Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Flaw Hits VAserv; Head of LxLabs Found Hanged

Posted by timothy on from the jerks-with-computers-elaborately-shrug dept.

Keldrin_1 writes "The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."

94 of 413 comments (clear)

  1. Well by courteaudotbiz · · Score: 4, Insightful

    I guess there's not much to say...

    1. Re:Well by ckthorp · · Score: 4, Funny

      Yah, but once you're in the ground, how do you dodge the bugs then?

    2. Re:Well by tattood · · Score: 5, Informative

      TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."

      I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.

      --
      WTB [sig], PST!!!
    3. Re:Well by SatanicPuppy · · Score: 5, Insightful

      Yea, Jesus. Someone take their job a little too seriously?

      If you ever seriously think of killing yourself over your job, it's time to get a new job.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    4. Re:Well by siloko · · Score: 2, Insightful

      A lot of stuff was going on in this guys life which suggests his demise wasn't simply down to exploits found in his software - from the article it appears that both his mother and sister committed suicide a few months ago, he also recently lost a large contract. That being said I can't imagine the news of VAserv (which relied on Ligesh's HyperVM, the exploited software) losing data on upto 10,000 virtual servers helping much.

    5. Re:Well by courteaudotbiz · · Score: 5, Insightful
      You know, I was just trying to show some compassion. I find it sad that someone could be that much desperate. I personnaly found my brother hung in his bedroom 10 years ago, so

      I guess there's not much to say...

      takes a very different meaning to me than the moderators or you could have seen in this comment.

    6. Re:Well by value_added · · Score: 5, Insightful

      If you ever seriously think of killing yourself over your job, it's time to get a new job.

      Probably good advice generally, but I wonder how many of those defaulting on their mortgages due to a layoff will react positively to hearing it.

      Sometimes that shitty job is all you've got.

    7. Re:Well by Darkness404 · · Score: 2, Insightful

      Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

      --
      Taxation is legalized theft, no more, no less.
    8. Re:Well by Comatose51 · · Score: 3, Interesting

      Agreed but I think that kind of situation or attitude is more prevalent than we think. People build their lives around different things. Their "work" (as in the product of their effort, not as in what they do from 9 to 5) becomes their lives. This is especially true of the creative types such as artists and writers but also software engineers. In many ways, software engineering or engineering in general is a hybrid between the arts and the sciences with room for creativity and personal touches. I work with a good group of engineers who are very passionate about their work, much more so than our paychecks can account for. I've seen the same passion turn into despair in bad times as well. Engineers also compound this problem by not being the most social people in the world. Having a network of people to connect to can really soften the pain when things don't go well. Most engineers don't commit suicide but the rate of burning out is rather high.

      --
      EvilCON - Made Famous by /.
    9. Re:Well by espamo · · Score: 5, Interesting

      TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."

      I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.

      And very likely a genetic predisposition to suicide as well.

    10. Re:Well by johnsonav · · Score: 5, Insightful

      But if you really are /that/ stressed about your job [...]

      It might not have anything to do with on-the-job stress. It seems that there were some other things going on in his life at the time. Lots of people, when their personal lives go to shit, begin to define themselves, more and more, by their jobs. When the rest of their life sucks, their job is where they are valuable, potent, skilled, respected, and needed.

      If you lose that, and you begin to think that your job performance is just as terrible as your performance in the rest of your life, That's when you find people at risk for suicide; they've just had their last leg kicked out from underneath them.

      For some people, a job is the only good thing in their life. Failing at that, as they perceive they've failed at every other aspect of life, is sometimes enough to drive someone over the edge. And no, a job at McDonald's won't mitigate that feeling.

      --
      ... and that's when the C.H.U.D.'s came at me.
    11. Re:Well by Thaelon · · Score: 2

      The job wasn't the only thing. From TFA:

      Ligesh was also still coming to terms with the suicides by hanging of his sister and mother five years ago.

      I'm sure that had a significant impact as well. The security flaw fiasco may have been just the final straw.

      --

      Question everything

    12. Re:Well by TheRealMindChild · · Score: 5, Insightful

      Typical. You do know that most places, you'd be lucky that a full time, minimum wage, McDonalds job will pay for a one bedroom apartment and food for yourself per month. That doesn't include utilities, transportation, clothing, etc.

      Now imagine the single mom with two children. Imagine the 68 year old woman who takes care of her husband who had a stroke.

