5 ms·

That's pretty crazy, though with the hack publicly disclosed, it was bound to be exploited. What I don't understand is why this report incident comes so late. T

by conradk 12y ago

That's pretty crazy, though with the hack publicly disclosed, it was bound to be exploited. What I don't understand is why this report incident comes so late. The hack has been public for a large amount of time. Could anyone explain?

custardcream 12y ago
Probably because they are a virtual and colo hoster so aren't generally responsible for the security of the machines they host. Also, a big chunk of people who buy these machines are less responsible than they should be. At best this is monitoring and playing whack-a-mole on their part which they've done a pretty good job of by the looks.
- seszett 12y ago
  The involved machines are dedicated servers, according to the posts. Also, although I have many things to blame OVH for, they at least take a somewhat proactive stance regarding security, even for the very cheap dedicated servers. They usually contact you when they notice a traffic spike on unusual ports for example. But yeah... judging by the people I know in real life who own cheap OVH dedicated servers, I'm not surprised at all by these news.
- nraynaud 12y ago
  that's why I find crazy all those people wanting to have a dedicated server, I don't want to spend my life on call 24/7. I'm pretty sure 90% of the customers are not professionally trained in server maintenance. I am, and I don't want to do it anyways unless I have a good reason to do it.
  - atmosx 12y ago
    I use a VPS for email (configured opensmtpd + IMAP over SSL), VPN server, HTTP Proxy and host 3-4 personal applications (nginx + mysql + ruby apps). The hard part was to set-up all these services, keeping them up-to-date, since no other party depends on them it is considerably easy and almost risk-free. Other than that is not time-consuming at all. Only 2 times in 3 years I had to re-configure a service. Most of the times I just run an upgrade-script on a tmux session and everything runs smoothly (I rarely use pre-compiled packages). Now, if I had a production-level web application, I would probably set-up as carefully as I could a new VPS and roll my application there, up to the point where I needed to scale. If it would be a one-man-show I'd probably go with Heroku (since I write sinatra/ruby/rails applications) or similar (possible cheaper) service to avoid spending time on sys-admin. But these service IMHO are still, expensive for projects with no income while a VPS can do all that and mode at once at a considerably lower price. ps. As a side note. Before I join HN, I though that all programmers were capable of sys-admin (UNIX servers). Then I realized that tasks that seem trivial to me, are considered somewhat difficult for others and vice-versa of course.
  - custardcream 12y ago
    Agree entirely. That's why I go half-way and use Windows Azure's PaaS platform. Much less painful. The company I currently work for have to full racks in two data centres each, most of which is near idle and it's a full time job for 2 people. Could do away with all the machines and all the associated administrative staff, just use a devops team and shave 40% of capex and opex as well by moving to something else. But then again, they might not be getting nice lunches with HP and the DC vendor.
    - devonkim 12y ago
      Depending upon how much they're spending, I kind of doubt HP would really pay a whole lot for trying to woo that customer. The usual method is to just cut pricing if someone gets antsy in TSG and over on the Procurve / networking side. This is a company that nickel and dimed people on trips to force them to exclude alcohol from reimbursement and had probably the lowest per diem I've ever had while traveling.
      - custardcream 12y ago
        Well the DC vendor "prefers HP" and they have a couple of thousand racks so not so sure...
  - erkkie 12y ago
    Because you're trained you realize the actual costs, most people don't factor in maintenance as cost and see VPS's being as no-brainer cheap to get stuff running on.
  - hbogert 12y ago
