<story><title>Linode hacked, CCs and passwords leaked</title><url>http://slashdot.org/firehose.pl?op=view&amp;type=submission&amp;id=2603667</url></story><parent_chain><item><author>jlgreco</author><text>Wouldn&apos;t doing that be a &lt;i&gt;massive&lt;/i&gt; PCI violation?  Aren&apos;t there extensive audits for this sort of thing?</text></item><item><author>danso</author><text>From a purported abridged chatlog with the alleged hacker:&lt;p&gt;&amp;#62; &lt;i&gt;05:42 &amp;#60; ryan||&amp;#62; credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security&lt;/i&gt;&lt;p&gt;&amp;#62; &lt;i&gt;06:00 &amp;#60; ryann&amp;#62; They did try to encrypt them, but using public key encryption doesn&apos;t work if you have the public and private key in the same directory&lt;/i&gt;&lt;p&gt;&lt;a href=&quot;http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt&quot; rel=&quot;nofollow&quot;&gt;http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...&lt;/a&gt;</text></item></parent_chain><comment><author>tptacek</author><text>Extensive PCI audits. Heh.</text></comment>
<story><title>Linode hacked, CCs and passwords leaked</title><url>http://slashdot.org/firehose.pl?op=view&amp;type=submission&amp;id=2603667</url></story><parent_chain><item><author>jlgreco</author><text>Wouldn&apos;t doing that be a &lt;i&gt;massive&lt;/i&gt; PCI violation?  Aren&apos;t there extensive audits for this sort of thing?</text></item><item><author>danso</author><text>From a purported abridged chatlog with the alleged hacker:&lt;p&gt;&amp;#62; &lt;i&gt;05:42 &amp;#60; ryan||&amp;#62; credit cards were encrypted, sadly both the private and public keys were stored on the webserver so that provides 0 additional security&lt;/i&gt;&lt;p&gt;&amp;#62; &lt;i&gt;06:00 &amp;#60; ryann&amp;#62; They did try to encrypt them, but using public key encryption doesn&apos;t work if you have the public and private key in the same directory&lt;/i&gt;&lt;p&gt;&lt;a href=&quot;http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt&quot; rel=&quot;nofollow&quot;&gt;http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...&lt;/a&gt;</text></item></parent_chain><comment><author>toomuchtodo</author><text>I&apos;ve done PCI &quot;audits&quot; for several companies I&apos;ve worked for; it&apos;s a checklist you go down &lt;i&gt;yourself&lt;/i&gt;. That&apos;s why its called a &quot;pci self assessment&quot;.</text></comment>