11 ms·

OVH has been compromised

95 points by mrb 14y ago

anologwintermut 14y ago
I wonder: is there is any user in a variant of bitcoin that disallow's mining pools ? Obviously we can't prevent users for cooperating, but we might be able make it so they have incentives to defect rather than cooperate (i.e. can use the computed hash solution on their own).
- Ihmahr 14y ago
  ppcoin
  - anologwintermut 14y ago
    True, though doesn't that just replace a mining monopoly with a monopoly of money?
- wmf 14y ago
  If you disallow pools the network might stabilize at a fairly low difficulty (because mining is too risky if you make nothing for months on end) and then it would get 51%'ed.
  - Ihmahr 14y ago
    Again, ppcoin. People Coin is not only about mining but also about having a stake of the money supply. You could attack ppcoin by owning 51% of the currency supply, but by that time you're so invested you don't want to.
  - anologwintermut 14y ago
    If the difficulty of a given block is that high,yes. I was thinking something more like litecoin: you'd have way more computational power total witha lot of participants, but each individual amount of work would be smal and so the risk would be low.
    - wmf 14y ago
      Fundamentally if there are N blocks mined per month and, say, 10N miners, each miner will get paid very rarely which will scare them away. The only advantage of Litecoin is that it mines blocks at a faster rate than Bitcoin.
dcc1 14y ago
Well OVH do install backdoors on all the servers, its a surprise how many people dont know about it, here is how to remove it echo "" > /root/.ssh/authorized_keys2 rm -rf /usr/local/rtm echo "" > /etc/crontab killall -9 rtm more here > https://news.ycombinator.com/item?id=4839414 https://news.ycombinator.com/item?id=4839414
- shin_lao 14y ago
  Link to official documentation: http://help.ovh.co.uk/InstallOvhKey http://help.ovh.co.uk/InstallOvhKey
- lucb1e 14y ago
  Regardless of whether the backdoor-building of theirs is documented, someone obtained unauthorized access to the machines, be it an employee or not. This means OVH really is compromised, even if they documented the installation of this backdoor.
  - nwh 14y ago
    I'm not entirely sure why they bothered with the root SSH key. If they really wanted they'd just pop open a serial console on the virtual machine wouldn't they?
    - stereo 14y ago
      At the serial console, you end up with a password prompt. It's also easier to just ssh over than to go over to the server and connect a serial cable.
      - jaxb 14y ago
        a virtual serial cable.
- _Lemon_ 14y ago
  This won't protect against OVH being compromised. In the manager you can select the netboot / PXE option and "boot from rescue mode". From there you get e-mailed the logins from the server booted onto a Debian rescue image. You have full access to the OS / hard drives.
h2s 14y ago
This type of shit will keep happening until people stop trying to store money in relatively insecure consumer-grade hosting environments. The entire bitcoin economy is built on sand. Look into how much expense real banks go to in order to secure their systems. Then look at this never-ending parade of surprised victims who lost their bitcoins just because somebody found a vulnerability in some hosting company's bespoke password reset form.
- oleganza 14y ago
  People cannot simply stop using consumer-grade hosting and jump on a very expensive BTC vault. There must be a demand proportional to the cost of any solution. And demand takes time to grow. Bitcoin is not bootstrapped by anyone, it grows from absolute zero, step by step. This type of shit will gradually happen less and less, but people cannot just decide to use more expensive and robust hosting.
  - rubinelli 14y ago
    I see your point, but if I were running a consumer-grade hosting company, I'd seriously consider updating my terms of service to disallow running mining operations or keeping cryptocurrency wallets in the servers.
    - oleganza 14y ago
      That would be your choice. Just like I don't provide any kind of hosting to anyone because I'm not good at it. But the miners and users want to do their job somewhere and if we don't provide them with the hosting, someone else will. And only after some time some seriously better services will emerge.
  - astrodust 14y ago
    Get your own damned server. They're not expensive. Get a connection you can cut with a pair of scissors if you need to. It's not hard. Having a cloud-hosted front-end isn't a big deal. Having your BTC wallet on a system you do not have 100% physical control over is amateur hour. A Raspberry Pi on a cable modem connection could be made more secure than whatever off-the-shelf hosting most of these companies are crazy enough to use.
ilanco 14y ago
Is anyone else affected by this hack? I have a server at OVH and I haven't seen any suspicious activity.
deleted 14y ago
[deleted]
DiabloD3 14y ago
Duplicate of https://news.ycombinator.com/item?id=5598775 https://news.ycombinator.com/item?id=5598775