    Yep, but the company wanted to have everything in-house, because that's safer right? /sarcasm
  - vini 12y ago
    I bet 90% of those servers were torrent seedboxes and that means, the owners don't have a clue about server management.
    - aragot 12y ago
      Sorry for my ignorance, but why would someone take the risk of hosting a torrent seedbox?
      - spindritf 12y ago
        To easily maintain ratio (of uploaded to downloaded amounts of data) on a private torrent tracker. Due to restricted access (members only), it's pretty safe. If you're asking about the hosting company, they largely don't care what you do unless someone complains.
        aragot 12y ago
        Would you think most of torrents are private? So you need to be introduced to be part of them? So if you're introduced, a police investigator could be introduced too, right?
deleted 12y ago
[deleted]
atmosx 12y ago
I manage 2 VPSs. I'm responsible for security patches and everything. If shit hits the fan, it's because of me not because of my VPS provider :-) That's what VPS is all about.
- deleted 12y ago
  [deleted]
- pavs 12y ago
  I have some vps with digitalocean, I haven't logged in to them in a long time, even after shellshock surfaced publicly. about aftter a month later I checked to see if I am vulnerable through shellshocker.net test and it was negative. I am guessing my provider did something to fix it.
  - viraptor 12y ago
    > ... vps with digitalocean ... I am guessing my provider did something to fix it. I don't think DO offers any managed service. They wouldn't do anything to fix your servers. It's entirely on you to keep them updated. Edit: https://www.digitalocean.com/help/policy/ https://www.digitalocean.com/help/policy/ <- they really don't offer it
    - pavs 12y ago
      I know they dont, I didn't say they do. But my non up-to-date Ubuntu server wasn't vulnerable when I checked about a month after shellshock vulnerable went public.
      - tokenizerrr 12y ago
        Have you considered you may be using a software stack that is not (obviously) vulnerable? Not every software is vulnerable by default on all URLs, just the ones that wind up calling out to bash in a specific way.
        12y ago
Wilya 12y ago
The linked issue isn't "we need to patch Shellshock". It's "we have 800 hacked machines on the network, they are DDoSing like crazy, and it's saturating the internal network". Their problem isn't that servers have been hacked. It's that it's overloading the network. OVH isn't responsible for what people do with the servers. They provide the initial installation, networking, hardware monitoring and some management tools, but that's it. If they detect that a server is sending too much traffic, they can guess that it has been hacked, so what they usually do is disable it and notify the owner to fix it. But they don't do more, that's not their business. If you want a host that does more for you, it's managed hosting you want, not a dedicated server provider.
- aroch 12y ago
  They actually tout their anti-hacking and anti-DDOS services when you sign up...
  - funkyy 12y ago
    Its on network/hardware level. The issues with internal DDOS is that they are software related. OVH cannot access your server (or it shouldn't) so the only choice they have is to shut the server and wait till you will fix it. But if you receive DDOS attack to your server from outside, they can defend you using network resources.
  - Wilya 12y ago
    Their anti-DDOS system is mostly designed to protect against external attacks. It works at the network level, probably at the connection between their network and the outside world. Because that's the most efficient way: detect them and block them where you have the most bandwidth available. This is an internal attack, which requires different mitigation measures, and is seen less often in the wild (compromising 500 servers from a specific provider is more difficult than 500 random servers on the internet, and you're pretty much guaranteed that the provider will deactivate most of them after the first attack), so I guess their protection systems aren't as developped against it.
  - dwild 12y ago

