5 ms·
The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the
by ultimoo 14y ago
The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the ops folk at Linode to have suffered an attack due to a third party 0-Day exploit. It could happen to any of us really.
On a side note, I am not sure of the "some occurrences of plaintext Lish passwords". Seems like quite a goofup on Linode's part.
- troels 14y agoIt's not really a zero-day, if a patch has been out for a week though.
- vrta 14y agoIt was 0-day when they got hit. Sad thing is that they do not tell how much time has passed since the hack.
- troels 14y agoYeah, maybe you're right. The text is a bit unclear about that.
- vrta 14y agoYeah, they didn't tell us when they got hacked, but seclist did (3/31/2013): http://seclists.org/nmap-dev/2013/q2/3 http://seclists.org/nmap-dev/2013/q2/3
- mjs 14y ago3/31/2013 is the backup they're reverting to, not when they got hacked though, right? (The email refers to "downtime over the last week", so I guess the hack happened around 6th April or later.
- codeulike 14y agoI'm not sure, their wording around it is a bit convoluted "... previously unknown zero-day vulnerability in Adobe’s ColdFusion application server. The vulnerabilities have only recently been addressed in Adobe’s APSB13-10 hotfix (CVE-2013-1387 and CVE-2013-1388) which was released less than a week ago." To me that reads like 'it was a former zero-day exploit", as all exploits are.
- zorbo 14y agoNot all exploits are zero-day exploits. As I understand it, a zero-day exploit is one that is used in the wild before it is disclosed. Plenty (most) vulnerabilities are only disclosed once a fix has been implemented.
- codeulike 14y agoI stand corrected
- kyrra 14y agoLinode brought this issue to Adobe's attention. It's pretty clear that the hack happend 1-2 weeks BEFORE it was announced to the public on Friday. See: http://seclists.org/nmap-dev/2013/q2/3 http://seclists.org/nmap-dev/2013/q2/3 seclists.org was one of the sites hit in the hack. See how they were down "over the last week". Also note that the Adobe security bulletin was release on April 9: http://www.adobe.com/support/security/bulletins/apsb13-10.html http://www.adobe.com/support/security/bulletins/apsb13-10.ht... So ya, these hackers found the problem (a 0-day in Coldfusion), used it against Linode. then Linode got Adobe to look into it and found the cause.
- fulafel 14y agoAdobe stuff is best assumed vulnerable at all times though.
- threeseed 14y agoSorry but having passwords in plaintext is not a "goofup". It is completely and utterly inexcusable.
- andyhmltn 14y agoA) It wasn't account passwords. It was LISH (no better but I thought I'd point that out) B) Not all passwords were in plaintext C) Judging from the above, I would say that there was some stuff up where passwords were written to the logs when they were changed but that's just speculation.
- noinsight 14y ago> It could happen to any of us really. Yes, but the whole private key thing and the ability to access the cc numbers from the front-end (unless they hacked the DB server as well, I think they didn't?) reeks of failure. The only thing standing between the plain text cc numbers and the hackers is the passphrase, better pray that it's a good one.