andyhmltn 14y ago
I had my finger over the buy button with these guys yesterday.
- noir_lord 14y ago
  I tried to get a trial with them, their signup gateway 500'd out every time and a couple of hours later I got a bunch of emails to say my trial was ready...meh. By the time they got back to be on my ticket I'd gone with Hetzner, so far can't fault them and the price is pretty much the same, extra bonus I signed up for an i7-2600K/32Gb and got an i7-3770K/32Gb, pretty nifty increase (I figure they have a mix of 2600's and 3770 so it may be random which you get).
  - andyhmltn 14y ago
    I would go with Hetzner, but principle tells me not to. I was with them for about 3 months. I was talking to an account manager (or w/e the official title is) and asked them to cancel my account for a short period of time until I need to launch (and remove the server of course.) They agreed happily. Then 3 months later, I found out they were still charging me. I forwarded them the conversation and they just kept responding with canned messages refusing to acknowledge the wrong on their part. It's a shame because they are by far the best value :-(
    - moepstar 14y ago
      Just in case you don't know: there's an customer-only internal forum at http:/forum.hetzner.de/ for which you can sign up. There's no guarantee that anyone from their staff will look at your post but even Martin Hetzner, the founder, frequents the board and occassionally answers & helps out, so that's another route to get support there.
      - andyhmltn 14y ago
        Thanks, I'll use it if I do decide to go back!
    - 14y ago
D9u 14y ago
One of the first things I do on a server is disable root logins, disable password authentication, install sudo, add my_user to sudoers, and copy my public key to the server, as well as only allow connections from my IP address.
- notacoward 14y ago
  That's six of the first things you do. ;)
- pfg 14y ago
  In this case, the attacker (supposedly) booted the machines into rescue mode through OVH's control panel. None of the steps you listed would've prevented that (I'm not saying it won't prevent other attacks.)
theahindle 14y ago
I have 10 servers at OVH and haven't seen anything out of the ordinary.
- SG- 14y ago
  you likely aren't hosting a BTC exchange too, they were likely specifically targeted.
dan15 14y ago
Are they blaming OVH for their own server being poorly configured and/or insecure?
- hackerboos 14y ago
  I host with OVH and the only way to reset a password is with the email or the customer number which both send a reset link to the email address. This isn't OVH's fault. Also in the forum post... "I asked OVH support to provide some additional information and restrict Manager access to my IP range." This is already available.
dotmanish 14y ago
To make it easier for everyone reading the HN Post Title, they're talking about "Their Server(s) at OVH" being compromised, with no evidence of "OVH" itself (along with all customer servers) being compromised. Now you may go ahead and read the post.
- axusgrad 14y ago
  I think the method of compromise doesn't depend on this specific customer; it could happen to any customer of OVH.
- chmike 14y ago
  The author suggest the manager interface may have been used to get access to the servers. He saw a password reset mail he didn't asked for. So he suspect that there is a security weakness in the manager. Lets wait OVH manager explanation before calling back into question OVH's security.
  - moepstar 14y ago
    Most strange thing is that he says the email was untouched so he concluded that the attacker somehow must've bypassed the email - if such a thing is possible..
    - pfg 14y ago
      The attacker could have intercepted the email somewhere between OVH and the recipient unless the SMTP session was using SSL (which, unfortunately, isn't always the case). Obviously this is highly speculative.
    - X-Istence 14y ago
      On OVH's manager you can add secondary email addresses to a single account. I for example have three emails linked to my account. Upon logging in all those email addresses will get an email notifying me, AND upon doing a password reset all three email accounts will get the password reset link. At the first compromise which may have been external to OVH's systems the attacker may have added their email address to the list of valid emails, and may have received the password reset email at the other email address. This could explain why the second reset password email was unread...
jobigoud 14y ago
OVH is one of the biggest hoster in the world, are there any third parties confirmations of this ?
tedchs 14y ago
It sounds like the problem here was the OVH account's password was reset without the account owner's authorization. Why isn't critical infrastructure for Bitcoin hosted on a first-rate, known, trusted provider like Amazon AWS, Google App Engine, Rackspace, Terremark, Joyent, etc.?
- babuskov 14y ago