      It isn't as cut and dry as "Stop being gluttonous"

      --

      "When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
    13. Re:Well by dagnabit · · Score: 5, Insightful

      How does a genetic predisposition for suicide propagate...?

    14. Re:Well by Anonymous Coward · · Score: 5, Insightful

      Please. This guy obviously does not speak English as his first language... probably French. When you speak his language as well as he speaks yours, go ahead and be a grammar Nazi.

      Until then, stfu.

    15. Re:Well by Abreu · · Score: 5, Insightful

      But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

      I would be glad to take a job at McDonalds or Starbucks if it only meant that I would not be able to afford a flat-screen TV... I'd be like Kevin Spacey in American Beauty... hanging out with the kids all day, flipping burgers or making frappuchinos in a no-pressure job.

      However, I choose put up with my current job because I have a wife and two kids that deserve more from me.

      --
      No sig for the moment.
    16. Re:Well by Ephemeriis · · Score: 5, Insightful

      Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

      Spoken like someone who hasn't had to deal with the job market in quite some time.

      The economy right now is in rough shape. My son has been looking for a job for six months now with no luck. He isn't looking for anything amazing - just retail, labor, or food service, or something basic like that. Folks aren't hiring.

      And your typical McDonalds job isn't going to cut it these days. Most food service/retail positions will be minimum wage, which doesn't go very far. They'll also be hourly, not salaried, so you're screwed if you get injured or sick. They'll also be part-time - your schedule will change from one week to the next so you'll not have reliable income, and there'll be absolutely no benefits.

      We're not talking about whether or not you can afford a 50" plasma. We're talking about whether or not you can keep your house and/or car. Whether you'll be able to afford to feed your family. Whether you'll be able to pay the assorted bills.

      We try very hard to live well within our means. We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.

      The odds of me being able to find reliable employment before our savings ran out aren't good. Like I said, folks around here aren't hiring. We could sell the house, if necessary, but I don't know that anyone would buy it. There are plenty of "for sale" signs around town and I don't see them disappearing very quickly. There aren't a whole lot of luxuries we could cut back.

      It's a very scary situation to be in, and we aren't even under a pile of debt. I can't imagine what it's like for some of the folks out there.

      --
      "Work is the curse of the drinking classes." -Oscar Wilde
    17. Re:Well by johnsonav · · Score: 5, Insightful

      You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.

      If you think that most job-related suicides have anything to do with material possessions, you're mistaken. Often, a person's job is the only thing in his life that is working at all. For most people, a job is more than a simple paycheck, it's a source of self-esteem, and feelings of potency, competence, and respect.

      If every facet of your personal life takes a huge dump on you, you might start feeling powerless. But, if you have a job where you can feel powerful and in control, it's easy to recognize that those feelings of powerlessness are a result of those circumstances, that you are not intrinsically powerless.

      But, take away that job, and the emotional support it brings, and you may just have removed the last thing standing between healthily handling life's disappointments, and believing that you are fundamentally powerless to affect change for the better, in your life.

      It's very easy, at that point, to stop seeing yourself as a resilient victim of circumstance, and begin to recognize that perhaps the only common thread in all your life's problems is you. For some people, that's when the line is crossed, and suicide is contemplated. It has nothing to do with material possessions, just feelings of guilt and powerlessness.

      --
      ... and that's when the C.H.U.D.'s came at me.
    18. Re:Well by Anonymous Coward · · Score: 4, Insightful

      Maybe in some sections of the country, people have to downsize from a Rolls to a Lincoln or go from their Lear Jet to chartering a plane and are hating life, but in most of America, a job loss means loss of a house, loss of basic transportation, and loss of the ability to feed one's family.

      People can't just downsize and work at McDonald's. It's not about the 50 inch plasma either. It's getting the kids clothing and school supplies, keeping a homestead, and keeping basic transportation running.

      The US isn't like Europe. In the majority of the nation, there just plain no other transportation other than by car. No, bikes don't work either, unless you like being buzzed by semis while trying to pedal into town on the frontage road of an interstate with no shoulder, not to mention being prey for any gangbangers. Yes, you have the BART and NYC's subway system, but for most of America, finding a bus route is a major achievement, and finding a bus route that can get someone to work on time is almost astounding. Of course, someone will chime in that people moved to the suburbs so they suffer what they may. However, most US cities, someone not extremely rich has a pretty bad choice: Raise a family up in the inner city with gunshots ringing out nightly, or buy a house in the suburbs with a reasonably safe chance to raise kids and commute to work.

