Security Notification and Linode Manager Password Reset

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @02:16PM (#10845278)

This is at least the fifth time I can count that linode has been hacked, really? Maybe it's time to ditch that coldfusion stack?

Edit:

1.The bitcoin hacks, March 2012

2.HTP hack, April 15, 2013 (CF exploit)

3.Second HTP hack April 16, 2013 (Another CF exploit)

4.MySQL server that allowed anonymous logins (?!?!) January 19, 2014

5.This hack

I'm not counting their domain name and various other parts of their infrastructure provided by third parties being compromised, but if I was the list would be significantly longer.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by mapgrep on Tuesday January 05, 2016 @02:56PM (#10845561)

I was just thinking the same thing. I've been a customer for >10 years but this is getting ridiculous.

First 2013 attack was apparently exacerbated by cleartext password storage for LISH (their management shell) and API tokens https://marco.org/2013/04/16/linode-hacked

The 2012 Bitcoin attack involved a breach of Linode's customer service portal http://arstechnica.com/business/2012/03/bitcoins-worth-22800...

Today's attack is some kind of unspecified or unknown breach involving Linode manager.

I guess the obvious commonality here is that all the attacks target the "soft" Linode layers AROUND managing deploys of Linux and Xen/KVM/UML rather than the "hard" targets of those widely used systems. This also happens to be the layer where Linode should be adding value (as opposed to the cheaper VPS providers out there) and I think it's increasingly troublesome that they continue to have such severe security issues.

Is this company (CEO - Christopher Aker) not investing in security staff, security training, best practices etc, or are they investing tons and just getting breached because they host so many sites? Unclear. But it's easy to imagine it's the former, from the outside, given all these incidents.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @03:02PM (#10845605)

Actually the 2013 hack was caused by linode running blatantly misconfigured CF installations, like doing stuff that the manual has big warnings about.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by throway-not-909 on Tuesday January 05, 2016 @03:20PM (#10845722)

A customer warned Linode team about the exposed CF folder. CEO aggressively shrugged it off. "That doesn't matter, it's nothing, that's a non issue." Dev who was a bit of a suck up parroted the same telling support to shut up about it. This was six months before HTP happened.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @03:23PM (#10845740)

We were aware of it for probably an year before anyone bothered to spend 10 minutes looking at coldfusion source. That's all the time it took.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by mapgrep on Tuesday January 05, 2016 @05:41PM (#10846675)

V interesting. Do any of the other VPS providers strike you as more secure alternatives?

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @06:13PM (#10846912)

I'd avoid VPS providers in general, but AWS is on a whole different level than linode. They actually understand what they're doing well enough to do live xen patching etc.

But yeah, people get hacked through their hosts all the time. Best approach is colo with minimum access for the dc staff.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by nickpsecurity on Tuesday January 05, 2016 @08:27PM (#10847724)

That's been my recommend for a long time. Plus, I liked obfuscating with unusual CPU choices and network guards (esp for protocol layers). Worked wonders with about no effort outside setting up guards. Opponents throw so much x86 shellcode at your Alpha, etc boxes while never quite getting stuff to run.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by sarciszewski on Tuesday January 05, 2016 @03:16PM (#10845690)

For those not in the know, ryanlol was one of the people on the team involved in the 2013 hacks.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by throway-not-909 on Tuesday January 05, 2016 @03:22PM (#10845731)

Really? Thomas Asaro told us they were all in jail.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @03:23PM (#10845747)

Nobody went to jail, I'm the only person being prosecuted. I won't go to jail.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by sarciszewski on Tuesday January 05, 2016 @03:29PM (#10845787)

I know of at least one other of the alleged HTP members who is not only not arrested, but still actively involved in the information security community.

Then there are other personalities that went dark, whom are presumably also not arrested.

Unless Thomas Asaro can name names, that was a bluff.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by threeseed on Tuesday January 05, 2016 @03:28PM (#10845781)

The best thing about the 2013 hack was that news of it was on Slashdot days before it was mentioned to customers.

I've been consistently saying this for years. Linode is a joke and you would be crazy to use them for anything other than toy/non-critical use cases.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ddevault on Tuesday January 05, 2016 @02:41PM (#10845462)

>Maybe it's time to ditch that coldfusion stack?

[Linode developer here]

Been working on (re)writing things in Python since I started. It takes a while, but I think everyone recognizes that the CF codebase is difficult to maintain. The good news is that significant progress is being made and we're still doing routine audits of the existing stuff.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @02:53PM (#10845539)

>we're still doing routine audits of the existing stuff.

This doesn't work, auditing coldfusion code is impossible without auditing the entire platform. The whole platform is so full of bugs and strange behaviour that it's actually impossible to produce secure coldfusion code.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by Sir_Cmpwn on Tuesday January 05, 2016 @02:56PM (#10845564)

I can't really deny that CF is that bad, but it'd be irresponsible to just let the codebase rust as we rewrite it - and we are rewriting it.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @03:03PM (#10845614)

When did you start rewriting it? It doesn't take years to replace this stuff.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ddevault on Tuesday January 05, 2016 @03:08PM (#10845643)

I was hired in July and have been driving most of this effort and we're shipping rewritten versions of some parts of our infra soon™

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by StavrosK on Tuesday January 05, 2016 @03:36PM (#10845837)

That sounds good, at least, thanks for letting us know.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by technion on Tuesday January 05, 2016 @05:11PM (#10846451)

    MySQL server that allowed anonymous logins

Has anyone got more information on this? Various Google searches keep pointing me at the other four hacks.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @05:17PM (#10846486)

https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-...

They try to downplay it pretty hard.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by technion on Tuesday January 05, 2016 @08:15PM (#10847656)

Thanks for this link. Although it talks about:

    database accessed using old forum credentials

So I'm not sure "anonymous login" would be an entirely accurate description.

[ Parent | on HN ]

Re:Security Notification and Linode Manager Password Reset by ryanlol on Tuesday January 05, 2016 @08:27PM (#10847721)

The server would in fact accept any credentials as it had been started with --skip-grant-tables. Tested it myself.

[ Parent | on HN ]