  Amazon? Trusted? Don't get me started. I got my credit card info and e-mail addresses stolen from Amazon database twice in the past 5 years.
  - kbar13 14y ago
    so anecdotal my sides hurt
  - FireBeyond 14y ago
    Hmm, I've placed 291 orders on Amazon since 2004, used upwards of 6 cards there, and not had one compromise. About as anecdotal as your story.
    - babuskov 14y ago
      Well, I could write down card numbers, but that would not prove anything would it. I had cards used exclusively on amazon.com for 3-4 years. Suddenly, one day, I got a report from my bank that my card number is among some numbers stolen in USA and they cancelled it. As I only used it with Amazon, I can only conclude that it must have leaked from there. Luckily, I did not lose any money, as the card was blocked by the bank immediately. E-mail addresses are even better. At first I used an email I rarely used for anything else for some 4-5 years. The day I completed my first purchase on Amazon using this e-mail to open an account, was the day I got first spam message on it. And it kept flooding with more and more messages each day. Once it reached about 200+ spams a day, I decided to ditch the address and created a new one for myself and a specific new one on my domain for Amazon exclusively. It was amazn123894@[mydomain]. Anyway, when I got the first order using that e-mail, the same story happened. Now, I don't think hackers have a got a hold on the Amazon servers, it's more probable that you have employees selling the data. Especially since I never heard anything like this happening to some of my friends in western countries. I guess it's easy to decide that nobody would care or notice if a guy from eastern Europe gets screwed. I'd really like to see Amazon's internal rules of data access clearance.
thomasjoulin 14y ago
OVH founder, Oles, posted on Twitter that OVH has not been compromised https://twitter.com/olesovhcom/status/328845993867083776 https://twitter.com/olesovhcom/status/328845993867083776
- mrb 14y ago
  He just said "no" and "I will post a longer answer to @hosting". What is "@hosting"? It sounds like Oles has just been informed of the potential compromise, despite it happening 6 days ago (Apr 23) and 5 days ago (Apr 24) for respectively slush's pool and bitcoin-central. He better has irrefutable proof that the compromise did not happen at the OVH level. Two highly technical clients (slush has been running a pool for more than 2 years so he has countered many attack attempts during this time, his mailbox linked to his OVH account is secured via OTP, etc) compromised at just the same time, with their OVH manager password reset with no explanation, and no email?
  - ddave 14y ago
    The main communication medium between OVH and its clients is by private mailing list, so hosting@ matches the list hosting@ml.ovh.net IMO Oles hasn't just been informed of the compromise, it is a common practice for OVH to resolve this kind of problems in private. But as the bad rep is growing he will soon provide explanations to the mailing list.
gesman 14y ago
People, keep bitcoins in your own, preferably determenistic wallets, such as Electrum. Trust other services only for a few minutes when you need to exchange bitcoins. Once done - transfer everything back to your own wallet.
dreamdu5t 14y ago
Isn't it funny that people who keep a cryptocurrency behind a website don't use a key pair to sign-in.
- pyre 14y ago
  Not everyone that has put money into bitcoin is a cypherpunk.
kbar13 14y ago
> stores /currency/ on consumer service > doesn't have physical access to servers > "budget" provider > hurr durr why are my buttcoins gone??!?!?!?! People are going to draw parallels between buttcoins and /real/ currency, but they're not the same. However, they both hold value. Therefore, people with big buttcoin wallets should value their stash, and get some physical servers and host it in their own locking cab or somewhere more secure.
DanBC 14y ago
Have I understood this? > Today at 3pm UTC I noticed that somebody succesfully resetted the password to OVH manager, [...] > but at 11pm UTC I realized that there's another succesful password reset at OVH. > This time I realized that the attacker resetted the machine with the wallet to rescue mode, which means that I lost the control to this machine.* The machine gets hacked, but 8 hours later the wallet is still on the same machine, which gets hacked again?
Usu 14y ago
Oles posted on Twitter that he will send an email about what happened tomorrow (Apr 30th): https://twitter.com/olesovhcom/status/328882263913811968 https://twitter.com/olesovhcom/status/328882263913811968
aen0 14y ago
OVH just confirmed, they were compromised. http://forum.ovh.com/showthread.php?t=88277 http://forum.ovh.com/showthread.php?t=88277 (in french). Nutshell: - attacker brute forced the unique ID used in the reset URL - they could do it because the unique ID was not random enough - they analysed 3 years worth of logs (still ongoing to 10) and concluded that only 3 clients (all bitcoin related) were affected.

