Hacker News Reader

Comment by throwsep3 | Hacker News Reader

I wonder if this is a diversion to keep Linode's security team busy so they won't notice someone compromising the Xen nodes with XSA-185/6/7/8?

View on HN

Apparently they came to the same conclusion—just a bit late.

https://status.linode.com/incidents/frq9sz7dyb1x

What in that article makes you think that? I don't see it. They do say "we'll have to upgrade Xen nodes", but they don't mention the DDoS or link them.

Why would they? Timing and the fact that it has happened before make it seem likely.

The XEN update was a scheduled thing -- I got an email about it weeks ago (had one linode I hadn't moved to KVM), and it was already scheduled for this weekend.

That said, I don't disagree that the attackers might be trying to distract the team while they exploit that... though I don't see what it gets them compared to quietly exploiting the XEN issues before they were common knowledge on 9/8.

You're the one who linked to the piece. I think it's your job to be clear that it doesn't say that, it's your conclusion.

Fascinating, seems believable.

XSAs are released alarmingly frequently. I've always wondered if KVM is really more secure or if it just gets less scrutiny (certainly there's a class of qemu vulnerabilities that impact both hypervisors).

KVM is a much smaller code base, which probably helps.

I've noted the AWS security bulletins[0] list nearly every Xen advisory with "AWS customers' data and instances are not affected by these issues, and there is no customer action required."

It would appear? you'd need to go back for quite a few months of being unpatched to find a genuine issue. Unless something about Amazon's mitigations don't apply universally.

[0] https://aws.amazon.com/security/security-bulletins/

AWS (and other large hosts: https://www.xenproject.org/security-policy.html search for predisclosure) get notified before the public.

Amazon and other big cloud providers get xen security fixes first, there was an HN discussion about it. Some they've probably already implemented the fix.

This happened last time.

They switched to KVM.

As far as I know, not all VPSs are running KVM yet. I migrated my last VPS to KVM just yesterday.

They recently incentivized customers to switch to KVM again by doubling the ram but they haven't required a switch yet.

Reply on news.ycombinator.com