49 ms·
If you didn't cancel the credit card you used for linode.com, now is the time
I have been a victim of procrastination. Since linode have been compromised, i promised my self i would cancel the credit card and get a new one. Well I didn't, eventually I just stopped thinking about it.
On May 28 checked my card account and I see multiple charges for large amounts. (cash converters, groceries, cheese, and so on). Note this is all done overseas.
How do I know this is from linode?
For my online transactions I use prepaid cards that are easy to dispose of, and this card was used solely for linode.
Advice: If you are still on linode and didn't cancel your credit card, well you should.
- madmaze 13y agoThanks, I was thankfully canceled my card. Is there anyone else here that has had their card compromised?
- aaronpk 13y agoHaven't seen any fraudulent charges on my card yet. I only have like 3 different monthly charges that go to that card so they'll be easy to spot and to contest if I need.
- adunar 13y agoThe card I used for Linode was used for fraudulent online purchases on May 13. However, I also used the credit card at many other places besides Linode, so I'm not certain that Linode was responsible.
- ambiate 13y agoI have not noticed any odd activity. My card has been with Linode for years.
- saryant 13y agoI haven't had anything odd yet. Ironically, Chase did flag my DigitalOcean charges last week.
- RexM 13y agoA few months ago I had some trouble with BofA flagging my card for "suspicious activity." I had to go in and get a new card twice over two months. The only change I can think of is that I switched hosting to DigitalOcean. I had been thinking of switching banks for awhile, but this ended up being the biggest motivator to finally pull the trigger.
- saryant 13y agoMy Chase cards seem to get compromised somewhat regularly but it's never been an issue. I get a robocall that asks me to press 1 if fraudulent, 2 if legit. Obviously I indicated that the DigitalOcean charge was fine. Whenever I've had an actual fraudulent charge, Chase has just overnighted me a replacement card, both with my business and personal cards. They've got wonderful customer service.
- adrr 13y agoChase notified that a 3rd party was breached and my credit card was at risk. They sent me a new card two weeks ago. Figured it was because of linode.
- forgotAgain 13y agoFunny, that's about when I cancelled my Chase card. When they asked why I told them an internet company I do business with had been compromised. I have a monthly charge from Linode on the card.
- davidw 13y agoI had some issues with a card several months ago that was used for very few things, including Linode. Security on one of the other services I used was actually pretty bad, rather than inadvertently bad: they resent me my own password, and I canceled immediately, so it may not have been Linode, but it's impossible to say.
- deleted 13y ago[deleted]
- sirn 13y agoI have seen a $780 purchase in one of my card (which is only used online in App Store, PayPal, Amazon and Linode) on April 27th. I dispute the purchase and request reissue of the card immediately. Since I also use this card physically few times (all before Linode incident) I wouldn't say for sure that Linode was responsible. (I'm not located in US but the purchase was from online store in US, I suspect it might be compromised online by some means.)
- plusbryan 13y agoYes, ours was used fraudulently the week before the breach was announced.
- InternalRun 13y agoGuess they really did leave the private and public keys on the sevrer.
- nwh 13y agoThey admitted that at the time. They assured everyone that the password on the private key was secure, even boasted about how long it was on twitter.
- azinman2 13y agoTo be fair, that still doesn't mean it's from linode 100%. I recently had a fraudulent charge on a Chase Freedom card that I never once used anywhere (their fine print when it arrived showed they mislead me in the rewards I was promised). I had even shredded it when I got it so its not possible someone took it from my place. When they called me about the possible fraudulent charge, they guy explained that various government/creditor databases contain these cards and sometimes malicious employees use them for fraud.
- ibudiallo 13y agoYou are right, i cannot say it's linode 100%, maybe 99%. however it is still a good idea to cancel those cards.
