5 ms·

> We have reviewed our security processes and continue to work with our customers to make sure they take advantage of all of our security features. What an abs

by nwh 13y ago

> We have reviewed our security processes and continue to work with our customers to make sure they take advantage of all of our security features. What an absolute joke. They have an unauthenticated hacker direct access, and somehow it's the clients fault.

natdempk 13y ago
The best part was that they offered them a credit on their account as compensation. As if they would want to continue their business with a hosting company that allows unauthenticated users to issue commands to their technicians.
- mikeash 13y ago
  I wonder just how much time they'd get from $100,000 in hosting credit.
  - natdempk 13y ago
    > Grant said the credit was nowhere near sufficient to cover the company’s loss and as a result his firm is contemplating legal action. I doubt it was $100,000 in hosting credit. Probably a free year or two or something relatively meaningless.
    - mikeash 13y ago
      No doubt, but it's amusing to imagine.
- lhgaghl 13y ago
  This is Rogers you're talking about. The sell you a shitty expensive connection capped at 60GB, and then they hijack your DNS failures to resolve to their shitty ads page, and throttle your traffic depending on the protocol. If you drive down the street in my city you see wireless access points named "Rogers Sucks Ass".
potatolicious 13y ago
Not only that, they gave an unauthenticated employee direct access. So your attack vectors are: - Pretend to be the server owner (potentially difficult, though evidently not in this case). - Bribe/threaten any support rep, because apparently they have complete control of any customer's server without any form of verification. What insane customer support system would even let someone have a whiff of private data without verifying that the agent is representing the customer?
- lsc 13y ago
  >Not only that, they gave an unauthenticated employee direct access. Now, this is kind of an interesting thing. From what I've seen, lower end datacenters, for example, he.net, often have "free remote hands" - their techs are expected to access your servers. If you go higher end to coresite or equinix? the only people in the building are security. (and /maybe/ a power/hvac person) And while they can get into your stuff (the locks on the racks are a joke) they aren't expected to do so; a security person will get fired for jimmying with your stuff. As an aside, from what I've seen, he.net has pretty good access control; they check your ID, and then they take a picture of you, and the login system shows the person who is letting you in a picture of you from the last three times you entered. I don't know how strongly they authenticate remote hands requests. He.net also prevents "tailgating" more effectively than most of the other area datacenters. It's interesting, even within coresite, all the local coresite locations have a fingerprint reader + radio access card access control combo, but at 55 S. market? they don't even try to stop tailgaters, as long as one of you has a badge. at 2972 stender? they put some effort into it, though they aren't as effective as he.net. I think that he.net is more effective at preventing tailgaters precisely because the user doesn't get an access card. You have to ask one of the he.net security folks to open the door for you every time you leave the datacenter floor, which presents a reasonably non-confrontational way for them to verify everyone has been verified. At 2972 stender, they are very apologetic, but they do usually stop you. I have, however, seen people get through without verification during busy times. (the 'man-trap' system is imperfectly enforced, in part because it would clog the place up otherwise.) Of course, these comments are mostly about physical security, and the article was about getting unauthorized remote hands. I didn't use the remote hands much at all at he.net, so I don't know.

by nwh 13y ago

natdempk 13y ago

The best part was that they offered them a credit on their account as compensation. As if they would want to continue their business with a hosting company that allows unauthenticated users to issue commands to their technicians.

mikeash 13y ago
I wonder just how much time they'd get from $100,000 in hosting credit.
- natdempk 13y ago
  > Grant said the credit was nowhere near sufficient to cover the company’s loss and as a result his firm is contemplating legal action. I doubt it was $100,000 in hosting credit. Probably a free year or two or something relatively meaningless.
  - mikeash 13y ago
    No doubt, but it's amusing to imagine.
lhgaghl 13y ago
This is Rogers you're talking about. The sell you a shitty expensive connection capped at 60GB, and then they hijack your DNS failures to resolve to their shitty ads page, and throttle your traffic depending on the protocol. If you drive down the street in my city you see wireless access points named "Rogers Sucks Ass".

potatolicious 13y ago

Not only that, they gave an unauthenticated employee direct access. So your attack vectors are: - Pretend to be the server owner (potentially difficult, though evidently not in this case). - Bribe/threaten any support rep, because apparently they have complete control of any customer's server without any form of verification. What insane customer support system would even let someone have a whiff of private data without verifying that the agent is representing the customer?

lsc 13y ago
>Not only that, they gave an unauthenticated employee direct access. Now, this is kind of an interesting thing. From what I've seen, lower end datacenters, for example, he.net, often have "free remote hands" - their techs are expected to access your servers. If you go higher end to coresite or equinix? the only people in the building are security. (and /maybe/ a power/hvac person) And while they can get into your stuff (the locks on the racks are a joke) they aren't expected to do so; a security person will get fired for jimmying with your stuff. As an aside, from what I've seen, he.net has pretty good access control; they check your ID, and then they take a picture of you, and the login system shows the person who is letting you in a picture of you from the last three times you entered. I don't know how strongly they authenticate remote hands requests. He.net also prevents "tailgating" more effectively than most of the other area datacenters. It's interesting, even within coresite, all the local coresite locations have a fingerprint reader + radio access card access control combo, but at 55 S. market? they don't even try to stop tailgaters, as long as one of you has a badge. at 2972 stender? they put some effort into it, though they aren't as effective as he.net. I think that he.net is more effective at preventing tailgaters precisely because the user doesn't get an access card. You have to ask one of the he.net security folks to open the door for you every time you leave the datacenter floor, which presents a reasonably non-confrontational way for them to verify everyone has been verified. At 2972 stender, they are very apologetic, but they do usually stop you. I have, however, seen people get through without verification during busy times. (the 'man-trap' system is imperfectly enforced, in part because it would clog the place up otherwise.) Of course, these comments are mostly about physical security, and the article was about getting unauthorized remote hands. I didn't use the remote hands much at all at he.net, so I don't know.