3 ms·

>We are a small company and don't have any security experts, etc. Find one.

by ryanlol 10y ago

jrgifford 10y ago
Can't stress this enough. Find one. Stat.
Fuxy 10y ago
Or contact the person if you can and ask them how they got in maybe even offer him a financial reward. Since he contact you Anonymously and is not trying to extort you he's just trying to point the issue out so there's no point in over reacting.
- ryanlol 10y ago
  How much would you trust that person? Enough to potentially risk your business on them?
  - riprowan 10y ago
    You are already trusting that person enough to risk your business on them, if that server is still up and running after finding the security hole.
    - ryanlol 10y ago
      It's not just about that server though, who knows if the other servers were compromised?
  - Fuxy 10y ago
    It's not about trust it's about information gathering the goal is 2 fold 1. figure out the intentions of the individual 2. quickly finding and fixing the affected system To be clear it doesn't matter if the information is true or false because if it's true you can find evidence on the system to confirm it and if it's false it could still prove useful. You can nuke it from orbit later that could take hours or even days depending on how much stuff you have on it plus if the entry-point was trough the new app you just created nuking it won't fix the issue. The moment you put the app on the new server you opened yourself up to get hacked again. We all know a constantly updated system with nothing happening on it is incredibly hard to hack vs a system that has a lot of things happening on it the more things you're doing on a server the higher the attack surface plus it's a small company we're talking about here so they probably want to keep costs down by doing everything on as few servers as possible.
- PeterisP 10y ago
  Sure, getting information on the particular vulnerability and its fix is useful. However, doing anything less than clean reinstall of the tainted system and implementing the fix there would be underreacting. Verifying if that system was/wasn't backdoored takes ten (if not hundred) times more effort than nuking it from orbit and reconfiguring a new one.
CiPHPerCoder 10y ago
This isn't the most insightful or actionable comment, but it is the correct solution for both the short term problem and many long term problems.
- ryanlol 10y ago
  There's not much insightful advice to be given, chances are this guy could've easily traversed to every box on their network and set up a plethora of backdoors. Without a "security expert" there really is nothing they can do.
  - CiPHPerCoder 10y ago
    > There's not much insightful advice to be given Except some semblance of an idea of where to find a security expert. Even if it's a slight remix of "where to find ryanlol", that's plenty more insight and guidance. :) (It probably seems obvious to you, but most people don't know where to find one.)
barrystaes 10y ago
Well to be fair, one has found them. In parallel to doing damage control as mention before i would certainly contact the party and friendly invite them to share more information in exchange for a token of good faith (discount or a gadget). If you feel good about it, offer a job with reward to fix it. If unsure about how much a reward should be, keep in mind how expensive it could get without.. often a costly chain-reaction of disasters.
cjcampbell 10y ago
This can be a tricky proposition for small companies given the breadth of experience that is needed to adequately address this sort of scenario. The practical solution for most is to outsource, but it can be challenging to find affordable and high-quality service at a reasonable price. I'm getting ready to launch in this space. With few exceptions, the services I trust are focused on the glut of opportunities with deep pocketed clients. I can count on my fingers (and maybe toes) the number of colleagues and companies who are willing to pass that gold rush up to deal with the needs of the smaller clients in a meaningful way.

>We are a small company and don't have any security experts, etc. Find one.

by ryanlol 10y ago

>We are a small company and don't have any security experts, etc. Find one.

jrgifford 10y ago

Can't stress this enough. Find one. Stat.

Fuxy 10y ago

Or contact the person if you can and ask them how they got in maybe even offer him a financial reward. Since he contact you Anonymously and is not trying to extort you he's just trying to point the issue out so there's no point in over reacting.

ryanlol 10y ago
How much would you trust that person? Enough to potentially risk your business on them?
- riprowan 10y ago
  You are already trusting that person enough to risk your business on them, if that server is still up and running after finding the security hole.
  - ryanlol 10y ago
    It's not just about that server though, who knows if the other servers were compromised?
- Fuxy 10y ago
  It's not about trust it's about information gathering the goal is 2 fold 1. figure out the intentions of the individual 2. quickly finding and fixing the affected system To be clear it doesn't matter if the information is true or false because if it's true you can find evidence on the system to confirm it and if it's false it could still prove useful. You can nuke it from orbit later that could take hours or even days depending on how much stuff you have on it plus if the entry-point was trough the new app you just created nuking it won't fix the issue. The moment you put the app on the new server you opened yourself up to get hacked again. We all know a constantly updated system with nothing happening on it is incredibly hard to hack vs a system that has a lot of things happening on it the more things you're doing on a server the higher the attack surface plus it's a small company we're talking about here so they probably want to keep costs down by doing everything on as few servers as possible.
PeterisP 10y ago
Sure, getting information on the particular vulnerability and its fix is useful. However, doing anything less than clean reinstall of the tainted system and implementing the fix there would be underreacting. Verifying if that system was/wasn't backdoored takes ten (if not hundred) times more effort than nuking it from orbit and reconfiguring a new one.

CiPHPerCoder 10y ago

This isn't the most insightful or actionable comment, but it is the correct solution for both the short term problem and many long term problems.

ryanlol 10y ago
There's not much insightful advice to be given, chances are this guy could've easily traversed to every box on their network and set up a plethora of backdoors. Without a "security expert" there really is nothing they can do.
- CiPHPerCoder 10y ago
  > There's not much insightful advice to be given Except some semblance of an idea of where to find a security expert. Even if it's a slight remix of "where to find ryanlol", that's plenty more insight and guidance. :) (It probably seems obvious to you, but most people don't know where to find one.)

barrystaes 10y ago

Well to be fair, one has found them. In parallel to doing damage control as mention before i would certainly contact the party and friendly invite them to share more information in exchange for a token of good faith (discount or a gadget). If you feel good about it, offer a job with reward to fix it. If unsure about how much a reward should be, keep in mind how expensive it could get without.. often a costly chain-reaction of disasters.

cjcampbell 10y ago

This can be a tricky proposition for small companies given the breadth of experience that is needed to adequately address this sort of scenario. The practical solution for most is to outsource, but it can be challenging to find affordable and high-quality service at a reasonable price. I'm getting ready to launch in this space. With few exceptions, the services I trust are focused on the glut of opportunities with deep pocketed clients. I can count on my fingers (and maybe toes) the number of colleagues and companies who are willing to pass that gold rush up to deal with the needs of the smaller clients in a meaningful way.