3 ms·

Not only that, they gave an unauthenticated employee direct access. So your attack vectors are: - Pretend to be the server owner (potentially difficult, though

Not only that, they gave an unauthenticated employee direct access. So your attack vectors are: - Pretend to be the server owner (potentially difficult, though evidently not in this case). - Bribe/threaten any support rep, because apparently they have complete control of any customer's server without any form of verification. What insane customer support system would even let someone have a whiff of private data without verifying that the agent is representing the customer?

lsc 13y ago
>Not only that, they gave an unauthenticated employee direct access. Now, this is kind of an interesting thing. From what I've seen, lower end datacenters, for example, he.net, often have "free remote hands" - their techs are expected to access your servers. If you go higher end to coresite or equinix? the only people in the building are security. (and /maybe/ a power/hvac person) And while they can get into your stuff (the locks on the racks are a joke) they aren't expected to do so; a security person will get fired for jimmying with your stuff. As an aside, from what I've seen, he.net has pretty good access control; they check your ID, and then they take a picture of you, and the login system shows the person who is letting you in a picture of you from the last three times you entered. I don't know how strongly they authenticate remote hands requests. He.net also prevents "tailgating" more effectively than most of the other area datacenters. It's interesting, even within coresite, all the local coresite locations have a fingerprint reader + radio access card access control combo, but at 55 S. market? they don't even try to stop tailgaters, as long as one of you has a badge. at 2972 stender? they put some effort into it, though they aren't as effective as he.net. I think that he.net is more effective at preventing tailgaters precisely because the user doesn't get an access card. You have to ask one of the he.net security folks to open the door for you every time you leave the datacenter floor, which presents a reasonably non-confrontational way for them to verify everyone has been verified. At 2972 stender, they are very apologetic, but they do usually stop you. I have, however, seen people get through without verification during busy times. (the 'man-trap' system is imperfectly enforced, in part because it would clog the place up otherwise.) Of course, these comments are mostly about physical security, and the article was about getting unauthorized remote hands. I didn't use the remote hands much at all at he.net, so I don't know.

lsc 13y ago

>Not only that, they gave an unauthenticated employee direct access. Now, this is kind of an interesting thing. From what I've seen, lower end datacenters, for example, he.net, often have "free remote hands" - their techs are expected to access your servers. If you go higher end to coresite or equinix? the only people in the building are security. (and /maybe/ a power/hvac person) And while they can get into your stuff (the locks on the racks are a joke) they aren't expected to do so; a security person will get fired for jimmying with your stuff. As an aside, from what I've seen, he.net has pretty good access control; they check your ID, and then they take a picture of you, and the login system shows the person who is letting you in a picture of you from the last three times you entered. I don't know how strongly they authenticate remote hands requests. He.net also prevents "tailgating" more effectively than most of the other area datacenters. It's interesting, even within coresite, all the local coresite locations have a fingerprint reader + radio access card access control combo, but at 55 S. market? they don't even try to stop tailgaters, as long as one of you has a badge. at 2972 stender? they put some effort into it, though they aren't as effective as he.net. I think that he.net is more effective at preventing tailgaters precisely because the user doesn't get an access card. You have to ask one of the he.net security folks to open the door for you every time you leave the datacenter floor, which presents a reasonably non-confrontational way for them to verify everyone has been verified. At 2972 stender, they are very apologetic, but they do usually stop you. I have, however, seen people get through without verification during busy times. (the 'man-trap' system is imperfectly enforced, in part because it would clog the place up otherwise.) Of course, these comments are mostly about physical security, and the article was about getting unauthorized remote hands. I didn't use the remote hands much at all at he.net, so I don't know.