3 ms·

It took them 21 days to announce this? It's a in-depth post and kudos to them for that, but I'd also like to know _when_ the actual intrusion was (on July 9th w

by jc4p 11y ago

It took them 21 days to announce this? It's a in-depth post and kudos to them for that, but I'd also like to know _when_ the actual intrusion was (on July 9th when they detected it? Months before?)

darkr 11y ago
The email I just received said: > Within hours of the start of the intrusion, we were able to detect and remove the attacker, and shut down the attack.
- rdl 11y ago
  Who cares? It was compromised, and customers weren't notified for 21 days. If this were some highly regulated banking/securities/government system, 21 days MIGHT be ok for public notice, but not for an infrastructure tool with highly technical users. People get hacked (not good), but responding badly is the true badness. And now additionally we're in WTF hell because no one knows if linode was compromised meaningfully (again), or if it was just a PagerDuty credential which got compromised.
  - noir_lord 11y ago
    PagerDuty use AWS and Linode, be interesting to see which one was responsible. https://support.pagerduty.com/hc/en-us/articles/202830570-Where-is-PagerDuty-hosted- https://support.pagerduty.com/hc/en-us/articles/202830570-Wh...
    - rdl 11y ago
      If it was AWS (and not just AWS credential mismanagement by a client), I will donate $100 to PETA.
      - jacquesm 11y ago
        That's an easy bet, if it was AWS there will be much higher visibility targets than pagerduty, the fact that that is not the case makes it seem as if betting against you at this point is a losing proposition.
    - sarciszewski 11y ago
      According to Julius Kivimaki (whom has hacked Linode countless times, including under the Hack the Planet hacker collective), Linode is pretty much an open door for blackhats.
      - ryanlol 11y ago
        Beat me to it.
    - akerl_ 11y ago
      It seems like if the compromise were due to a failure on the provider's side, rather than the more common stolen/phished credentials, PagerDuty would be more clear about laying fault where it's due. It would help clarify that they didn't directly make an error, and allow them to put the ball in the provider's court to respond. Instead, the post's comment makes a reference to "an administrative panel provided by one of our infrastructure providers". It's not clear if this refers to the provider's internal tool, or the administrative panel they expose to customers for administering their accounts. If the former: I'd prefer they name the provider. If the latter, it might be worth clarifying the wording so it's more clear.
hijinks 11y ago
Here is my guess.. Hacker notified them with proof of the hack on the 9th. Gave them a few weeks for a payout and Pagerduty wouldn't payout so the hacker will then release. So to jump out ahead Pagerduty sent out the email. Most cases like this the company claims they found the hacker but that isn't the case.

by jc4p 11y ago

It took them 21 days to announce this? It's a in-depth post and kudos to them for that, but I'd also like to know _when_ the actual intrusion was (on July 9th when they detected it? Months before?)

darkr 11y ago

The email I just received said: > Within hours of the start of the intrusion, we were able to detect and remove the attacker, and shut down the attack.

rdl 11y ago
Who cares? It was compromised, and customers weren't notified for 21 days. If this were some highly regulated banking/securities/government system, 21 days MIGHT be ok for public notice, but not for an infrastructure tool with highly technical users. People get hacked (not good), but responding badly is the true badness. And now additionally we're in WTF hell because no one knows if linode was compromised meaningfully (again), or if it was just a PagerDuty credential which got compromised.
- noir_lord 11y ago
  PagerDuty use AWS and Linode, be interesting to see which one was responsible. https://support.pagerduty.com/hc/en-us/articles/202830570-Where-is-PagerDuty-hosted- https://support.pagerduty.com/hc/en-us/articles/202830570-Wh...
  - rdl 11y ago
    If it was AWS (and not just AWS credential mismanagement by a client), I will donate $100 to PETA.
    - jacquesm 11y ago
      That's an easy bet, if it was AWS there will be much higher visibility targets than pagerduty, the fact that that is not the case makes it seem as if betting against you at this point is a losing proposition.
  - sarciszewski 11y ago
    According to Julius Kivimaki (whom has hacked Linode countless times, including under the Hack the Planet hacker collective), Linode is pretty much an open door for blackhats.
    - ryanlol 11y ago
      Beat me to it.
  - akerl_ 11y ago
    It seems like if the compromise were due to a failure on the provider's side, rather than the more common stolen/phished credentials, PagerDuty would be more clear about laying fault where it's due. It would help clarify that they didn't directly make an error, and allow them to put the ball in the provider's court to respond. Instead, the post's comment makes a reference to "an administrative panel provided by one of our infrastructure providers". It's not clear if this refers to the provider's internal tool, or the administrative panel they expose to customers for administering their accounts. If the former: I'd prefer they name the provider. If the latter, it might be worth clarifying the wording so it's more clear.

hijinks 11y ago

Here is my guess.. Hacker notified them with proof of the hack on the 9th. Gave them a few weeks for a payout and Pagerduty wouldn't payout so the hacker will then release. So to jump out ahead Pagerduty sent out the email. Most cases like this the company claims they found the hacker but that isn't the case.