- ry0ohki 13y agoMaybe if they are debit cards, but the hassle of changing cards everywhere combined with the protection against fraudulent charges banks give, I don't plan on doing anything just for the heck of it. IE, lets say your correct and I start seeing fraudulent charges? I call my bank and they reverse them all immediately, it's not a big deal.
- kgermino 13y agoIf you don't mind my asking, how did Chase mislead you about the awards available? I've had my Chase Freedom card for almost a year now and I love it, but I don't recall running into any sort of fine print issues so I'm curious what you ran into.
- richardlblair 13y agoI would also like to add that the same thing happened to me. Except it happened on May 30th. I can't be 100% sure that my card was compromised because of linode, but there is a good chance that it was. Thankfully the transactions were not captured, so I'm not out any money, but it still sucks.
- leeoniya 13y agothat card tied to a lot of things :(, probably a bad idea in general. but for overseas charges at least, my bank will block transactions and notify me.
- par 13y agoBoA actually cancelled it for me, I didn't even have a choice!
- tixocloud 13y agoAre there any other alternatives out there for VPS service?
- nwh 13y agoSounding like a broken record, but I'm partial to DigitalOcean. The coupon "SSDTWEET" nets you $10 of account credit. I've been using them for a while now, and can't in a bit fault them.
- notacoward 13y agoI've tested close to a dozen providers, mostly found via http://www.cloudorado.com/ http://www.cloudorado.com/ or http://serverbear.com/ http://serverbear.com/, and there are many who can match or exceed both Linode and Digital Ocean (who seem to be all over every story here that even touches on VPSes) according to every possible criterion. Personally I went with Host Virtual when I left Linode (shortly after having left Rackspace), but the choice was largely dictated by physical location. Another day it might have been Ramnode. There are others too. The real point is that it's just not hard to find a better VPS host. It's a crowded space.
- peregrine 13y agoI haven't seen anything yet, and I tend to keep pretty close watch on it.
- will_work4tears 13y agoI haven't seen anything yet either. All of my accounts have some policy in place where they call us. It actually got annoying when my wife was "couponing" and we hit 5-6 stores in a couple hours. Always got a call. Comforting. Any charge in another country is set to be a flag. When we travel we make a call and let them know so it doesn't get flagged.
- mietek 13y agoFirstDirect cancelled my Linode card for me, after the first three fraudulent charges. Luckily, they were easy to detect, as they were made in physical locations in the US, while I was in the UK at the time. Probably the only time in my life a bank actually helped me retain my money!
- dkulchenko 13y agoI cancelled mine for an unrelated reason, but was about to anyway once news about the Linode compromise got out. Linode themselves have admitted that the only thing between HTP and the credit card numbers is a passphrase (of unknown quality). I no longer have any VMs on Linode. It's unfortunate that a company I trusted behaved so oddly and non-transparently over the course of the incident.
- Ramp_ 13y agoThe Linode write-up from HTP which may be relevant to this. Scroll to the "Linode" section of course. http://www.exploit-db.com/papers/25306/ http://www.exploit-db.com/papers/25306/
- lifeguard 13y agoIt should be easy to prove you did not make the purchases and instantly have your funds credited back to your account OP.
- xbryanx 13y agoBank Simple actually reached out to me and asked me if I wanted to cancel my card. I did. But I was impressed that they saw that I'd had charges from them and knew about the security issues.
- Osiris 13y agoI also use Simple and I've been very happy with their customer support. Not having checks has been a pain in a few cases, but I definitely prefer it over a brick and mortar. I have a few invitations on my account if anyone is interested.
- matthuggins 13y agoI canceled my card the day I saw the issue relating to linode.com. I'm glad I did!
- greenyoda 13y agoSigning up for on-line services is a good use for "virtual account numbers". This is a feature offered on some Citibank and Discover credit cards (maybe others) that allows you to generate a separate credit card number that's billed to your original account. The nice thing about them is that once a virtual account number has been billed by a vendor, it does not accept any charges in the future except from the same vendor. So if the account is compromised, the credit card number is useless to the person who steals it.
- stock_toaster 13y agoI wish other banks offered that functionality. I am not a fan of Citibank.
- encoderer 13y agoGet the Fidelity Amex from FIA (aka BofA). It's one of the few genuine 2% cashback cards, has no annual fee, no forex fees iirc, and lets you create "ShopSafe" numbers.
- caw 13y agoIt has a forex fee, just called about it before a trip. Something like 2.5 or 3.5%; my CapitalOne card didn't so I just used that instead. Haven't found the ShopSafe numbers yet; I'm going to look for that now that you mentioned it. Overall great card to have, because besides the 2% back on all purchases (if you deposit the money to a qualified Fidelity account) it has a bunch of the perks like rental car coverage, theft insurance on recent purchases, and doubled warranty, up to 1 year.
- stock_toaster 13y agoAre you sure it is the amex card that supports shopsafe? I thought Amex discontinued their similar product _years_ ago.
- encoderer 13y ago
- tzs 13y agoWhat do you mean by "cancel"? If you mean have your card issuer give you a new card with a new number, and stop allowing charges using the old number, that isn't necessarily sufficient. You may have to close your underlying account. Visa and MasterCard both have updater services, which are available to some (but not all--I'm not sure what exactly the requirements are for access) merchants that accept their cards. The updater service allows the merchant to inquire about a particular card number and receive back a status that can be one of: no info available; card still valid; card replaced and here is the new card number and expiration date; account closed.
- acchow 13y ago> card replaced and here is the new card number and expiration date I assume they don't do this if they replace a card that was stolen/compromised...
- stock_toaster 13y agoIs there a difference if you report your card lost (just ask for replacement) or stolen?
- encoderer 13y agoThere is absolutely no risk that this would happen if you call and report your card as stolen. None. Now, if you've already had a charge authorized, then yes, the issuers has to allow that charge to be captured, even if you cancelled the card in the interim. But your issuer can certainly tell you if there are any valid authorizations outstanding.
- rapsourly 13y agoMy credit card was recently reissued without my request. The accompanying letter said it was being reissued to prevent fraud, as a merchant had recently disclosed a compromise. It did not say which merchant, but not I suspect it could have been linode. Has anyone else had this happen?
- archon 13y agoI'm not positive that it was Linode, but I received this email from my bank about the card I used for Linode (bank name removed): "We were notified by a payment processor that your debit card information, such as your name, debit card number and expiration date may have been compromised. Unauthorized access to non-_____ systems may have occurred through a merchant where you shopped or dined, or by other fraudulent activity. Specific details about the compromise were not reported to _____."
- maqr 13y agoWF opted to send me a new card out of nowhere, without explaining why they're sending me a new card. I suspect it's due to the linode breach.
- pavel_lishin 13y agoMy bank does this to me from time to time, without bothering to notify me. It seems incredibly insecure to me - I do have to call to activate it, but there are no "secret" questions asked during this process, just the last four digits of my social security number, and my zip code (and guess where the card gets sent to?)
- Encosia 13y agoI believe you only get that streamlined activation if you call from the number they have on file for you, which makes it more secure than it seems.
- MetaCosm 13y agoI suspect it isn't as a fellow WF customer and Linode customer.
- mbesto 13y agoPlease provide a little more evidence than starting a flame war. Although it could in theory be true, it's a fairly baseless claim until you present a little more evidence. For my online transactions I use prepaid cards that are easy to dispose of, and this card was used solely for linode. Couldn't the online card issuer be to blame? How do we know you haven't mistakenly used it for anything else? The fact that you use prepaid cards for online purchases seems fishy to me in the first place (which is just as baseless of a claim on my part as yours is here). groceries, cheese How do you use a online generated CC for groceries and cheese?? From Linode: Credit card numbers in our database are stored in encrypted format, using public and private key encryption. The private key is itself encrypted with passphrase encryption and the complex passphrase is not stored electronically. Along with the encrypted credit card, the last four digits are stored in clear text to assist in lookups and for display on things like your Account tab and payment receipt emails. We have no evidence decrypted credit card numbers were obtained. https://blog.linode.com/2013/04/16/security-incident-update/ https://blog.linode.com/2013/04/16/security-incident-update/ TL;DR - This is unfair to Linode and I think the community (who uses their service quite frequently) would appreciate if you took it up with them first, before you start a smear campaign.
- jmillikin 13y agoThe fact that Linode stored the public and private keys in the same directory is strong evidence that they do not have any competence in security. Their reluctance to disclose the compromise of their customer's passwords and financial data is evidence that they are not trustworthy. So on one hand we have someone who is careful enough about their finances to use disposable prepaid cards for renting a VPS. On the other, a company that doesn't understand how encryption works and had to be forced to disclose the attack by the FBI. Which do you believe?
- dllthomas 13y ago"stored the public and private keys in the same directory" People keep harping on that, but as phrased that's not a problem. Wherever you have your private key, there's no reason not to also have your public key. The issue is if the private key was living somewhere inappropriate. Consider that "public and private keys in the same directory" is exactly what happens when you run ssh-keygen on any of the typical setups; failing to then remove the public key is not any kind of a security threat.
- rosser 13y agoAnecdata to the contrary, I've seen no suspicious activity on my Linode-associated card.
- ChuckMcM 13y agoYet? One of the things I've learned by reading Danchev and other blogs on the scourge of credit card fraud is that 'carders' seem to have waaaaaay more cards than they need so the turnaround time between having it be made public and having it used can be quite long. So far for me every time one of my cards has been compromised there was a small charge that went through before the bigger charges came in. And my bank has been pretty good about effectively freezing things as soon as that small charge hits. Given all the big data stuff on my 'work' cards (like gas card which is only used to buy fuel) it should be instantly obvious if a charge is bogus coming from a non-gas station. But I digress. I wish someone would set up a 'whitelist only' type credit card where I could first do a small test charge, then I could authorize that source with my bank, and then their regular charges would go through. But if the number was compromised any attempt to use it anywhere that I hadn't pre-approved would be rejected.
- rosser 13y agoFair enough. "Yet." I've also noticed the same pattern with compromised cards: a couple of small auths to test the waters, and then increasingly large charges coming from decreasingly likely places. I regularly log onto my online banking and inspect the recent activity looking for exactly that kind of activity. I've long wished for the same, "whitelist-only card" type thing, too. I think I might smell an opportunity...
- WestCoastJustin 13y agoLinode stored the encrypted credit card numbers in our [linode's] database ... we have no evidence decrypted credit card numbers were obtained. [1] To me, this implies that the attackers did indeed get the encrypted data. This would be a mighty juicy target to focus your decryption efforts on! In my mind, it was only a matter of time. Regardless of whether OP's story holds water.. get your card re-issued if this applies to you! [1] https://blog.linode.com/2013/04/16/security-incident-update/ https://blog.linode.com/2013/04/16/security-incident-update/
- marshray 13y ago> This would be a mighty juicy target to focus your decryption efforts on! In practice, either the Linode data was properly encrypted and keys properly managed, or it wasn't, rendering the encryption worthless. There's very little middle ground. If you can break properly encrypted data, you have way bigger opportunities than carding.
