Linode hack

<me>
45 minutes ago	Hello,

this morning (UTC) I found my Linode account was hacked - linodes were after restart, root passwords were changed and there are "Change root password" records in Host job queue which I didn't initiated. Attacker also used Lish console for adding SSH keys into server accounts: http://pastebin.com/sHJ6aCdR .

Do you have any logs (at least IPs) of login attempts to Linode manager? I was using unique password for linode manager which wasn't dictionary word or combination of them, it also contained numbers etc.

There are two possibilities: there's backoor/security vulnerability in linode manager or somebody is trying brute force attack against linode manager, which sounds pretty crazy, because you should notice milions of attempts for login form...

Best,
Marek

ericoc
32 minutes ago	 Hi,

I'm sorry to hear this! There's no indication of any sort of "brute force" attack against the Linode Manager nor are we aware of any security issues within the Linode Manager though you may want to investigate setting up IP white-listing from the "my profile" link.

The only recent log-ins to the Linode Manager related to your account are for your "<me>" user:

84.42.xxx.xxx	/ 2012-01-28 09:23:56
89.176.xxx.xxx / 2012-02-06 10:44:57
89.176.xxx.xxx / 2012-02-06 13:37:01
109.80.xxx.xxx / 2012-02-07 08:41:34
109.80.xxx.xxx / 2012-02-08 10:07:23
84.42.xxx.xxx/ 2012-03-01 03:38:11
84.42.xxx.xxx / 2012-03-01 04:50:10

Please feel free to contact us with any future questions or concerns.

Regards,
Eric

<me>
25 minutes ago	 Hello Eric,

in which timezone are those times?

ericoc
24 minutes ago	 Hi,

All times would be in EST. Let us know if you ever have any additional inquiries.

Regards,
Eric

<me>
17 minutes ago	 Servers were restarted and passwords changed (over Linode Manager, not over "passwd" in shell, because there's entry in Host job queue) in 7am UTC (=2am EST). Can you please investigate how this can happen when nobody is logged into manager?

Last two logins (from 84.42.xxx.xxx) are from my IP, but it happen AFTER the attack. There's no previous login for almost one month.

Or is there any other possibility how can appear job for password change in Manager without logging into the account?

Best,
Marek

ericoc
10 minutes ago	 Hi,

Unfortunately, there's no indication of any issues on our end. It may be possible that a previous session from an older log-in on either the "<me>" user account or one of the other users under your account made these changes.

Please don't hesitate to contact us if you ever have any additional inquiries.

Regards,
Eric

<me>
5 minutes ago	 Do you have any more logging around Host job queue? For example - who initiated it?

I really doubt that attacker kept session open for almost one month before he changed the password. And there's clean attack vector:

1. Last login in Manager on 08/02/2012
2. Password changed in Manager & linodes restarted on 01/03/2012 2:00am EST
3. Login in Manager on 01/03/2012 3:38 EST (it was me checking what happen)

Please try to explain how this can happen without some vulnerability on your end.

Best,
Marek

akerl
5 hours ago	 Hello,

I've escalated this to our administrators so that they can look into this matter. We'll update you once we have more information.

Regards,
Les


tasaro
29 minutes ago	 Hello Marek-

We were alerted to the suspicious activity and have identified and corrected the issue. Our investigation has revealed a customer support interface was used to access your account. The compromised credentials have been restricted and we are discussing policy changes to prevent this from recurring.

We regret that this incident has occurred, and apologize for the unnecessary work this may have caused you.

We appreciate your business and certainly want to keep you as a happy and satisfied customer. If there is anything we can do to make this up to you, certainly let us know.

Regards,

Thomas Asaro
Vice President