GPF News Archive

In the interest of full disclosure, I wanted to make our readers aware that there recently was a security incident at our current Web host, Linode. As of this writing, all that I know about the incident comes from two blog posts on the Linode site, dated April 12th and 16th. The bottom line is that the entire GPF site is currently unaffected and no user data has been at risk of compromise. That said, my data with respect to my relationship with the host could be at risk, although none of that will affect any of you.

Here's a more complete breakdown of the facts for those who are interested in details:

• The compromise occurred within Linode's customer management console. Portions of their back-end code and customer database were copied and may have been exposed. While critical data such as credit card numbers were encrypted with public-key cryptography, both the public and private keys were also stored on the same machine and were copied as well. As far as anyone knows, the password on the private key has not been compromised, but that may just be a matter of time. (Brute-force password cracking, even with a very strong password, can be cut short through parallelizaiton.) Other important pieces of data like an API key and an emergency backup console password may have been stored unencrypted, but I've made sure to ensure those keys have been refreshed.
• The actual virtual host under which the GPF site runs has NOT been compromised. None of our server files or data have been touched or, as far as I can tell, were really ever at risk from the initial attack. That said, there is a risk of a potential compromise in that the emergency backup console mentioned above may have a flaw that could permit breaking out of a virtual host and accessing the master server under which the virtual hosts run. If the master server can be compromised, all virtual hosts running under it may be at risk. While I've changed my emergency backup console password and double-checked that my account within their management system is locked down tight (as it always has been), there is a remote possibility that another account hosted on the same physical box could be less prepared than we are. Without knowing how many virtual hosts are running on the same physical box we're on, there's no way to estimate the size of that risk.
• GPF does NOT store any personally identifiable information about our users. This includes Premium accounts, the Forum, and the Wiki. The only information we store about our users are usernames, e-mail addresses, passwords, and application preferences. We NEVER store PayPal or credit card data; all financial transactions on our site are transient and this information is NEVER stored and ALWAYS strongly encrypted in transit, then digitally shredded after transactions are complete. Premium passwords are salted and cryptographically hashed so they can't be reversed. While I don't know the exact details on how forum and wiki passwords are stored, both phpBB and MediaWiki do encrypt their passwords and both are well-vetted Open Source platforms that get a lot of scrutiny by security experts.
• Although GPF's data has not been affected, I would still like to remind everyone that you should be following good security habits whenever you use any online service, including ours. You should use distinct passwords for every site and service you are registered with. Again, while none of our data has been affected, you may want to consider changing your Premium and/or forum passwords if you feel it is necessary. If you reuse those passwords on other sites, I strongly recommend you change all of them to something new and distinct for each service. (There are lots of password management tools that can make such a task easier if you do some diligent Web searching. Here is the one I use, which coincidentally I also wrote.)
• Since it appears that I'm the only one related to GPF at any potential financial risk, I'm happy to report that (for now, at least) I haven't seen any suspicious activity related to the breach. That said, I will probably end up canceling the credit card on file with Linode as an extra precaution. Although I do use distinct passwords everywhere, you better believe I changed all of them related to Linode, as well as the API keys and such mentioned above.

A big thanks to every one of you who support GPF, from those who occasionally stop by to catch up on the archives, to our loyalest of subscribers who always leave a tab open to the site.