View difference between Paste ID: UW7iT5fj and S2TX9NU1
SHOW: | | - or go back to the newest paste.
1-
palatinus 
1+
<me> 
2
45 minutes ago	Hello,
3
4
this morning (UTC) I found my Linode account was hacked - linodes were after restart, root passwords were changed and there are "Change root password" records in Host job queue which I didn't initiated. Attacker also used Lish console for adding SSH keys into server accounts: http://pastebin.com/sHJ6aCdR .
5
6
Do you have any logs (at least IPs) of login attempts to Linode manager? I was using unique password for linode manager which wasn't dictionary word or combination of them, it also contained numbers etc.
7
8
There are two possibilities: there's backoor/security vulnerability in linode manager or somebody is trying brute force attack against linode manager, which sounds pretty crazy, because you should notice milions of attempts for login form...
9
10
Best,
11
Marek
12
 
13
ericoc 
14
32 minutes ago	 Hi,
15
16
I'm sorry to hear this! There's no indication of any sort of "brute force" attack against the Linode Manager nor are we aware of any security issues within the Linode Manager though you may want to investigate setting up IP white-listing from the "my profile" link.
17
18-
The only recent log-ins to the Linode Manager related to your account are for your "palatinus" user:
18+
The only recent log-ins to the Linode Manager related to your account are for your "<me>" user:
19
20
84.42.xxx.xxx	/ 2012-01-28 09:23:56
21
89.176.xxx.xxx / 2012-02-06 10:44:57
22
89.176.xxx.xxx / 2012-02-06 13:37:01
23
109.80.xxx.xxx / 2012-02-07 08:41:34
24
109.80.xxx.xxx / 2012-02-08 10:07:23
25
84.42.xxx.xxx/ 2012-03-01 03:38:11
26
84.42.xxx.xxx / 2012-03-01 04:50:10
27
28
Please feel free to contact us with any future questions or concerns.
29
30
Regards,
31
Eric
32
 
33-
palatinus 
33+
<me> 
34
25 minutes ago	 Hello Eric,
35
36
in which timezone are those times?
37
 
38
ericoc 
39
24 minutes ago	 Hi,
40
41
All times would be in EST. Let us know if you ever have any additional inquiries.
42
43
Regards,
44
Eric
45
 
46-
palatinus 
46+
<me>  
47
17 minutes ago	 Servers were restarted and passwords changed (over Linode Manager, not over "passwd" in shell, because there's entry in Host job queue) in 7am UTC (=2am EST). Can you please investigate how this can happen when nobody is logged into manager? 
48
49
Last two logins (from 84.42.xxx.xxx) are from my IP, but it happen AFTER the attack. There's no previous login for almost one month.
50
51
Or is there any other possibility how can appear job for password change in Manager without logging into the account?
52
53
Best,
54
Marek
55
 
56
ericoc 
57
10 minutes ago	 Hi,
58
59-
Unfortunately, there's no indication of any issues on our end. It may be possible that a previous session from an older log-in on either the "palatinus" user account or one of the other users under your account made these changes.
59+
Unfortunately, there's no indication of any issues on our end. It may be possible that a previous session from an older log-in on either the "<me>" user account or one of the other users under your account made these changes.
60
61
Please don't hesitate to contact us if you ever have any additional inquiries.
62
63
Regards,
64
Eric
65
 
66-
palatinus 
66+
<me>  
67
5 minutes ago	 Do you have any more logging around Host job queue? For example - who initiated it?
68
69
I really doubt that attacker kept session open for almost one month before he changed the password. And there's clean attack vector:
70
71
1. Last login in Manager on 08/02/2012
72
2. Password changed in Manager & linodes restarted on 01/03/2012 2:00am EST
73
3. Login in Manager on 01/03/2012 3:38 EST (it was me checking what happen)
74
75
Please try to explain how this can happen without some vulnerability on your end.
76
77
Best,
78-
Marek
78+
79
80
akerl 
81
5 hours ago	 Hello,
82
83
I've escalated this to our administrators so that they can look into this matter. We'll update you once we have more information.
84
85
Regards,
86
Les
87
88
 
89
tasaro 
90
29 minutes ago	 Hello Marek-
91
92
We were alerted to the suspicious activity and have identified and corrected the issue. Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring.
93
94
We regret that this incident has occurred, and apologize for the unnecessary work this may have caused you.
95
96
We appreciate your business and certainly want to keep you as a happy and satisfied customer. If there is anything we can do to make this up to you, certainly let us know.
97
98
Regards,
99
100
Thomas Asaro
101
Vice President

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×