      So the adage that most Americans are just whining that they can only buy a smaller TV or go with a smaller SUV for their 500 pound derriere is pure BS.

    19. Re:Well by iluvcapra · · Score: 2, Funny

      After reading the headline "Head of LxLabs found hanged" I was sortof hoping "Head of LxLabs" was some sort of master node and it just needed a power cycle...

      --
      Don't blame me, I voted for Baltar.
    20. Re:Well by Shatrat · · Score: 5, Funny

      My opinion is suggesting someone work at McDonalds, which is virtually impossible for an american citizen, is about as cold hearted as suggesting someone work at a call center, which is virtually impossible for an american citizen, more or less for the same business reasons.

      I've worked at both McDonalds and a call center, and I'm an American citizen.
      I think your definition of "virtual impossibility" is similar to VAserve's definition of "virtual machine security".

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    21. Re:Well by SatanicPuppy · · Score: 5, Insightful

      The core premise of Existentialism is very simple: most people spend their entire lives lying to themselves, and living in a world of imaginary restrictions. It's herd behaviour.

      If you build your self-image on something outside of your self you are giving up your right to self-determination. Other people are making your decisions, and deciding how your life is going to be. Your boss can decide, on a whim, how you get to feel about yourself.

      The whole problem is that we get trapped in this societal notion of how it's supposed to be, of all the things that we have to do. You have to realize that all those obligations are things you put on yourself. There is nothing you can't walk away from.

      Depressing ass philosophy, right? But its still useful. I got stuck in a bitch session with my boss a couple of weeks ago which basically boiled down to, "I'm pissed that the stuff that corporate assigned to you over my head has taken precedence over this thing I wanted you to do."

      And in the middle of it, I unclipped my badge and tossed it on my desk, and looked him in the eye. And he shut his mouth, turned around and didn't bother me again for the rest of the week. He could fire me, no problem, but he feared those consequences more than I did, and he knew it.

      When you define the boundaries of yourself, and you understand that your choice governs your life, and you know it profoundly, there is a freedom in that that scares the shit out of people who let their lives be defined by others.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    22. Re:Well by TheSpoom · · Score: 2

      WARNING! WARNING! CYNICISM OVERLOAD!

      My fiancee has worked at a call center and is an American citizen, and I know many American citizens who have worked for McDonalds.

      Do your research before making such outlandish claims.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    23. Re:Well by jeffasselin · · Score: 3, Informative

      Genes that bring defects that don't affect an individual before its main reproductive period tend to survive more easily. So say a gene defect that kills you the day you are 40, especially for females, will propagate more easily than one that kills you at 10, because you've reproduced and passed those genes on by that time.

      There is still an advantage to surviving after the age of reproduction in a species with longer childhood cycles or one where the grandparents care for the offsprings of its offspring (aka its grandchildren). This advantage is lessened because of gene dilution and its (usually) lesser importance compared to straight reproduction, but still if humans mostly reproduce around 15-20y old (historically), around where they reach maturity, then surviving till at least 40 is an advantage because of more care for the offspring up till maturity. For grandchildren, the age can be up to 60 in the same context.

      Species with communal care for offspring also get advantaged by members who survive longer because they get more people to care for the offsprings, but then the dilution is even more significant.

      So I can see how a gene that brings higher suicide rates of mature subjects can survive for a while, even though it is detrimental.

      --
      If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
    24. Re:Well by david_thornley · · Score: 4, Insightful

      That philosophy can work for a single person, but only at a cost: you'll never be able to make binding commitments. If you want to exercise your freedom to get married, or have kids, you've accepted obligations that you can't just walk away from (or, at least, you really shouldn't). If you want to keep your freedom to risk your job, without being a complete and utter jerk, you have to pass on some things that make some other people's lives deeply meaningful.

      Or, to put this another way, if you can't (or won't) choose to enter an obligation you can't walk away from, you don't have as much freedom as a person who can.

      Personally, I chose to get married and make a commitment, and we chose together to have a kid. This means that I chose certain obligations. The form of the obligations is guided by societal notions, but the choice was mine in both cases. These choices do govern my life, in ways I fully accept. I'm as free as you are, aside from acknowledging that there are consequences for decisions freely made.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    25. Re:Well by svnt · · Score: 2, Interesting

      I'd be like Kevin Spacey in American Beauty...

