<story><title>Linode Security Advisory</title><url>https://blog.linode.com/2016/02/19/security-investigation-retrospective/</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>&lt;i&gt;Update: also, read this comment&lt;/i&gt; right away. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11136948&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;news.ycombinator.com&amp;#x2F;item?id=11136948&lt;/a&gt;&lt;p&gt;I find this update very hard to follow. Can someone tell me if I&amp;#x27;m misreading it? I&amp;#x27;m going to quote it twice, and then attempt to summarize:&lt;p&gt;&lt;i&gt;After examining the image from our July investigation, we discovered software capable of generating TOTP codes if provided a TOTP key. We found software implementing the decryption method we use to secure TOTP keys, along with the secret key we use to encrypt them. We also found commands in the bash history that successfully generated a one-time code. Though the credentials found were unrelated to any of the unauthorized Linode Manager logins made in December, the discovery of this information significantly changed the seriousness of our investigation.&lt;/i&gt;&lt;p&gt;and then:&lt;p&gt;&lt;i&gt;The findings of our security partner’s investigation concluded there was no evidence of abuse or misuse of Linode’s infrastructure that would have resulted in the disclosure of customer credentials. Furthermore, the security partner’s assessment of our infrastructure and applications did not yield a vector that would have provided this level of access.&lt;/i&gt;&lt;p&gt;&lt;i&gt;Linode’s security team did discover a vulnerability in Lish’s SSH gateway that potentially could have been used to obtain information discovered on December 17, although we have no evidence to support this supposition. We immediately fixed the vulnerability.&lt;/i&gt;&lt;p&gt;Here is my read of what this says; I&amp;#x27;d like to know if I&amp;#x27;m wrong.&lt;p&gt;&amp;quot;One of our customers got owned up in July, and gave us an attacker source address within Linode. We pickled up the attacker&amp;#x27;s host. In December, we examined the pickled host, and found secrets related to the way we store 2FA credentials, indicating that our credentials database may have been compromised. In conclusion: we have no idea how that could have happened.&amp;quot;&lt;p&gt;Am I missing something else?</text></comment>
<story><title>Linode Security Advisory</title><url>https://blog.linode.com/2016/02/19/security-investigation-retrospective/</url></story><parent_chain></parent_chain><comment><author>noir_lord</author><text>Not sure what to think about Linode anymore, on the one hand from a pure reliability point of view they have been bullet proof, had a few issues during the DDoS in December and I&amp;#x27;ve always found their support to be good (the few times I&amp;#x27;ve used them in 7 years).&lt;p&gt;On the other hand they&amp;#x27;ve had security issues fairly regularly and their response to the DDoS was pretty poor.&lt;p&gt;That said if I was a cynic I&amp;#x27;d say they probably have one of the best setups for dealing with future attacks (old joke about never firing an employee who made an expensive mistake because he&amp;#x27;ll never make that mistake again) and &lt;i&gt;finally&lt;/i&gt; seem to be taking security seriously, for me the list of changes all sound good (particulary open sourcing Linode Manager and tokenising CC&amp;#x27;s had to reset a card because of them once before).&lt;p&gt;We are slowly moving a lot of stuff back to a DC up the road but we still have some stuff with them.</text></comment>