It's a bad day for security. OpenSSL has been compromised for most distros. Enterprise distros (RH <6.5) are not affected.
People missed (or dismissed) my warning before should re-read it. Here is a small addendum.
If you use a VPS, here are your layers of protection:
1. Your own security
-Did you secure ports via iptables against outsiders?
-Were you running any SSL services? Then those may have been compromised. SSH was not affected but is exploitable if other SSL vulnerable services were running.
2. The security of your VM host which you have NO control over.
-The security of other VMs running on the same VM host as you. What were they running? Did they run SSL vulnerable services via LAMP? If they got rooted, then was your VM host rooted via host escalation? If so, then you got rooted as well.
3. The security of your VPS provider which you have NO control over.
-What about web services? Was your account compromised? Was your user info compromised? If so, you should check if anyone has logged into your account or tried to masquerade as you.
This openssl vulnerability hits web based services pretty bad. Every key/password is to be considered compromised at the moment. This hits especially bad against newbies because they will generally use insecure distros such as debian, ubuntu, mint.You could run a micro on EC2 for $14/mo to do it.
Important: Please take time to read this!I see a lot of excitement from people looking to run masternodes, but ensure you know what you are doing. Among them, is NOT putting a masternode on
ANY VPS provider.
Here is a checklist of things that could go wrong. Remember it's your 1000 drk sitting in a hotwallet.
1. Remember you did not do the install, you launched an image that was prepared. This is analogous to putting your key into someone else's computer. There is no way of knowing the image is not rootkitted because you are
INSIDE the image.
2. VMs are still rather new and there are plenty of host privilege escalation exploits. This means security of your vm is not 100% yours. You are multiplying your risk by the number of other VMs on your VM host, and the network it is connected to.
3. VPS storage is rather primitive and NOT designed for security. Your root storage is NOT encrypted at all. Encrypting a container inside your vm will not do any good because it must be decrypted for your process to run it. Then the VM host has access to it.
4. (offtopic) If you don't have the resources to set up your own machine and are just looking to use a VPS, you may not have general knowledge of hardening your image against vulnerabilities. A few topics to be knowledgeable about include selinux, PaX, iptables, auditd if you run anything else what so ever on the VM.
5. Trusting your provider: those of you who have been in this game long enough will remember countless heists, but the one that rings out in my memory is the one where someone lost a wallet of 25k btc when btc was at $20 USD. He cried over $500k of btc, what was he thinking when 25k btc meant the loss of $30million+? I haven't looked it back up, but as I recall, he NEVER found out how he lost it, and that was the worst part. The only suspicion was that he uploaded a backup of his wallet onto dropbox. Who took it? A dropbox employee? Was dropbox compromised? As far as I know, no one ever found out. No amount of security audits can help find the culprit when the number of doors and windows are an unknown variable.
If you're into darkcoin because privacy is your thing but you don't think twice about online security, I have a VM to sell you.
ps. sign up for your free darksend.it/username at
http://darksend.it