      You did see the entire movie, right?

      Notable characteristics of Kevin Spacey's character: in the middle of a mid-life crisis, hated by his daughter, hates his wife, has sexual contact with a minor. Oh, and he happens to work at a fast food restaurant.

      This is just a friendly suggestion, but before you tell this story to people you actually know, maybe refine your role model selection a little?

    26. Re:Well by emlyncorrin · · Score: 2, Informative

      How does a genetic predisposition for suicide propagate...?

      Genetically...?

    27. Re:Well by PMBjornerud · · Score: 2, Insightful

      A man or woman has kids before they kill themselves.

      Not at all! For genes to prosper, the do not merely have to allow for themself to transfer.

      In this case, the man was 32 years. Well within reproductive range, even in a primitive ages.

      If it is in the genes, it means individuals with a tendency to suicide does actually tend to generate more surviving offspring than others.

      Obviously there cannot be a direct way for suicide to benefit reproduction. Thus one must look at the group as a whole. One theory could be that suicide of individuals in the face of hardship is a net benefit to the group, freeing up food and resources for the remaining survivors.

      --
      I lost my sig.
    28. Re:Well by Omestes · · Score: 2, Funny

      I am Mexican, you idiot! ...and I live in Mexico, before you reply with more racist stupidities

      Well go back to... erm...
      Wait...

      Stop taking my Mexican jobs!

      --
      A patriot must always be ready to defend his country against his government. -edward abbey
    29. Re:Well by Abreu · · Score: 4, Insightful

      The way I saw the movie it was about:

      A man in the middle of his mid-life crisis, quits his hated job and gets a job in McDonalds ...he also gets a boner about his teenage daughter's friend, but lets be honest, this is Mena Suvari (at her prime!) we are talking about!

      His wife, in the middle of her mid-life crisis, gets into an affair with a coworker

      His daughter, in the middle of her teenage crisis, hates them both

      I really don't see Lester (the protagonist) as a role model; I for one, don't plan to quit my job. However, I can empathize with his feelings and the situation he's in.

      --
      No sig for the moment.
  2. Narrow escape by sakdoctor · · Score: 2, Interesting

    Just closed an account with VAserv last week for no particular reason.
    I hardly ever do things for "no particular reason" so it must have been my spider sense.

    Will this be a case of good bye reputation, or no publicity is bad publicity?

    1. Re:Narrow escape by TheRaven64 · · Score: 3, Interesting

      An SQL injection vulnerability, via the web, gained hypervisor-level access to their system. Let me say that again; a web server, an SQL database, and a web app were all running with sufficiently-high privilege that a vulnerability in one caused arbitrary-code execution at the hypervisor level. Anyone who doesn't immediately start worrying when they see that kind of lack of privilege separation has absolutely no business running a VPS business. I definitely won't be putting any business VAserv's way in the future...

      --
      I am TheRaven on Soylent News
    2. Re:Narrow escape by EvilRyry · · Score: 4, Insightful

      If I'm reading this right, the point of the web application is to manage the VMs. If it didn't have privilege to manage (or destroy in this case) the VMs, it would be pretty useless.

    3. Re:Narrow escape by vlm · · Score: 2, Insightful

      I definitely won't be putting any business VAserv's way in the future...

      Well, normally, this results in a high level of focus on the problem... So, in the future, they probably won't have problems like this. On the other hand, their competitors will be too busy signing up accounts to patch their systems and any public display of patching (like special extended maint time or a new way of using their product) will make them look just as bad so of course their competitors won't focus on security, leaving them more vulnerable than VAserv...

      Except their dude, whom would have focused on security in the near future, is dead now. So maybe that doesn't work too well in this case. Hmm.

      --
      "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
  3. Well by Zashi · · Score: 4, Funny

    That's one way to dodge all those bug reports...

    --
    Skiffy is Spiffy, but Ort is tort.
  4. Mixed feelings by JeffSpudrinski · · Score: 4, Interesting

    You can't truly blame Milw0rm for a person being depressed and committing suicide.

    However, reading their security notes on it, they did hear back from the developer...they simply declared that it didn't happen fast enough and decided unilaterally that the "Vendor appears uninterested".

