything) Mine is not a CC or a debit card, it's a 'prepayed card' so liability is limited. Still, I'm considering calling the lost/stolen line of the card.
deleted 14y ago
[deleted]
ak3nat0n 14y ago
No weird activities on mine either but I will give a call to my CC company anyway. I have had to cancel the card I use on linode twice in the past few months because of suspicious activities. I just didn't think it would be coming from Linode

jervisfm 14y ago

What about for people who did not use a credit card to pay for linode but instead relied on PayPal. Should they follow the same steps? What about other cautious steps?

level09 14y ago
I don't think they allow paypal as a payment method
- bpatrianakos 14y ago
  I've got a PayPal business mastercard which is connected to PayPal Smart Connect. They may not allow PayPal proper but you could pay using PayPal by way of their card. I use my PayPal card hooked into Smart Connect for a good number of recurring payments like this. So I guess the answer would be, if you ended up hooking your PayPal account up to Linode in the way I described, yeah follow the same steps as other cards, otherwise it's not even possible to have a problem.

pw7 14y ago

Yeah I did the same thing, but new card takes 5-7 days in my case. Very disappointed that I had to find out about this incident here, imagine all the customers who dont happen to look on slashdot or hacker news.

ereckers 14y ago

"because it'll be easier to just spend half an hour doing this instead of spending hours upon hours disputing specific transactions." I live on the internet. Put my credit card out on many services. Over the last 5 to 8 years I've had my credit card numbers taken I believe 4 times. Never had to dispute it once. These Credit Card companies and Banks have a stake in not allowing your account to be drained. I think it would be a waste of time to go out and cancel our CC until hearing from Linode that yes, CC information was taken.

oinksoft 14y ago
I did it, not worth the worrying. But then again I only bill two things to this CC, one of which is annual.
NewAccnt 14y ago
Wow, four times? You should probably be more careful about who you give your number to. Personally, I usually get a new card every 3-5 months. If someone ever sat on my card number, it's useless to them now. Never had any issues either.
- danneu 14y ago
  I also do that, but it's because I'm scared of recurring subscriptions that I've forgotten about, especially those that decide to sneak into my pocket after I've deliberately canceled them.
- kansface 14y ago
  This is bad for your credit report I believe.
  - JshWright 14y ago
    He's not tearing down and setting back up the entire credit line, just the card number associated with it. It won't be reflected on any credit reports.
- zallen 14y ago

nigma 14y ago

So here's what Linode support is actually saying when asked about the breach: Thank you for contacting us. We have no evidence at this time that any payment information was compromised.

bndr 14y ago
I asked about the security measures and they answered with: "We appreciate the response, and we can assure you that we have implemented all appropriate measures to provide the maximum amount of protection to our customers."
- Evbn 14y ago
  That severely underestimates the intelligence and wrath of their highly technical customer base.

j_s 14y ago

Do this immediately if it is a debit card!

eridius 14y ago
If it's a debit card that can be used as a credit card (and it must be, otherwise it couldn't have been used to pay for Linode), then it enjoys the same protection as regular credit cards when it's used as one.
- mbreese 14y ago
  Yeah, but it's one thing to deal with a line of credit that is maxed out by fraud and another to deal with an empty checking account.
  - analog 14y ago
    Very true. If your bank gives you a separate savings account you can transfer the bulk of your money there and just use the card from the current account to limit your exposure.