10 ms·
A customer stuck due to a hurricane who needed SSH
- Multiplayer 3y agoI wonder how long until customer support AI will solve these issues or is this an edge case that will require intervention?
- arwineap 3y agoGiving a customer service ai the ability to configure firewall rules seems problematic Maybe eventually they will be less suspectable to social engineering but I don't have that confidence yet Is it still social engineering if you're talking to an AI?
- powersnail 3y agoPrompt injection is basically the AI version of social engineering, isn't it?
- flangola7 3y agoSocial engineering has limits and each individual has unique vulnerabilities. It's not possible to call in and speak a single sentence compelling any agent who hears it to immediately burn the office building down.
- powersnail 3y agoSome human vulnerabilities are surprisingly common. A lot of scammers follow scripts and formula. Of course, to coax arson would be difficult. But life-devastating incidents like emptying out the entire bank account, leaking secrets, causing self-harm, etc. are not unheard of.
- supertrope 3y agoSome support phone numbers automatically offer to waive a late fee if your account is generally in good standing.
- m463 3y agosort of like stackoverflow with a "run this solution"
- tedunangst 3y agoGood reason to have backup connection means, like ssh in https. (Or at the time of the article, since it's possible even https was blocked, ssh over dns.)
- junon 3y agoAt Uber someone (reportedly) got TCP or UDP (can't remember which) over SMS. Always intrigued me.
- askiiart 3y agoI haven't heard of that, but here's IP over WhatsApp. Rather convenient for flights that only have WhatsApp free. https://github.com/aleixrodriala/wa-tunnel https://github.com/aleixrodriala/wa-tunnel
- ars 3y agoI hate public WiFi that blocks arbitrary ports. The internet is not HTTP!!
- pixl97 3y agoAt the same time free public Wifi is just that, a "we do what we can and try to keep the infra safe at low cost". There is a lot of tooling to filter out bad behavior by HTTP. When it comes to other protocols, not so much. Much easier to block other ports then end up with your IP range on a block list.
- bombcar 3y agoWhat I'd like to see, is public Wifi setup with something akin to "HTTP/HTTPS - wide open" and "all other ports, you can connect to 1-5 machines an hour" or something. Blocks useful access for worms, Trojans, etc but still lets you get out once.
- taway1237 3y agoTrojans only need to connect to one server (c&c) and they usually use http(s). Worms are almost nonexistent nowadays. Spambots are a concern (some of which could be consider a worm if you squint hard enough), but they only need to connect to two servers (configured SMTP server and C&C).
- m463 3y agoI think ports < 1024 is not so arbitrary.
- marcod 3y agoDon't you know that ssh is only used by hackers?!?!!!1
- em-bee 3y agoi use mosh. it uses high ports that shouldn't be blocked. usually it is already running when i open the laptop. saves a lot of time. as an added benefit, it sometimes even works when the actual wifi connection is not yet authorized at the portal because that often only blocks tcp and not udp.
- jmholla 3y agoNot being too familiar with `iptables` myself, I'd love to see the magic invocation they used. Anyone have any idea what that would have looked like?
- dijit 3y agofwiw, in the “Port” directive in sshd_config you can just add another port number declaration and SSHd will listen on both ports. Port 22 Port 80 Much cleaner than iptables magic; though I have done similar iptables redirects before it is almost always a bad idea. :)
- sleepybrett 3y agoPossible that this was a feature added after this event?
- dijit 3y agopossible, but I see recommendations along these lines going back to 2011 https://serverfault.com/questions/284566/configuration-for-multiple-port-ssh https://serverfault.com/questions/284566/configuration-for-m...
- jrockway 3y agoI feel like the blink tag part of the story dates it to before 2011. (I just tested to see if blink tags still worked. It did not.)
- fiddlerwoaroof 3y agoUnless it’s anonymized, Hurricane Jeanne dates it to 2004
- pwdisswordfishc 3y agoWhy would a hurricane need SSH?
- saagarjha 3y agoWhy would a hurricane need electric?
- wiml 3y agoWhy would a hurricane want to rock me?
- TheGoddessInari 3y agoIPv6 migration.
- yazzku 3y agoThe hurricane needed SSH so that it could troubleshoot the customer's problem and get them unstuck.
- bsza 3y agoProbably for cloud migration. … I’ll see myself out.
- doublerabbit 3y agoBrings a whole new meaning to TCP. Tornado Cloud Protocol.
- aio2 3y agoPart of a series on DNS, Do Natural Survival
- JoshTriplett 3y agoI prefer the Unending Deluge Protocol.
- what-no-tests 3y agoCommas, so important, are so very, infrequently, and - unnecessarily - sparingly used.
- ndesaulniers 3y ago> Whether they were trying to be KIBO or B1FF, I may never know. Can someone explain this reference to me, I didn't get it?