    I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

    -JJS

    1. Re:Mixed feelings by asdf7890 · · Score: 5, Informative

      I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

      -JJS

      But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there? Quietly forgetting about it and just hoping that you are the only people who know about the issue and no black-hats out there will find it is simply not an option.

    2. Re:Mixed feelings by Zashi · · Score: 2, Interesting

      Actually thanks to cyber-bullying laws I think you can.

      --
      Skiffy is Spiffy, but Ort is tort.
    3. Re:Mixed feelings by drachenfyre · · Score: 3, Insightful

      Why is it not an option? It isn't the best option, which is to announce that an exploit exists, but not release the details. I'm not blaming their actions for the guy's death, but the people who lost servers and data have every right to be angry. It would have been far easier for them to announce that an exploit exists so customers could get out of a bad position instead of releasing the code which guarantees the end result we see here (For the customer, not the owner of LxLabs)

    4. Re:Mixed feelings by CarpetShark · · Score: 2, Interesting

      You can't truly blame Milw0rm for a person being depressed and committing suicide.

      No, you truly can. You can't blame it for 100% of the problem, but without doubt, people who make viruses are preying on others. What outcome to you expect, when those preyed upon are already struggling just to get through the day and raise their kids or whatever?

    5. Re:Mixed feelings by corbettw · · Score: 4, Insightful

      But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there?

      You're assuming the bolded part is true. Reading through the information on Milw0rm's own site, it appears they had an email exchange with someone at LXLabs for two weeks, then decided on their own to release the information. Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients. I hope the guys at Milw0rm get sued into oblivion over this. Their actions were completely irresponsible and directly led to millions of dollars of damage, potentially billions of dollars of damage (over 100,000 accounts were destroyed, assuming those accounts spent on $10 per month on hosting that's millions of dollars in damage to the hosting provider alone). VAServ is based in the UK and LXLabs is based in India; I have no idea what the laws are like in those countries, but let's hope Milw0rm faces criminal charges there over this. Security research is an important field and requires a certain level of trust, accountability, and responsibility for it to function properly. By releasing this information publicly without sufficient notice, Milw0rm breached those traits and deserves to suffer the consequences for doing so.

      --
      God invented whiskey so the Irish would not rule the world.
    6. Re:Mixed feelings by Todd+Knarr · · Score: 2, Interesting

      The problem with that approach is that the day after you announce that the exploit exists the company's going to sue you for defamation and libel. They're going to use the fact that you didn't provide any evidence to support your claim against you as evidence that you don't have any evidence and are lying specifically to harm their reputation. And one of the first things they're going to ask for is an order barring you from libeling them any further, which is going to prevent you from disclosing anything to help clear your reputation. By the time you get the lawsuit untangled you won't be able to demonstrate that the vulnerability really existed (the fix will have been quietly added during a regular update and your exploit won't work anymore) and you'll end up with the trashed reputation.

      My position:

      1. Contact the vendor with full details. Give them working exploit code so they can verify for themselves that it really works. They get 2 weeks to respond confirming they've received your material, and no more than an additional 4 weeks to at least notify their customers of the problem.
      2. If the vendor fails to meet either of those deadlines, publicly release a full report on the problem including sufficient details and/or code for other parties to verify the correctness of your claims and any known workarounds or steps that can be taken to mitigate the vulnerability. By this point the bad guys already have all this information, now the affected users also have it and can take steps to protect themselves.
      3. Don't threaten. Don't bluff. Your position should be Londo's: "Actually, now that you mention it...".
    7. Re:Mixed feelings by nxtw · · Score: 2, Interesting

      Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients

      Are you serious?

      According to milw0rm, whoever responded didn't even access the details of the vulnerabilities - after two weeks. Nor did they provide any contact information. It would only take a few minutes to skim through the details, and it should have been immediately apparent that the vulnerabilities described could be serious. But they didn't read the details at all.

      Assuming milw0rm did contact the correct person/people at LXLabs, they clearly has no interest in the security of their product(s).

    8. Re:Mixed feelings by corbettw · · Score: 5, Insightful
      Someone sends a random, out-of-the-blue email saying "hey we hax0red your code, lol" and you expect the recipient to pop tall and check out their site immediately? Are you serious? And what contact information was needed? Obviously Milw0rm talked with someone at the company, so they already had contact information. Could it be that Milw0rm was talking to a customer service agent who didn't appreciate the severity of the problem because, gee, I dunno, Milw0rm didn't bother to track down contact information for the right person(s)?

