3 ms·

Ah - sorry! I hope Slicehost was simply going through their own process; notifying the customer and helping them to resolve the issue: the server may have been

Ah - sorry! I hope Slicehost was simply going through their own process; notifying the customer and helping them to resolve the issue: the server may have been running a business that is multiple peoples' livelihoods. Those processes take time, and they have to balance the damage you're doing to the 'target' victim vs the damage to the 'compromised host' victim. Given that shutting down the compromised host wouldn't save the target anyway, I would also have prioritized my own customer.

ErrantX 17y ago
Security 101 we teach clients: if you have a compromised server take it down. It's too risky to do anything else really. If it was running a clients services they are compromised too and if that is the case, and Slicehost leaves it compromised, that is a serious liability problem. There is a reasonably high likelihood it was a slice set up specifically to launch attacks (though the blog post does say compromised, so perhaps they have more info on the slice in question than has been made public so far). In which case leaving it running is, again, unnecessary liability. I think tptacek and I are just surprised this didn't concern Slicehost as much as it, probably, should :)
- justinsb 17y ago
  But what if I phone up your hosting provider and tell them that your webserver is attacking my site? Should they shut it down immediately before notifying you? How long should they wait for a reply from you? How many checks should they do? We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. Should the hosting company have circumvented your access controls and looked into your VM? My understanding is that Slicehost is responsible for the VM 'hardware', and you're responsible for what goes on inside it. There are exceptions for illegal behaviour, but I'm sure those involve checks and balances and processes, probably for legal reasons as well as for simple reasons of fairness.
  - ErrantX 17y ago
    As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. It's trivial enough to spot if you review the logs and the information available. Anyone with an ounce of security knowledge would spot it very quickly. Should the hosting company have circumvented your access controls and looked into your VM? They do this anyway; as root on the dedicated machine they have access to your VM anyway :) There are exceptions for illegal behaviour This is illegal behaviour isn't it :)

ErrantX 17y ago

Security 101 we teach clients: if you have a compromised server take it down. It's too risky to do anything else really. If it was running a clients services they are compromised too and if that is the case, and Slicehost leaves it compromised, that is a serious liability problem. There is a reasonably high likelihood it was a slice set up specifically to launch attacks (though the blog post does say compromised, so perhaps they have more info on the slice in question than has been made public so far). In which case leaving it running is, again, unnecessary liability. I think tptacek and I are just surprised this didn't concern Slicehost as much as it, probably, should :)

justinsb 17y ago
But what if I phone up your hosting provider and tell them that your webserver is attacking my site? Should they shut it down immediately before notifying you? How long should they wait for a reply from you? How many checks should they do? We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. Should the hosting company have circumvented your access controls and looked into your VM? My understanding is that Slicehost is responsible for the VM 'hardware', and you're responsible for what goes on inside it. There are exceptions for illegal behaviour, but I'm sure those involve checks and balances and processes, probably for legal reasons as well as for simple reasons of fairness.
- ErrantX 17y ago
  As I suggested I doubt they sent them a quick mail :) I would have hoped they provided detail and logs to show what happened. We're not talking about instantly recognizable traffic here; this was likely HTTPS traffic. It's trivial enough to spot if you review the logs and the information available. Anyone with an ounce of security knowledge would spot it very quickly. Should the hosting company have circumvented your access controls and looked into your VM? They do this anyway; as root on the dedicated machine they have access to your VM anyway :) There are exceptions for illegal behaviour This is illegal behaviour isn't it :)