Topic: Linode compromised and it's effect on TradeHill - page 2. (Read 7128 times)
It scares me that websites dealing with the amount of money you guys deal with even have the remote consideration of using these types of services (clouds and vps). simply a joke and a very good reveal of the security taken by all these companies.
I haven't seen my funds yet, and no reply from TH since 16 Feb 2012.
Generally I fear that my TH funds (EUR and USD) are gone forever (hope I am wrong), because I do not trust TH any more.
Why? --> See here.
Generally I fear that my TH funds (EUR and USD) are gone forever (hope I am wrong), because I do not trust TH any more.
Why? --> See here.
I'm pasting this from the other thread. We take this very seriously.
Regarding the withdrawals the site will be back up very soon and either have an interface or provide withdrawals via email.
Send an email to [email protected] now if you like and I'll process it as soon as we finish recovering from the Linode hack.
About the email with the information CC'd. We take privacy very seriously. This was an isolated incident where one employee made a mistake and sent out an email to several customers using CC instead of BCC. It's not excusable and the employee has been reprimanded. Despite this only happening once with over 100,000 emails sent I want to make it very clear that it was not our policy and I will take responsibility for this. It was not our intention and I would like to seriously apologize to the people effected.
SOmething I thought hilarious, I read the TradeHill complaint (lawsuit) on Scribd.com, which plastered it with banner ads for Linode "hosting as little as 65 cents a day" between every page. Not just once, but the majority of the ad spots between the 19 pages went to Linode.
That is funny as hell.
-Jered
SOmething I thought hilarious, I read the TradeHill complaint (lawsuit) on Scribd.com, which plastered it with banner ads for Linode "hosting as little as 65 cents a day" between every page. Not just once, but the majority of the ad spots between the 19 pages went to Linode.
I haven't seen my funds yet, and no reply from TH since 16 Feb 2012.
Generally I fear that my TH funds (EUR and USD) are gone forever (hope I am wrong), because I do not trust TH any more.
Why? --> See here.
Generally I fear that my TH funds (EUR and USD) are gone forever (hope I am wrong), because I do not trust TH any more.
Why? --> See here.
It is reassuring to see you posting here - is TradeHill customer service still working?
Thanks. Yes customer service is still working we're just swamped trying to get all the funds out and deal with a lot of individual requests.
When the banks simultaneously closed our accounts it created a huge backlog. We'll get to the emails as fast as we can. Almost everything has been processed at this point and is under control. We'll have the Linode situation sorted soon as well.
-Jered
We're currently dealing with them but we are being very careful and doing them all manually.
I'd estimate a few days at most we'll be caught up and they shouldn't take more than a day after that point.
We don't want to screw anything up considering everything that has happened.
We've also been dealing a lot with our lawsuit against Dwolla.
See tradehillblog.com for more info on that or the other post in this forum.
-Jered
It is reassuring to see you posting here - is TradeHill customer service still working?
Thanks. Yes customer service is still working we're just swamped trying to get all the funds out and deal with a lot of individual requests.
When the banks simultaneously closed our accounts it created a huge backlog. We'll get to the emails as fast as we can. Almost everything has been processed at this point and is under control. We'll have the Linode situation sorted soon as well.
-Jered
This is 10 points for Tradehill. I hope you launch Bitcoin.com soon, I'm interested in that site. You've earned the trust of the community and we're excited for what's coming.
Good work, TradeHill. In the interest of protecting from future events like this, would you disclose what you did that made your accounts immune to this attack?
It is reassuring to see you posting here - is TradeHill customer service still working?
Thanks. Yes customer service is still working we're just swamped trying to get all the funds out and deal with a lot of individual requests.
When the banks simultaneously closed our accounts it created a huge backlog. We'll get to the emails as fast as we can. Almost everything has been processed at this point and is under control. We'll have the Linode situation sorted soon as well.
-Jered
It is reassuring to see you posting here - is TradeHill customer service still working?
It would seem the attacker used backdoor administration access that was not logged (and not publicized as being present) to reset shadow passwords and gain access. They were quite quick in withdrawing funds from slush mining pool, bitcoin faucet, and bitcoinica, but I wouldn't rule out any kind of compromise or future wallet emptying, as it seems that many think this came from inside Linode themselves using tools only their personnel would have access to on any reasonably administered system. It would be wise to go as far as considering your entire VPS file system cloned and logged into with root access, then think of what the intruder might do with the data.
I hesitate to speak too soon and we're going through it right now but it looks fine. The idea was that Linode could be compromised without compromising TradeHill and without compromising the servers where everything happens. We built the exchange to protect against things like this and the engineer that laid it out did fine job. I wasn't enjoying paying the extra data centers every month but I certainly don't regret the decision now.
Linode is done though, they were great to work with and we'll see what happens.
Jered
It would seem the attacker used backdoor administration access that was not logged (and not publicized as being present) to reset shadow passwords and gain access. They were quite quick in withdrawing funds from slush mining pool, bitcoin faucet, and bitcoinica, but I wouldn't rule out any kind of compromise or future wallet emptying, as it seems that many think this came from inside Linode themselves using tools only their personnel would have access to on any reasonably administered system. It would be wise to go as far as considering your entire VPS file system cloned and logged into with root access, then think of what the intruder might do with the data.
From tradehillblog.com
Dear Clients,
Yesterday, March 1st, one of our hosting providers was compromised. Linode.com contacted us several hours ago via email stating:
" As a valued customer, the security of your account is our top priority. Today we suffered from an unauthorized access of our system that resulted in eight customer accounts being compromised. Unfortunately, your account was one of the accounts targeted.
You should begin a compromised system recovery procedure immediately -- we recommend a complete redeployment -- on your Linodes. "
It appears that hackers were targeting accounts owned by Bitcoin businesses.
We built TradeHill with security as a priority and make use of multiple data centers to protect core infrastructure. Due to our system architecture design it appears that no user data was compromised, and all wallet files are safe, however we are in the process of a more thourough audit and will provide updates when more information is available.
We are taking TradeHill offline at this point as a precaution and appreciate your patience.
Updates can be found here and on twitter via @tradehill and @jeredkenna
Regards,
Jered Kenna
Chief Executive Officer
TradeHill
Dear Clients,
Yesterday, March 1st, one of our hosting providers was compromised. Linode.com contacted us several hours ago via email stating:
" As a valued customer, the security of your account is our top priority. Today we suffered from an unauthorized access of our system that resulted in eight customer accounts being compromised. Unfortunately, your account was one of the accounts targeted.
You should begin a compromised system recovery procedure immediately -- we recommend a complete redeployment -- on your Linodes. "
It appears that hackers were targeting accounts owned by Bitcoin businesses.
We built TradeHill with security as a priority and make use of multiple data centers to protect core infrastructure. Due to our system architecture design it appears that no user data was compromised, and all wallet files are safe, however we are in the process of a more thourough audit and will provide updates when more information is available.
We are taking TradeHill offline at this point as a precaution and appreciate your patience.
Updates can be found here and on twitter via @tradehill and @jeredkenna
Regards,
Jered Kenna
Chief Executive Officer
TradeHill
Jump to: