Data hosted with ♥ by Pastebin.com - Download Raw - See Original
  1. <me>
  2. 45 minutes ago Hello,
  3.  
  4. this morning (UTC) I found my Linode account was hacked - linodes were after restart, root passwords were changed and there are "Change root password" records in Host job queue which I didn't initiated. Attacker also used Lish console for adding SSH keys into server accounts: http://pastebin.com/sHJ6aCdR .
  5.  
  6. Do you have any logs (at least IPs) of login attempts to Linode manager? I was using unique password for linode manager which wasn't dictionary word or combination of them, it also contained numbers etc.
  7.  
  8. There are two possibilities: there's backoor/security vulnerability in linode manager or somebody is trying brute force attack against linode manager, which sounds pretty crazy, because you should notice milions of attempts for login form...
  9.  
  10. Best,
  11. Marek
  12.  
  13. ericoc
  14. 32 minutes ago Hi,
  15.  
  16. I'm sorry to hear this! There's no indication of any sort of "brute force" attack against the Linode Manager nor are we aware of any security issues within the Linode Manager though you may want to investigate setting up IP white-listing from the "my profile" link.
  17.  
  18. The only recent log-ins to the Linode Manager related to your account are for your "<me>" user:
  19.  
  20. 84.42.xxx.xxx / 2012-01-28 09:23:56
  21. 89.176.xxx.xxx / 2012-02-06 10:44:57
  22. 89.176.xxx.xxx / 2012-02-06 13:37:01
  23. 109.80.xxx.xxx / 2012-02-07 08:41:34
  24. 109.80.xxx.xxx / 2012-02-08 10:07:23
  25. 84.42.xxx.xxx/ 2012-03-01 03:38:11
  26. 84.42.xxx.xxx / 2012-03-01 04:50:10
  27.  
  28. Please feel free to contact us with any future questions or concerns.
  29.  
  30. Regards,
  31. Eric
  32.  
  33. <me>
  34. 25 minutes ago Hello Eric,
  35.  
  36. in which timezone are those times?
  37.  
  38. ericoc
  39. 24 minutes ago Hi,
  40.  
  41. All times would be in EST. Let us know if you ever have any additional inquiries.
  42.  
  43. Regards,
  44. Eric
  45.  
  46. <me>
  47. 17 minutes ago Servers were restarted and passwords changed (over Linode Manager, not over "passwd" in shell, because there's entry in Host job queue) in 7am UTC (=2am EST). Can you please investigate how this can happen when nobody is logged into manager?
  48.  
  49. Last two logins (from 84.42.xxx.xxx) are from my IP, but it happen AFTER the attack. There's no previous login for almost one month.
  50.  
  51. Or is there any other possibility how can appear job for password change in Manager without logging into the account?
  52.  
  53. Best,
  54. Marek
  55.  
  56. ericoc
  57. 10 minutes ago Hi,
  58.  
  59. Unfortunately, there's no indication of any issues on our end. It may be possible that a previous session from an older log-in on either the "<me>" user account or one of the other users under your account made these changes.
  60.  
  61. Please don't hesitate to contact us if you ever have any additional inquiries.
  62.  
  63. Regards,
  64. Eric
  65.  
  66. <me>
  67. 5 minutes ago Do you have any more logging around Host job queue? For example - who initiated it?
  68.  
  69. I really doubt that attacker kept session open for almost one month before he changed the password. And there's clean attack vector:
  70.  
  71. 1. Last login in Manager on 08/02/2012
  72. 2. Password changed in Manager & linodes restarted on 01/03/2012 2:00am EST
  73. 3. Login in Manager on 01/03/2012 3:38 EST (it was me checking what happen)
  74.  
  75. Please try to explain how this can happen without some vulnerability on your end.
  76.  
  77. Best,
  78. Marek
  79.  
  80. akerl
  81. 5 hours ago Hello,
  82.  
  83. I've escalated this to our administrators so that they can look into this matter. We'll update you once we have more information.
  84.  
  85. Regards,
  86. Les
  87.  
  88.  
  89. tasaro
  90. 29 minutes ago Hello Marek-
  91.  
  92. We were alerted to the suspicious activity and have identified and corrected the issue. Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring.
  93.  
  94. We regret that this incident has occurred, and apologize for the unnecessary work this may have caused you.
  95.  
  96. We appreciate your business and certainly want to keep you as a happy and satisfied customer. If there is anything we can do to make this up to you, certainly let us know.
  97.  
  98. Regards,
  99.  
  100. Thomas Asaro
  101. Vice President