Web托管服务商Linode官方博客详细解释了 这次黑客入侵事件，证实客户数据失窃，但表示信用卡号码等信息都加密了。Linode称，他们认为自称HTP的黑客组织利用了Adobe ColdFusion应用服务器的一个0day漏洞，获得权限访问web服务器、部分源代码和数据库，黑客没能渗透到托管机器或其它服务器。Linode 表示，信用卡号码都以加密格式储存，使用公钥和私钥加密，其中私钥本身也用了复杂密码加密，而且密码没有以电子形式保存。信用卡号码加密，但为了便于查阅 和在帐号中展示，最后四位数字是以明文形式显示。目前不知道黑客是否能暴力破解加密私钥的“复杂密码”，如果破解了那么黑客就能完全掌握Linode客户 的信用卡号码。
Security incident update
April 16, 2013 2:55 am
Yesterday, a group named HTP claimed responsibility for accessing Linode Manager web servers, we believe by exploiting a previously unknown zero-day vulnerability in Adobe’s ColdFusion application server. The vulnerabilities have only recently been addressed in Adobe’s APSB13-10 hotfix (CVE-2013-1387 and CVE-2013-1388) which was released less than a week ago.
As a result of the vulnerability, this group gained access to a web server, parts of our source code, and ultimately, our database. We have been working around the clock since discovering this vulnerability. Our investigation reveals that this group did not have access to any other component of the Linode infrastructure, including access to the host machines or any other server or service that runs our infrastructure.
Credit card numbers in our database are stored in encrypted format, using public and private key encryption. The private key is itself encrypted with passphrase encryption and the complex passphrase is not stored electronically. Along with the encrypted credit card, the last four digits are stored in clear text to assist in lookups and for display on things like your Account tab and payment receipt emails. We have no evidence decrypted credit card numbers were obtained.
Linode Manager user passwords are not stored in our database, but their salted and cryptographically hashed representations are. Despite the uselessness of these hashes, as you know we expired Linode Manager passwords on Friday.
There were occurrences of Lish passwords in clear text in our database. We have corrected this issue and have invalidated all affected Lish passwords effective immediately. If you need access to the Lish console, you can reset a new Lish password under the Remote Access sub-tab of your Linode.
For users who have set an API key, we’re also taking action to expire those keys. We’ll be emailing API-enabled users with that information.
We take your trust and confidence in us very seriously, and we truly apologize for the inconvenience that these individuals caused. Our entire team has been affected by this, leaving all of us, like you, feeling violated. We care deeply about the integrity of Linode and are proud of the work that we accomplish here for you. This unfortunate incident has only strengthened our commitment to you, our customer.
Please feel free to contact customer service via our ticket system or support@linode.com if you have any questions or concerns.
Filed under: announcements by caker