      Assuming milw0rm did contact the correct person/people at LXLabs

      That's a huge assumption and not one I'm willing to make. However, I am willing to state, without reservation, that Milw0rm are a bunch of asshats who deserve to be sued into oblivion over their callous disregard for the safety of the customers using this software. That's really the worst part of all of this. Most of the people hurt by this had no control over the software getting fixed, had no idea there was a problem until it was too late to do anything about it, and were completely innocent of any mistakes. And yet Milw0rm doesn't care one fig about those people and just releases code that sends their lives and businesses into a tailspin. How do you defend that kind of behavior and call yourself a professional?

      --
      God invented whiskey so the Irish would not rule the world.
  5. Re:There's yer problem... by Anonymous Coward · · Score: 4, Insightful

    Backup your own damn data. If you trust your webhoster to do it for you, you're a lost cause.

  6. Can we stick to the tech? by Anonymous Coward · · Score: 5, Insightful

    According to the article, there have been other suicides in the family a few years ago. Let's just discuss tech, and let the personal stay personal.

  7. VM Attacks by barfy · · Score: 2, Informative

    Had been posited for about 2-3 years now. It is actually amazing that this was such a brutal attack.

    The dangers of these attacks had always been stealth related, because it is nearly impossible for the machine to SEE the vm manager. Which makes these things even more dangerous than rootkits.

    1. Re:VM Attacks by Zocalo · · Score: 5, Interesting

      Actually, this has almost nothing to do with attacking VMs and more to do with the simple fact that LxLab's code is an extremely poorly written piece of crap from a security standpoint that leaves the VM wide open to attack. Having read through the 24 sample exploits when they were first published on milw0rm, the errors are pretty damn fundamental and indicate a complete ignorance of many of the established best practices in secure coding. It was just a matter of time before one of LxLab's users got hit and hit hard; frankly I'm surprised it took so long.

      The only thing that I found surprising about the attack on VAserv is that the perpetrator decided to blow away the servers instead of subvert them for sending spam or hosting related websites; 100,000 web hosts have got to be worth quite a few dollars on the right market. While it sucks to be VAserv or one of their customers right now, it's probably better things went this way than the alternative for everyone else. Of course, it's just a matter of time before the next users of LxLabs HyperVM gets hit - if they haven't been already - and at least some of them are almost certainly going to be end up doing something less than legitimate.

      --
      UNIX? They're not even circumcised! Savages!
  8. My condolences by elnyka · · Score: 5, Insightful

    My condolences to Mr. Ligesh's family.

  9. Times of India article on owner by dleigh · · Score: 2, Informative

    http://timesofindia.indiatimes.com/Bangalore/Techie-hangs-himself-in-HSR-Layout-/articleshow/4633101.cms

  10. Depressed person with problems kills himself by hattig · · Score: 4, Informative

    Sounds like the guy needed some more help than he got to get to grips with his personal situation. Anyway ...

    The flaws include SQL injection vulnerabilities and flaws that create a way for hackers to gain file access to files hosted on a vulnerable system.

    There is no excuse for SQL Injection vulnerabilities these days. The problem is well known and publicised, the solutions are well documented. This is a problem that is solved by altering how you code, that results in neater code with less errors. If you can't use prepared/parameterised statements and insist on building SQL command strings out of user supplied data, then ... well, err, I can't say "you deserve to hang" in this case can I?

    1. Re:Depressed person with problems kills himself by Saija · · Score: 2, Informative

      There is no excuse for SQL Injection vulnerabilities these days.

      I just wish that be truth, right now i'm using some "connection db class" in c# made by someone else, wich expects the sql commands to be executed be concatenated strings, no SqlParameters or whatsoever, no, just single and dangerous sql commands concatenateds, and there's no way in hell i could change that class for something better

      --
      Slashdot ya no es que lo era! ;)
    2. Re:Depressed person with problems kills himself by QuoteMstr · · Score: 3, Insightful

      It's enough to make you wish we were real engineers. If an engineer is working on a bridge and his supervisor orders him to use a dangerously weak cable, the engineer has both a moral and legal duty to refuse. The same principle ought to apply to software developers, especially when life and property are at stake.

