Was there ever an update to the customer support portal issue that allowed a few sites to get hacked? If so I could not find it.

I would really like to know what exactly happened there.

I refer to this:
http://pastebin.com/UW7iT5fj
http://pastebin.com/6sSk00js

EDIT:
Ok, I found this:
http://status.linode.com/2012/03/manage ... ident.html

It doesn't describe how the attacker got a working customer support login in the first place, or how the attacker knew what machines to attack.

They said they were still gonna do an announcement on March 9:


However, as of today there hasn't been one yet. Hopefully soon, though.

I suspect the linode manager/api maintenance over the past few days may have something to do with why there's no announcement yet. They're busy changing things making them more secure then they'll make an announcement.

Of course this is pure speculation.

_________________
Paid support
How to ask for help
1. Give details of your problem
2. Post any errors
3. Post relevant logs.
4. Don't hide details i.e. your domain, it just makes things harder
5. Be polite or you'll be eaten by a grue

If there is some issue with the Linode manager this could well happen again, or maybe it has happened before. BitCoin sites will complain loudly when things like this happen but most people won't.

If I'm given no information I tend to think the worst. I don't think I'm alone in that.

The worst obviously didn't happen, because we're all still here.

In this particular case, there were obvious and blatant indications that something bad happened: changing the root password required a reboot and multiple entries in the job log. Failure to notice or investigate unexpected reboots is probably pretty common, though.

Outside of the job queue and status information, there is likely complete isolation between the Linode Manager and the hosts themselves, limiting to the scope of any manager breach. This is a significant limitation when developing new features, but it could have been much much much worse...

(Cheap plug: a script to e-mail you the contents of your node's job queue on boot.)

_________________

/* TODO: need to add signature to posts */

We are, how about the multinational companies who never post on this forum?

Until we get an accurate and complete update from Linode it's all just guesswork.

Pretty much, yeah. My info is nothing but an educated guess. -rt

_________________

/* TODO: need to add signature to posts */