- thaumaturgy 13y agoAttackers claimed that the keys were stored in memory and that they retrieved them: "We proceeded to breach Linode and acquire their in-memory keys." http://straylig.ht/zines/HTP5/0x02_Linode.txt http://straylig.ht/zines/HTP5/0x02_Linode.txt
- gee_totes 13y agoOP, I'm confused how your system for paying for things online works. If it's a prepaid card, I'm assuming that you have to load it with money. Since you're just using it for Linode, you couldn't have loaded that much money on it (unless you're paying for huge Linodes). I'm wondering how large these large amounts were and why they didn't simply empty out the amount on the prepaid card. Besides my confusion (if I were using your system, I would load $20 or whatever onto the card each month and then the maximum I could lose if the card was stolen was $20), I would also like to point out that while prepaid cards are easy to dispose of, Credit Cards typically provide better fraud protection. With credit cards, there is normally a $50 liability if the card is stolen and no time limits around reporting it. With debit cards, there are time limits around reporting the card being lost or stolen. With prepaid cards, they are not subject to the jurisdiction of the FDIC and consumer protections are voluntary on the part of the issuer.
- zachlatta 13y agoThis isn't because of Linode. Both the hackers and Linode themselves have shown that no credit card information was stolen.
- cmsmith 13y agoTangentially: Why do merchants really need to store CC numbers? From the consumers' standpoint, there would be no difference if, during the first transaction, the merchant is issued some alterate key with which to charge the account. Each merchant would be issued their own key, so there would be no risk of a security breach spreading outside of the merchant.
- bluelu 13y agoHetzner, which was hacked today, did so. They got a unique id back from their payment provider which they stored in their database in order to bill. Depending on your payment provider, you will be however locked in and can't change anymore.
- wr0ng 13y agoMostly they don't. The payment provider stores this and provides that and the truncated PAN (the card number with digits masked by asterisks). One of the things you pay payment providers for is for taking on the risk of the higher levels of PCI compliance.
- bifrost 13y ago> Why do merchants really need to store CC numbers? They need to store them transitionally to use them, but in general you don't really want to keep it around. The only legit reason is for subscription/recurring based charges, but if you're doing that you want to make damn sure you're not stupid with how you store them. Stripe makes it super easy to never even see a CC, so I use them for a bunch of stuff, you can even do reocurring charges pretty easily. If you have any doubts about storing data safely, DO NOT DO IT.
- dangrossman 13y agoThis creates lock-in with whatever company is storing the cards. Let's say you let PayPal store all your cards and you only had tokens. Now, you want to switch to Stripe, but you'd have to re-acquire the cards from all your customers to do so. If you're doing recurring billing, you're going to lose a significant percentage of your revenue doing this, perhaps so much that it's not feasible to switch even though you're unhappy with your current processor.
- peterwwillis 13y agoDo you use Windows? If so, you are infected with Malware that stole your card number and it finally got used. I don't know why this is getting downvoted. This is a perfectly valid explanation for why your card got charged that contradicts your reasoning that Linode's encrypted card database got cracked.
- ksmiley 13y agoThe way you phrased it makes it sound as though, if you are a Windows user that experienced fraudulent charges, then the _only_ possible explanation is malware. Your explanation is certainly possible, but it doesn't contradict the Linode explanation. You might say that the former is much more likely than the latter, but that doesn't rule linode out.
- brink 13y agoI just had to cancel my card due to a large, unauthorized purchase at Walgreens states away. I don't know that it was from Linode, but it was the same card that I had when Linode was compromised.
- EugeneBelford 13y agoYour source of identity theft is elsewhere. CVVs were not stored in the database, and we provided shred logs. Do some research before you blame anyone but yourself. - HTP
- ianmcgowan 13y agoI just got notified by my bank about a fraud notice, and they cancelled the debit card I use for Linode. It's a huge pain, but I'm inclined to give Linode the benefit of the doubt. I've done enough stupid things in my life to not cast the first stone. Hopefully they'll learn from this, and beef up both their approach to security and their transparency. Strike one.
- maukdaddy 13y agoI just got an email yesterday from Amex about suspicious activity on my account. The card was used to make purchases from at least three dating sites, groupon, Microsoft, hidemyip, and a handful of others. This card is tied to Linode, Amazon, and one or two other large merchants. Sure looks like Linode CC numbers were breached.