Also, was the nature of the attack just that the were able to login to your linode admin panel and from their root the machines and then loot your wallets?
The way I understand it the attackers were able to get access to the admin panel and invoked some kind of 'change root password' emergency stuff. The machines were rebooted it seems, which makes sense: The interface of Linode has probably/hopefully no access to the root password. Maybe this 'Reset my root' feature (now I'm guessing) reboots the machine in single user mode or passes init=/bin/sh to the kernel to reset the password once and reboots again afterwards.
Only THEN the attacker had access. But yes, he had root. The good (if you want to call it that) part of it is that this procedure rings every alarm possible. The real owner doesn't have the password anymore, as he'll soon figure out. It's everything but sneaky.
I DO wonder why root is allowed to log in at all, though..
He won't figure it out until he tries to login though.
Also admins that only log with ssh keys and don't use root won't be able to notice that, will they?
2) Very good point. In that case it might work undetected for quite a while..
Even if you fully disable root, that's not going to stop the init=/bin/sh script.
Even if you fix that (securing grub?) you're still screwed because it's a virtual machine, and they can just mount the partition to another VM, and pull all your data/reset root that way.
So, maybe if you have an encrypted partition, no root access, secure grub, and real hardware (it's probably possible to dump the VMs memory by snapshotting it, then pulling the key out that way), you would be secure against attacks like this.
With a VM? No, it's not nearly secure enough for very important things.
Total dataloss for me. But i fyou _do_ remember your dm_crypt password, I think you're safe against these kind of attacks
Someone at Linode did it. Ran a script to see how many bitcoin files there were on all the machines (they probably do these types of queries for anti-virus/whatever anyways) and took a customer support password to log in and get the coins. If he did it right he still might be working there, as it is easy to get credentials from friends/coworkers (even though it should be really really hard).
I'll happily eat my words if that turns out to be what happened, but it is definitely not the simplest answer.
It is technically possible for an employee to do it because it seems (from the linked pastebin above) that is how it was compromised, an elevated account for linode manage was compromised.
As for an employee being the one that did it, that is probably the least likely cause.
I wonder how anyone can trust their linode systems after an admin account being compromised.
It would likely ruin their business to re-install everything, but that is the only way to know root kits have not been installed.
We can only speculate at this point.
The simplest answer is probably that one of the staff was subject to a targeted hack and a 3rd party gained external access to the CSR tools.
Possibly for an extended period of time. <-- This is the concerning part.
It's relatively unlikely an internal staff member would do something this dumb (but, not impossible. we've had this happen _here_ where I work, with credit card numbers, but obviously the person responsible was caught almost immediately).