Hacker News Reader

Comment by ultimoo | Hacker News Reader

The update has quite a frank and an apologetic tone to it. Especially the concluding paragraph gives it a very empathetic touch. It must be truly tough for the ops folk at Linode to have suffered an attack due to a third party 0-Day exploit. It could happen to any of us really.

On a side note, I am not sure of the "some occurrences of plaintext Lish passwords". Seems like quite a goofup on Linode's part.

View on HN

Adobe stuff is best assumed vulnerable at all times though.

It's not really a zero-day, if a patch has been out for a week though.

It was 0-day when they got hit. Sad thing is that they do not tell how much time has passed since the hack.

Yeah, maybe you're right. The text is a bit unclear about that.

Yeah, they didn't tell us when they got hacked, but seclist did (3/31/2013): http://seclists.org/nmap-dev/2013/q2/3

3/31/2013 is the backup they're reverting to, not when they got hacked though, right? (The email refers to "downtime over the last week", so I guess the hack happened around 6th April or later.

I'm not sure, their wording around it is a bit convoluted

"... previously unknown zero-day vulnerability in Adobe’s ColdFusion application server. The vulnerabilities have only recently been addressed in Adobe’s APSB13-10 hotfix (CVE-2013-1387 and CVE-2013-1388) which was released less than a week ago."

To me that reads like 'it was a former zero-day exploit", as all exploits are.

Not all exploits are zero-day exploits. As I understand it, a zero-day exploit is one that is used in the wild before it is disclosed. Plenty (most) vulnerabilities are only disclosed once a fix has been implemented.

I stand corrected

Linode brought this issue to Adobe's attention. It's pretty clear that the hack happend 1-2 weeks BEFORE it was announced to the public on Friday. See: http://seclists.org/nmap-dev/2013/q2/3

seclists.org was one of the sites hit in the hack. See how they were down "over the last week". Also note that the Adobe security bulletin was release on April 9: http://www.adobe.com/support/security/bulletins/apsb13-10.ht...

So ya, these hackers found the problem (a 0-day in Coldfusion), used it against Linode. then Linode got Adobe to look into it and found the cause.

Sorry but having passwords in plaintext is not a "goofup".

It is completely and utterly inexcusable.

A) It wasn't account passwords. It was LISH (no better but I thought I'd point that out) B) Not all passwords were in plaintext C) Judging from the above, I would say that there was some stuff up where passwords were written to the logs when they were changed but that's just speculation.

> It could happen to any of us really.

Yes, but the whole private key thing and the ability to access the cc numbers from the front-end (unless they hacked the DB server as well, I think they didn't?) reeks of failure.

The only thing standing between the plain text cc numbers and the hackers is the passphrase, better pray that it's a good one.

Reply on news.ycombinator.com