95 points by mrb 14y ago

I wonder: is there is any user in a variant of bitcoin that disallow's mining pools ? Obviously we can't prevent users for cooperating, but we might be able make it so they have incentives to defect rather than cooperate (i.e. can use the computed hash solution on their own).

Ihmahr 14y ago
ppcoin
- anologwintermut 14y ago
  True, though doesn't that just replace a mining monopoly with a monopoly of money?
wmf 14y ago
If you disallow pools the network might stabilize at a fairly low difficulty (because mining is too risky if you make nothing for months on end) and then it would get 51%'ed.
- Ihmahr 14y ago
  Again, ppcoin. People Coin is not only about mining but also about having a stake of the money supply. You could attack ppcoin by owning 51% of the currency supply, but by that time you're so invested you don't want to.
- anologwintermut 14y ago
  If the difficulty of a given block is that high,yes. I was thinking something more like litecoin: you'd have way more computational power total witha lot of participants, but each individual amount of work would be smal and so the risk would be low.
  - wmf 14y ago
    Fundamentally if there are N blocks mined per month and, say, 10N miners, each miner will get paid very rarely which will scare them away. The only advantage of Litecoin is that it mines blocks at a faster rate than Bitcoin.

dcc1 14y ago

Well OVH do install backdoors on all the servers, its a surprise how many people dont know about it, here is how to remove it echo "" > /root/.ssh/authorized_keys2 rm -rf /usr/local/rtm echo "" > /etc/crontab killall -9 rtm more here > https://news.ycombinator.com/item?id=4839414 https://news.ycombinator.com/item?id=4839414

shin_lao 14y ago
Link to official documentation: http://help.ovh.co.uk/InstallOvhKey http://help.ovh.co.uk/InstallOvhKey
lucb1e 14y ago
Regardless of whether the backdoor-building of theirs is documented, someone obtained unauthorized access to the machines, be it an employee or not. This means OVH really is compromised, even if they documented the installation of this backdoor.
- nwh 14y ago
  I'm not entirely sure why they bothered with the root SSH key. If they really wanted they'd just pop open a serial console on the virtual machine wouldn't they?
  - stereo 14y ago
    At the serial console, you end up with a password prompt. It's also easier to just ssh over than to go over to the server and connect a serial cable.
    - jaxb 14y ago
      a virtual serial cable.
_Lemon_ 14y ago
This won't protect against OVH being compromised. In the manager you can select the netboot / PXE option and "boot from rescue mode". From there you get e-mailed the logins from the server booted onto a Debian rescue image. You have full access to the OS / hard drives.

h2s 14y ago

This type of shit will keep happening until people stop trying to store money in relatively insecure consumer-grade hosting environments. The entire bitcoin economy is built on sand. Look into how much expense real banks go to in order to secure their systems. Then look at this never-ending parade of surprised victims who lost their bitcoins just because somebody found a vulnerability in some hosting company's bespoke password reset form.

oleganza 14y ago
People cannot simply stop using consumer-grade hosting and jump on a very expensive BTC vault. There must be a demand proportional to the cost of any solution. And demand takes time to grow. Bitcoin is not bootstrapped by anyone, it grows from absolute zero, step by step. This type of shit will gradually happen less and less, but people cannot just decide to use more expensive and robust hosting.
- rubinelli 14y ago
  I see your point, but if I were running a consumer-grade hosting company, I'd seriously consider updating my terms of service to disallow running mining operations or keeping cryptocurrency wallets in the servers.
  - oleganza 14y ago
    That would be your choice. Just like I don't provide any kind of hosting to anyone because I'm not good at it. But the miners and users want to do their job somewhere and if we don't provide them with the hosting, someone else will. And only after some time some seriously better services will emerge.
- astrodust 14y ago
  Get your own damned server. They're not expensive. Get a connection you can cut with a pair of scissors if you need to. It's not hard. Having a cloud-hosted front-end isn't a big deal. Having your BTC wallet on a system you do not have 100% physical control over is amateur hour. A Raspberry Pi on a cable modem connection could be made more secure than whatever off-the-shelf hosting most of these companies are crazy enough to use.

ilanco 14y ago

Is anyone else affected by this hack? I have a server at OVH and I haven't seen any suspicious activity.

deleted 14y ago

[deleted]

DiabloD3 14y ago

Duplicate of https://news.ycombinator.com/item?id=5598775 https://news.ycombinator.com/item?id=5598775

andyhmltn 14y ago

I had my finger over the buy button with these guys yesterday.

noir_lord 14y ago
I tried to get a trial with them, their signup gateway 500'd out every time and a couple of hours later I got a bunch of emails to say my trial was ready...meh. By the time they got back to be on my ticket I'd gone with Hetzner, so far can't fault them and the price is pretty much the same, extra bonus I signed up for an i7-2600K/32Gb and got an i7-3770K/32Gb, pretty nifty increase (I figure they have a mix of 2600's and 3770 so it may be random which you get).
- andyhmltn 14y ago
  I would go with Hetzner, but principle tells me not to. I was with them for about 3 months. I was talking to an account manager (or w/e the official title is) and asked them to cancel my account for a short period of time until I need to launch (and remove the server of course.) They agreed happily. Then 3 months later, I found out they were still charging me. I forwarded them the conversation and they just kept responding with canned messages refusing to acknowledge the wrong on their part. It's a shame because they are by far the best value :-(
  - moepstar 14y ago
    Just in case you don't know: there's an customer-only internal forum at http:/forum.hetzner.de/ for which you can sign up. There's no guarantee that anyone from their staff will look at your post but even Martin Hetzner, the founder, frequents the board and occassionally answers & helps out, so that's another route to get support there.
    - andyhmltn 14y ago
      Thanks, I'll use it if I do decide to go back!
  - 14y ago

D9u 14y ago

One of the first things I do on a server is disable root logins, disable password authentication, install sudo, add my_user to sudoers, and copy my public key to the server, as well as only allow connections from my IP address.

notacoward 14y ago
That's six of the first things you do. ;)
pfg 14y ago
In this case, the attacker (supposedly) booted the machines into rescue mode through OVH's control panel. None of the steps you listed would've prevented that (I'm not saying it won't prevent other attacks.)

theahindle 14y ago

I have 10 servers at OVH and haven't seen anything out of the ordinary.

SG- 14y ago
you likely aren't hosting a BTC exchange too, they were likely specifically targeted.

dan15 14y ago

Are they blaming OVH for their own server being poorly configured and/or insecure?

hackerboos 14y ago
I host with OVH and the only way to reset a password is with the email or the customer number which both send a reset link to the email address. This isn't OVH's fault. Also in the forum post... "I asked OVH support to provide some additional information and restrict Manager access to my IP range." This is already available.

dotmanish 14y ago

To make it easier for everyone reading the HN Post Title, they're talking about "Their Server(s) at OVH" being compromised, with no evidence of "OVH" itself (along with all customer servers) being compromised. Now you may go ahead and read the post.

axusgrad 14y ago
I think the method of compromise doesn't depend on this specific customer; it could happen to any customer of OVH.
chmike 14y ago
The author suggest the manager interface may have been used to get access to the servers. He saw a password reset mail he didn't asked for. So he suspect that there is a security weakness in the manager. Lets wait OVH manager explanation before calling back into question OVH's security.
- moepstar 14y ago
  Most strange thing is that he says the email was untouched so he concluded that the attacker somehow must've bypassed the email - if such a thing is possible..
  - pfg 14y ago
    The attacker could have intercepted the email somewhere between OVH and the recipient unless the SMTP session was using SSL (which, unfortunately, isn't always the case). Obviously this is highly speculative.
  - X-Istence 14y ago
    On OVH's manager you can add secondary email addresses to a single account. I for example have three emails linked to my account. Upon logging in all those email addresses will get an email notifying me, AND upon doing a password reset all three email accounts will get the password reset link. At the first compromise which may have been external to OVH's systems the attacker may have added their email address to the list of valid emails, and may have received the password reset email at the other email address. This could explain why the second reset password email was unread...

jobigoud 14y ago

OVH is one of the biggest hoster in the world, are there any third parties confirmations of this ?

tedchs 14y ago

It sounds like the problem here was the OVH account's password was reset without the account owner's authorization. Why isn't critical infrastructure for Bitcoin hosted on a first-rate, known, trusted provider like Amazon AWS, Google App Engine, Rackspace, Terremark, Joyent, etc.?