by conradk 12y ago

custardcream 12y ago

Probably because they are a virtual and colo hoster so aren't generally responsible for the security of the machines they host. Also, a big chunk of people who buy these machines are less responsible than they should be. At best this is monitoring and playing whack-a-mole on their part which they've done a pretty good job of by the looks.

seszett 12y ago
The involved machines are dedicated servers, according to the posts. Also, although I have many things to blame OVH for, they at least take a somewhat proactive stance regarding security, even for the very cheap dedicated servers. They usually contact you when they notice a traffic spike on unusual ports for example. But yeah... judging by the people I know in real life who own cheap OVH dedicated servers, I'm not surprised at all by these news.
nraynaud 12y ago
that's why I find crazy all those people wanting to have a dedicated server, I don't want to spend my life on call 24/7. I'm pretty sure 90% of the customers are not professionally trained in server maintenance. I am, and I don't want to do it anyways unless I have a good reason to do it.
- atmosx 12y ago
  I use a VPS for email (configured opensmtpd + IMAP over SSL), VPN server, HTTP Proxy and host 3-4 personal applications (nginx + mysql + ruby apps). The hard part was to set-up all these services, keeping them up-to-date, since no other party depends on them it is considerably easy and almost risk-free. Other than that is not time-consuming at all. Only 2 times in 3 years I had to re-configure a service. Most of the times I just run an upgrade-script on a tmux session and everything runs smoothly (I rarely use pre-compiled packages). Now, if I had a production-level web application, I would probably set-up as carefully as I could a new VPS and roll my application there, up to the point where I needed to scale. If it would be a one-man-show I'd probably go with Heroku (since I write sinatra/ruby/rails applications) or similar (possible cheaper) service to avoid spending time on sys-admin. But these service IMHO are still, expensive for projects with no income while a VPS can do all that and mode at once at a considerably lower price. ps. As a side note. Before I join HN, I though that all programmers were capable of sys-admin (UNIX servers). Then I realized that tasks that seem trivial to me, are considered somewhat difficult for others and vice-versa of course.
- custardcream 12y ago
  Agree entirely. That's why I go half-way and use Windows Azure's PaaS platform. Much less painful. The company I currently work for have to full racks in two data centres each, most of which is near idle and it's a full time job for 2 people. Could do away with all the machines and all the associated administrative staff, just use a devops team and shave 40% of capex and opex as well by moving to something else. But then again, they might not be getting nice lunches with HP and the DC vendor.
  - devonkim 12y ago
    Depending upon how much they're spending, I kind of doubt HP would really pay a whole lot for trying to woo that customer. The usual method is to just cut pricing if someone gets antsy in TSG and over on the Procurve / networking side. This is a company that nickel and dimed people on trips to force them to exclude alcohol from reimbursement and had probably the lowest per diem I've ever had while traveling.
    - custardcream 12y ago
      Well the DC vendor "prefers HP" and they have a couple of thousand racks so not so sure...
- erkkie 12y ago
  Because you're trained you realize the actual costs, most people don't factor in maintenance as cost and see VPS's being as no-brainer cheap to get stuff running on.
- hbogert 12y ago
  Yep, but the company wanted to have everything in-house, because that's safer right? /sarcasm
- vini 12y ago
  I bet 90% of those servers were torrent seedboxes and that means, the owners don't have a clue about server management.
  - aragot 12y ago
    Sorry for my ignorance, but why would someone take the risk of hosting a torrent seedbox?
    - spindritf 12y ago
      To easily maintain ratio (of uploaded to downloaded amounts of data) on a private torrent tracker. Due to restricted access (members only), it's pretty safe. If you're asking about the hosting company, they largely don't care what you do unless someone complains.
      - aragot 12y ago
        Would you think most of torrents are private? So you need to be introduced to be part of them? So if you're introduced, a police investigator could be introduced too, right?

deleted 12y ago

[deleted]

atmosx 12y ago

I manage 2 VPSs. I'm responsible for security patches and everything. If shit hits the fan, it's because of me not because of my VPS provider :-) That's what VPS is all about.

deleted 12y ago
[deleted]
pavs 12y ago
I have some vps with digitalocean, I haven't logged in to them in a long time, even after shellshock surfaced publicly. about aftter a month later I checked to see if I am vulnerable through shellshocker.net test and it was negative. I am guessing my provider did something to fix it.
- viraptor 12y ago
  > ... vps with digitalocean ... I am guessing my provider did something to fix it. I don't think DO offers any managed service. They wouldn't do anything to fix your servers. It's entirely on you to keep them updated. Edit: https://www.digitalocean.com/help/policy/ https://www.digitalocean.com/help/policy/ <- they really don't offer it
  - pavs 12y ago
    I know they dont, I didn't say they do. But my non up-to-date Ubuntu server wasn't vulnerable when I checked about a month after shellshock vulnerable went public.
    - tokenizerrr 12y ago
      Have you considered you may be using a software stack that is not (obviously) vulnerable? Not every software is vulnerable by default on all URLs, just the ones that wind up calling out to bash in a specific way.
      - 12y ago

Wilya 12y ago

The linked issue isn't "we need to patch Shellshock". It's "we have 800 hacked machines on the network, they are DDoSing like crazy, and it's saturating the internal network". Their problem isn't that servers have been hacked. It's that it's overloading the network. OVH isn't responsible for what people do with the servers. They provide the initial installation, networking, hardware monitoring and some management tools, but that's it. If they detect that a server is sending too much traffic, they can guess that it has been hacked, so what they usually do is disable it and notify the owner to fix it. But they don't do more, that's not their business. If you want a host that does more for you, it's managed hosting you want, not a dedicated server provider.

aroch 12y ago
They actually tout their anti-hacking and anti-DDOS services when you sign up...
- funkyy 12y ago
  Its on network/hardware level. The issues with internal DDOS is that they are software related. OVH cannot access your server (or it shouldn't) so the only choice they have is to shut the server and wait till you will fix it. But if you receive DDOS attack to your server from outside, they can defend you using network resources.
- Wilya 12y ago
  Their anti-DDOS system is mostly designed to protect against external attacks. It works at the network level, probably at the connection between their network and the outside world. Because that's the most efficient way: detect them and block them where you have the most bandwidth available. This is an internal attack, which requires different mitigation measures, and is seen less often in the wild (compromising 500 servers from a specific provider is more difficult than 500 random servers on the internet, and you're pretty much guaranteed that the provider will deactivate most of them after the first attack), so I guess their protection systems aren't as developped against it.
- dwild 12y ago