2 ms·

There are hosting providers who openly advertise servers for sending spam illegally. The idea that you can achieve security by shutting down your attackers is

There are hosting providers who openly advertise servers for sending spam illegally. The idea that you can achieve security by shutting down your attackers is ridiculous. Had slicehost acted more rapidly, Atlassian would have been hacked by the same hackers using a different server. Obviously Atlassian knows this also, because they didn't even bother putting an IP blocking rule into their firewalls. If Atlassian didn't even think that worthwhile, pointing the finger at Slicehost is dubious.

ErrantX 17y ago
Just to be clear that's not the point I was making.
- justinsb 17y ago
  Ah - sorry! I hope Slicehost was simply going through their own process; notifying the customer and helping them to resolve the issue: the server may have been running a business that is multiple peoples' livelihoods. Those processes take time, and they have to balance the damage you're doing to the 'target' victim vs the damage to the 'compromised host' victim. Given that shutting down the compromised host wouldn't save the target anyway, I would also have prioritized my own customer.
  - ErrantX 17y ago
    Security 101 we teach clients: if you have a compromised server take it down. It's too risky to do anything else really. If it was running a clients services they are compromised too and if that is the case, and Slicehost leaves it compromised, that is a serious liability problem. There is a reasonably high likelihood it was a slice set up specifically to launch attacks (though the blog post does say compromised, so perhaps they have more info on the slice in question than has been made public so far). In which case leaving it running is, again, unnecessary liability. I think tptacek and I are just surprised this didn't concern Slicehost as much as it, probably, should :)
    - justinsb 17y ago
      But what if I phone up your hosting provider and tell them that your webserver is attacking my site? Should they shut it down immediately before notifying you? How long should they wait for a reply from you? How many checks should they do? We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. Should the hosting company have circumvented your access controls and looked into your VM? My understanding is that Slicehost is responsible for the VM 'hardware', and you're responsible for what goes on inside it. There are exceptions for illegal behaviour, but I'm sure those involve checks and balances and processes, probably for legal reasons as well as for simple reasons of fairness.
      - ErrantX 17y ago
        As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. It's trivial enough to spot if you review the logs and the information available. Anyone with an ounce of security knowledge would spot it very quickly. Should the hosting company have circumvented your access controls and looked into your VM? They do this anyway; as root on the dedicated machine they have access to your VM anyway :) There are exceptions for illegal behaviour This is illegal behaviour isn't it :)
tptacek 17y ago
Breaking into someone else's machine is not an illegality on par with facilitating spam. It's crazy to me how inured we've all become to breakins. Breakins are a big deal.

ErrantX 17y ago

Just to be clear that's not the point I was making.

justinsb 17y ago
Ah - sorry! I hope Slicehost was simply going through their own process; notifying the customer and helping them to resolve the issue: the server may have been running a business that is multiple peoples' livelihoods. Those processes take time, and they have to balance the damage you're doing to the 'target' victim vs the damage to the 'compromised host' victim. Given that shutting down the compromised host wouldn't save the target anyway, I would also have prioritized my own customer.
- ErrantX 17y ago
  Security 101 we teach clients: if you have a compromised server take it down. It's too risky to do anything else really. If it was running a clients services they are compromised too and if that is the case, and Slicehost leaves it compromised, that is a serious liability problem. There is a reasonably high likelihood it was a slice set up specifically to launch attacks (though the blog post does say compromised, so perhaps they have more info on the slice in question than has been made public so far). In which case leaving it running is, again, unnecessary liability. I think tptacek and I are just surprised this didn't concern Slicehost as much as it, probably, should :)
  - justinsb 17y ago
    But what if I phone up your hosting provider and tell them that your webserver is attacking my site? Should they shut it down immediately before notifying you? How long should they wait for a reply from you? How many checks should they do? We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. Should the hosting company have circumvented your access controls and looked into your VM? My understanding is that Slicehost is responsible for the VM 'hardware', and you're responsible for what goes on inside it. There are exceptions for illegal behaviour, but I'm sure those involve checks and balances and processes, probably for legal reasons as well as for simple reasons of fairness.
    - ErrantX 17y ago
      As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. It's trivial enough to spot if you review the logs and the information available. Anyone with an ounce of security knowledge would spot it very quickly. Should the hosting company have circumvented your access controls and looked into your VM? They do this anyway; as root on the dedicated machine they have access to your VM anyway :) There are exceptions for illegal behaviour This is illegal behaviour isn't it :)

tptacek 17y ago

Breaking into someone else's machine is not an illegality on par with facilitating spam. It's crazy to me how inured we've all become to breakins. Breakins are a big deal.