4 ms·
The problem wasn't in passwords being stolen. CC information was allegedly leaked.
by bndr 13y ago
The problem wasn't in passwords being stolen. CC information was allegedly leaked.
- nwh 13y agoAllegedly? They admitted it was.
- bndr 13y agoThey admitted that the encrypted CC numbers were leaked, they didn't mention if the encryption keys were stored on the same machine. The alleged hacker said that the encryption keys were stored on the same machine, making the encryption useless.
- astrodust 13y agoIt was also made clear that the encryption key was protected by a passphrase which was not stored on the machine.
- sendob 13y ago"which was not stored on the machine", like they should be commended ( Reminds me of exams where you received some credit for including your name... ). I am sorry, them confirming this fact, and even if I recall adding a smiley in the tweet they did it, just cemented that they do not understand their business. They clearly wish to give the impression that they are "secure". They need more lock icons...they are almost as effective as the racing stickers on my car!
- astrodust 13y agoThe real problem here is that PCI certification is an absolute joke. There should be several classes of certification, from "I want to sell a few pet rocks" to "I'm Apple with 150,000,000 credit cards on file". Right now there's basically two.
- krg 13y agoThis isn't proof of anything, but a few days after this incident the CC I use for Linode got a fraudulent charge, the first such in years. I cancelled the card, so no big deal, but this makes me strongly suspect that the attacker ended up with actual card numbers, regardless of the passphrase.
- nilved 13y agoIRC logs showed the passphrase was extracted from the ColdFusion app's memory.
- nwh 13y agoLinode confirmed that the private encryption key was stored on the same machine. They've been parroting lines about the password on the private key being too strong to crack.