Because next time, they might be. You're going to have to do better than incremental upgrades to convince me to come back.
Because next time, they might be. You're going to have to do better than incremental upgrades to convince me to come back.
https://blog.linode.com/2013/04/16/security-incident-update/
Compromised Linode, thousands of BitCoins stolen (bitcoinmedia.com)
316 points by tillda 510 days ago
https://news.ycombinator.com/item?id=3654110
Linode hacked, CCs and passwords leaked (slashdot.org)
732 points by DiabloD3 101 days ago
https://news.ycombinator.com/item?id=5552756
The story around the Linode hack (straylig.ht)
349 points by foofoobar 79 days ago
https://news.ycombinator.com/item?id=5667027Brief summary: according to the hackers involved, they struck a deal with Linode whereby, if Linode made no moves to disclose the attack, the hackers would shred all of the data they had grabbed. Instead, the FBI forced Linode's hand in the matter. Even if that's not true -- and, in this incident, the hackers came out as more believable than Linode IMO -- there still was no mention of the incident on the Linode blog until after the hackers had claimed credit on Linode's IRC channel and the news of that had started making the rounds. This is identical to the previous incident, where Linode said nothing until after a customer started complaining loudly on their user forums.
Then, Linode wasn't forthcoming with details, despite the hack having occurred a couple of days prior. The second update from Linode came only after additional information had been made public by the hackers, and provided no information beyond what had already become public. Linode claimed that customers' credit card information was still secure, but the hackers claimed otherwise and in the days and weeks following the event, several people claiming to be Linode customers claimed that they were seeing suspicious activity on cards that could reasonably be traced back to Linode (cards that were Linode-specific or used for few enough other services).
The way that Linode has handled both incidents has left me, and many others, with the impression that they simply will not disclose that they've been compromised unless forced to by someone else -- a customer or the attacker(s) -- and then they'll attempt to be very opaque and not-specific about the incident.
It's a shame, because aside from this, I really like Linode. I wouldn't even be interested in looking at other VPS providers if it weren't for this. But now I'm being negligent if I continue to host customer data & services on Linode. I don't know yet if anyone else handles this sort of thing better, but I do know how Linode handles it and it's not good.
This'll be my only comment on this subject. You (or others that are interested) really should just go over past threads discussing the incident.
They made a mistake on the 12th and corrected it by the [with some forum posts in between those two dates and someone claiming responsibility between those two dates] 16th. I'm not seeing the issue in regards to the previous question except 'Hackers say otherwise'.
None of those threads date before the 12th which was kind of the point. I generally assume incompetence before malice while everyone else seems to be the reverse.
And the only reason they admitted it (well at least it looked like that) was because the info had already been leaked through their irc channel[0].
[0]: http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...
Every time someone says that I've noticed either: A) They missed the public notification. B) Their security expectations aren't in line with a VPS environment where everything is controlled through a WAN control mechanism. [e.g. $200k worth of bitcoins stolen...why on earth aren't you using a colo box with your own dedicated hardware that you can be certain is as secure as you can possibly make it. That is something you can do with $2k and at most $200/month.]
a) Linode was extremely cavalier in releasing a public notification. It was all over slashdot and in their support channel, with ZERO notification from them (till long after the fact), leaving the community to assume the worst, which was inline with what actually happened.
I was a Linode customer during their first security incident (Bitcoins stolen). I found out about it through Reddit. It was communicated to customers weeks after through a post to their status page. At no stage were customers informed via email and nobody knows to this day what exactly happened and what exactly has been done about it.
They played it safe by waiting until they actually knew what happened before releasing any information.