  11. It may have been genetic by BadAnalogyGuy · · Score: 4, Interesting

    His sister and mother both committed suicide by hanging 5 years ago. He may have had a genetic propensity towards suicide.

    Culturally, Indians have a very heavy emphasis on honor and responsibility. The failure of the software is only the outermost layer of true damage. Each of those compromised VMs is a failure to satisfy a customer at best, and a grave violation of the trust between vendor and customer.

    When it comes to suicide, why hanging? It seems like a really hard way to go. Maybe the person wants to suffer to pay back his debts before death.

    1. Re:It may have been genetic by fuzzyfuzzyfungus · · Score: 3, Interesting

      Not really. Plenty of people commit suicide in their late 20s or later, which leaves a decent slice of breeding time, depending on how early you start. Particularly with modern social structures(where orphans are incrementally less likely to starve in Dickensian workhouses) you can fairly easily pump out surviving children at greater than replacement rate, even if you are dead by 30.

      Also, a "propensity" toward suicide isn't necessarily fatal, depending on life conditions. If you don't run into much serious stress, a tendency to respond badly to stress is largely harmless. If your son gets it and runs into a series of nasty business reversals, it'll bite him.

    2. Re:It may have been genetic by Anonymous Coward · · Score: 2, Interesting

      Sadly, I've never seen that level of dedication to quality in anything touched by an Indian outsourcing provider. It's always a pile of crap that you spent twice as long overspeccing to make sure they didn't mess up, then whatever came back was so broken that you spent twice as long as it would have taken to do it right the first time trying to fix it. You can't just wipe it and start over because whoever the bright bulb was who insisted on outscourcing to begin with will have a lot of political clout invested in not looking like the weenie they actually are.

      Posting anonymously because, well, I'm a coward.. but I speak the truth (as I have seen it).

    3. Re:It may have been genetic by Anonymous Coward · · Score: 4, Insightful

      I use the word "honor" in public, and no one laughs at me, but I don't use it to describe acts like this one. This is just as screwed up a notion of honor as the Japanese have. Killing yourself does not absolve you of anything. It does not help anyone. It is at best a gesture, and at worst simple escapism.

      The honorable thing to do would have been to fix the problem in the first place, or build a new version from scratch, or shut down the project and provide a migration path. The honorable thing to do after the disaster would have been to patch the biggest holes as fast as possible while providing a migration path to another product. The thing about responsibility for negligence or idiocy is that it requires messy things like restitution, even if no one is making you do it. Suicide is ridiculously self-serving by comparison.

    4. Re:It may have been genetic by Anonymous Coward · · Score: 2, Insightful

      Oh, and I'm perfectly accepting of suicide when people are trying to escape pain, boredom, shame, or whatever. I just don't like seeing it confused with honor.

  12. potential upside by Anonymous Coward · · Score: 4, Funny

    Hopefully the sites lost were those abandoned blogs, even better if they were active blogs.

  13. The guys pic by ultrapenguin · · Score: 3, Informative

    The guys pic

    http://i41.tinypic.com/zjdqgy.jpg

    RIP

  14. Disrespectful by gubers33 · · Score: 5, Insightful

    I think it is quite disturbing with all of the disrespectful comments on this article. I could Mod some of this, but not all of it. The guy obviously hit hard times with death of two family members by suicide and the tanking of his company. It is clear he had depression in his family and was not able to bear all of this hitting him. It is sickening that so many of you think it is a joke.

    --
    Just because you are wrong and I called you out on it doesn't mean I am a Troll.
    1. Re:Disrespectful by QuoteMstr · · Score: 4, Insightful

      It is sickening that so many of you think it is a joke.

      Sickening, but not surprising. Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check. Remove via anonymity the social cues that inhibit these instincts, and we end up with the appalling comments here.

    2. Re:Disrespectful by SatanicPuppy · · Score: 3, Insightful

      Killing yourself pretty much removes your right to a lot of sympathy. Lot of people are talking about "honor" like killing yourself is the honorable way out, but really it's not. The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    3. Re:Disrespectful by DoofusOfDeath · · Score: 5, Funny

      Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check.

      Yes, but if you look under the Barbarism, you actually find two layers of humanitarianism.

      You don't need a sense of despair; just a good belt sander.