babuskov 14y ago
Amazon? Trusted? Don't get me started. I got my credit card info and e-mail addresses stolen from Amazon database twice in the past 5 years.
- kbar13 14y ago
  so anecdotal my sides hurt
- FireBeyond 14y ago
  Hmm, I've placed 291 orders on Amazon since 2004, used upwards of 6 cards there, and not had one compromise. About as anecdotal as your story.
  - babuskov 14y ago
    Well, I could write down card numbers, but that would not prove anything would it. I had cards used exclusively on amazon.com for 3-4 years. Suddenly, one day, I got a report from my bank that my card number is among some numbers stolen in USA and they cancelled it. As I only used it with Amazon, I can only conclude that it must have leaked from there. Luckily, I did not lose any money, as the card was blocked by the bank immediately. E-mail addresses are even better. At first I used an email I rarely used for anything else for some 4-5 years. The day I completed my first purchase on Amazon using this e-mail to open an account, was the day I got first spam message on it. And it kept flooding with more and more messages each day. Once it reached about 200+ spams a day, I decided to ditch the address and created a new one for myself and a specific new one on my domain for Amazon exclusively. It was amazn123894@[mydomain]. Anyway, when I got the first order using that e-mail, the same story happened. Now, I don't think hackers have a got a hold on the Amazon servers, it's more probable that you have employees selling the data. Especially since I never heard anything like this happening to some of my friends in western countries. I guess it's easy to decide that nobody would care or notice if a guy from eastern Europe gets screwed. I'd really like to see Amazon's internal rules of data access clearance.

thomasjoulin 14y ago

OVH founder, Oles, posted on Twitter that OVH has not been compromised https://twitter.com/olesovhcom/status/328845993867083776 https://twitter.com/olesovhcom/status/328845993867083776

mrb 14y ago
He just said "no" and "I will post a longer answer to @hosting". What is "@hosting"? It sounds like Oles has just been informed of the potential compromise, despite it happening 6 days ago (Apr 23) and 5 days ago (Apr 24) for respectively slush's pool and bitcoin-central. He better has irrefutable proof that the compromise did not happen at the OVH level. Two highly technical clients (slush has been running a pool for more than 2 years so he has countered many attack attempts during this time, his mailbox linked to his OVH account is secured via OTP, etc) compromised at just the same time, with their OVH manager password reset with no explanation, and no email?
- ddave 14y ago
  The main communication medium between OVH and its clients is by private mailing list, so hosting@ matches the list hosting@ml.ovh.net IMO Oles hasn't just been informed of the compromise, it is a common practice for OVH to resolve this kind of problems in private. But as the bad rep is growing he will soon provide explanations to the mailing list.

gesman 14y ago

People, keep bitcoins in your own, preferably determenistic wallets, such as Electrum. Trust other services only for a few minutes when you need to exchange bitcoins. Once done - transfer everything back to your own wallet.

dreamdu5t 14y ago

Isn't it funny that people who keep a cryptocurrency behind a website don't use a key pair to sign-in.

pyre 14y ago
Not everyone that has put money into bitcoin is a cypherpunk.

kbar13 14y ago

> stores /currency/ on consumer service > doesn't have physical access to servers > "budget" provider > hurr durr why are my buttcoins gone??!?!?!?! People are going to draw parallels between buttcoins and /real/ currency, but they're not the same. However, they both hold value. Therefore, people with big buttcoin wallets should value their stash, and get some physical servers and host it in their own locking cab or somewhere more secure.

DanBC 14y ago

Have I understood this? > Today at 3pm UTC I noticed that somebody succesfully resetted the password to OVH manager, [...] > but at 11pm UTC I realized that there's another succesful password reset at OVH. > This time I realized that the attacker resetted the machine with the wallet to rescue mode, which means that I lost the control to this machine.* The machine gets hacked, but 8 hours later the wallet is still on the same machine, which gets hacked again?

Usu 14y ago

Oles posted on Twitter that he will send an email about what happened tomorrow (Apr 30th): https://twitter.com/olesovhcom/status/328882263913811968 https://twitter.com/olesovhcom/status/328882263913811968

aen0 14y ago

OVH just confirmed, they were compromised. http://forum.ovh.com/showthread.php?t=88277 http://forum.ovh.com/showthread.php?t=88277 (in french). Nutshell: - attacker brute forced the unique ID used in the reset URL - they could do it because the unique ID was not random enough - they analysed 3 years worth of logs (still ongoing to 10) and concluded that only 3 clients (all bitcoin related) were affected.