3 ms·
The email I just received said: > Within hours of the start of the intrusion, we were able to detect and remove the attacker, and shut down the attack.
by darkr 11y ago
The email I just received said:
> Within hours of the start of the intrusion, we were able to detect and remove the attacker, and shut down the attack.
- rdl 11y agoWho cares? It was compromised, and customers weren't notified for 21 days. If this were some highly regulated banking/securities/government system, 21 days MIGHT be ok for public notice, but not for an infrastructure tool with highly technical users. People get hacked (not good), but responding badly is the true badness. And now additionally we're in WTF hell because no one knows if linode was compromised meaningfully (again), or if it was just a PagerDuty credential which got compromised.
- noir_lord 11y agoPagerDuty use AWS and Linode, be interesting to see which one was responsible. https://support.pagerduty.com/hc/en-us/articles/202830570-Where-is-PagerDuty-hosted- https://support.pagerduty.com/hc/en-us/articles/202830570-Wh...
- rdl 11y agoIf it was AWS (and not just AWS credential mismanagement by a client), I will donate $100 to PETA.
- jacquesm 11y agoThat's an easy bet, if it was AWS there will be much higher visibility targets than pagerduty, the fact that that is not the case makes it seem as if betting against you at this point is a losing proposition.
- sarciszewski 11y agoAccording to Julius Kivimaki (whom has hacked Linode countless times, including under the Hack the Planet hacker collective), Linode is pretty much an open door for blackhats.
- ryanlol 11y agoBeat me to it.
- akerl_ 11y agoIt seems like if the compromise were due to a failure on the provider's side, rather than the more common stolen/phished credentials, PagerDuty would be more clear about laying fault where it's due. It would help clarify that they didn't directly make an error, and allow them to put the ball in the provider's court to respond. Instead, the post's comment makes a reference to "an administrative panel provided by one of our infrastructure providers". It's not clear if this refers to the provider's internal tool, or the administrative panel they expose to customers for administering their accounts. If the former: I'd prefer they name the provider. If the latter, it might be worth clarifying the wording so it's more clear.