- BoxFour 3y agohttps://en.m.wikipedia.org/wiki/BIFF_(Usenet) https://en.m.wikipedia.org/wiki/BIFF_(Usenet) https://en.m.wikipedia.org/wiki/James_Parry https://en.m.wikipedia.org/wiki/James_Parry
- infruset 3y agoI had the exact same question, and I'm happy to share how I got an immediate, complete and clear answer: https://chat.openai.com/share/8813ec1b-f64d-4dad-9b80-a8d3a2d128c7 https://chat.openai.com/share/8813ec1b-f64d-4dad-9b80-a8d3a2...
- AnotherGoodName 3y agosocat is better for this. It plumbs any connection to any connection. Listen on port 8080 and route to some local 22? socat TCP-LISTEN:8080,fork,reuseaddr TCP:[somelocalip]:22 This lets you be very explicit in watching this run and killing when done. Socat also lets you route networks through old serial ports, log all data going over a connection to a file, and even join completely different protocols. Fun past projects based on socat; a serial port->socat to tcp out->socat on another computer to listen->a serial port out. Basically this created a serial port that worked over a satellite for a customer doing some remote monitoring so they could set an alarm if something failed (a lot of equipment only has serial connectivity for status).
- em-bee 3y agobut socat is a process that needs to run, so someone needs to configure it to start at boot. that's what the iptables solution avoids.
- AnotherGoodName 3y agoYeah the quick and dirty socat way can be an advantage or disadvantage. I like it for the times i just need to quickly get something through as a once off exactly because it runs when i run it. I feel like hacking some port mapping up during a disaster as more of a socat thing than an iptables thing but hey if it works it works.
- jasonjayr 3y agoSocat would make the connections to ssh show up from the machine running socat, rather than the origin, which might have auditing/logging implications. iptables with a dnat redirect addresses that.
- deleted 3y ago[deleted]
- kazinator 3y agoPeople who run Wi-Fi hotspots that firewall port 22 should be tied to rocks and tossed in a river.
- dheera 3y agoAlso Wi-Fi hotspots that hijack DNS.
- anonu 3y agoeven today, while traveling through the US, there are lots of wifi access points that won't allow you to ssh. Sometimes I just fire up my VPN and then I can ssh again.
- s1291 3y agoWeb based ssh could have solved that issue, e.g. [0]. [0]: https://shellngn.com/ https://shellngn.com/
- guerby 3y agocockpit does offer lots of admin including a web shell (port 9090 by default) meshcentral has a web shell too.
- sys42590 3y agoIf you can sneak a <blink> tag into the ticket system, you likely can sneak a in <script> or <iframe> tag as well... I'm sure input sanitization was already a thing preached back then but ignored by many web developers...
- nopurpose 3y agoI miss good and responsive support. I mostly deal with Google GCP and it's soul draining. They always take close to 24 hours to reply to any of your comment, even if you immediately reply you won't hear from them until next day. They cherry pick one line to answer and their replies often contradict rest of the facts presented in the issue report. They shield product engineers from you, acting as intermediary, so now there are two 24 hour hops each way. When product engineer also give nonsense answer, support doesn't enter into discussion with them on your behalf to get something reasonable, no they just pass it along. For the price they charge for support I'd expect more quality.
- nvarsj 3y agoThere is very little incentive for engineers to spend a lot of time on support at big tech. In fact it detracts time from their projects which tie to their performance review. Internally big tech would need to prioritise customer satisfaction as some OKR to incentivise engineers - but this doesn’t happen for some reason. As a result you’re at the whim of whether the engineer cares enough to spend time on your case. Note in my experience AWS has great support - so their internal incentives seem to be aligned with customers.
- Amezarak 3y agoI see comments like this on HN frequently and I wonder what is going on with BigTech. I guess I wouldn't make it. Support is fun. You're solving mysteries and (hopefully) fixing them within the constraints of the design.
- InitialLastName 3y agoLevel 2 support is fun. Level 1 support is "dealing with an onslaught of people whose days have gone wrong, and they're sure it's your fault".
- nvarsj 3y agoIt's the performance culture at these companies. An engineer gets evaluated on metrics they move the needle on. At very OKR centric companies like Google, these metrics have to tie into high level business goals like revenue growth. I imagine it is pretty difficult to match customer support metrics to these, hence it's not prioritised by engineers or the company.
- thanatos519 3y agoI expose sshd on :443 for use in airports and hotels and other places with awful firewalls. Worked great until the hotel where such connections also had a maximum duration!
- Piskvorrr 3y agoStill works great, what with `autossh somehost.example.com -p443 -t -- screen -xR` or somesuch.
- supriyo-biswas 3y agoAdd ServerAliveInterval and ServerAliveCountMax to your SSH client.
- sambazi 3y agothis works great for the lowend of security solutions. at bigger chains, there is some dpi security solution involved which will easily spot the difference between https and ssh.
- throwawaymobule 3y agoI've exposed SSH over tor in the past, so I can at least get into the box to set up a workaround like this if needed. (usually ddns/DMZ setup being broken) Never had many login attempts that weren't me through it, but had fail2ban installed just in case.
- hexo 3y agoPoor hurricane needing ssh
- throw7 3y agoThe ability to just switch -I to -D to delete the rule is something I miss in nftables. I used that all the time.