    4. Re:Disrespectful by Brad+Mace · · Score: 2, Insightful

      Some people use humor as a coping mechanism. I suspect the percentage is higher than average on slashdot. Perhaps that's because it's a relatively young crowd that doesn't have much experience with death. That's how it goes though; things that hit close to home seem like serious business, and the sort of things that "happen to someone else" don't. It's also just not possible to get personally invested in every bad thing that happens in the world. With our 24-hour news cycle and world-wide coverage, we'd spend every waking moment grieving. I think humor is used to push back against the tendency to only report on the bad news.

    5. Re:Disrespectful by Jamie's+Nightmare · · Score: 2, Insightful

      Oh, fuck you. Stop being a pompous ass. Some choose to deal with personal tragedy through humor and sarcasm. Your "public" concern over the self induced death of one man amid a universe this complex and incredible is a joke in and of itself.

      --
      "When you see a unixer brainwashed beyond saving, kick him out of the door." - Xah Lee
    6. Re:Disrespectful by gad_zuki! · · Score: 5, Insightful

      >Killing yourself pretty much removes your right to a lot of sympathy.

      Bullshit. People with mental illness deserve your sympathy. The idea that suicide was some kind of rational selfish response is stupid. Clearly, he had a lot of suffering if he felt he needed to kill himself. These people deserve our sympathy not our disdain. Hopefully, we can teach people, especially young people, that mental illness shouldnt be shameful and if they suspect they have it then they should get treated - not hide it away and have it lead to suicide like this guy.

    7. Re:Disrespectful by AioKits · · Score: 4, Insightful

      The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.

      I suspect it's much easier to say this when you're not the one having to travel that road. No offense to you is implied by this observation Mr SatanicPuppy, but from a smaller degree of personal experience, it is easier said than done. The depression I entered after my brother's death (sorry, no details for /.) has had some long lasting effects on me, even if it was 11 years, 7 months and 2 days, 15 hours, 30 minutes ago.

      Not saying I disagree, but still, easier said than done.

      --
      "Quote me as saying I was mis-quoted." -Groucho Marx
    8. Re:Disrespectful by AioKits · · Score: 2, Insightful

      Let's try not to get into cock waving here over who has experienced the most tragedy and death please. I only offered my experience as a point of reference for myself. I take no pride in that I can survive such an...experience. I can't claim to know all circumstances for all people. I admire (for what little my admiration goes for these days) you were able to survive the previously mentioned situations. Don't be sympathetic because of his choice, be sympathetic because he is dead. If not for him, then for those around him.

      --
      "Quote me as saying I was mis-quoted." -Groucho Marx
    9. Re:Disrespectful by SatanicPuppy · · Score: 2, Insightful

      I just wanted you to know where I was coming from before I disagreed with you.

      The funny thing about it is how people are affected differently by different levels of emotional trauma. I've known people whose whole lives were shattered by their parents going through what I'd consider to be a reasonably amicable divorce.

      So trauma is weird. Some people shake it off, other people...not so much. I'm always sympathetic with people who can't take it. I get that.

      I'm not really sympathetic with people who dish it out, however. I don't know if this guy has a family or not. He was pretty young, around the age I was when I had my first kid. If he did have a family, I have nothing but contempt for him. If he was having trouble getting over his family members committing suicide, then what possible fucking rationale could he have passing that on to the rest of his family?

      Gotta feel bad for his fricking father: that guy had his wife and two of his kids kill themselves. Of course, who's to say that's not misplaced sympathy? The guy could be the reason they all offed themselves.

      I don't know. I guess, in my head, I view suicide when you have loved ones and/or dependents to be SO prickish, that frankly, they're probably better off without him. If it were my brother/son/father, I'd be so fucking angry...Not. Even. Words. I can't imagine the level of pissed off I'd feel if my kid offed himself after something stupid like a business crash...THAT?! That is worth your life? Jesus.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
  15. Re:Damn... by Chatterton · · Score: 4, Funny

    That's like putting your mission critical servers in a garden shed with holes in the roof.

    What??? It's not a cheap way to get my server water cooled???

    Could this explain my high hardware failure?

  16. Hackers = murderers? by Anonymous Coward · · Score: 2, Insightful

    I'm sure this guy was already unstable but can't help but believe that the attacks were what finally pushed him over the edge. Legally this would be difficult to prosecute as murder but morally those little script kiddies who so impressed with themselves should consider the unintended consequences of their actions. We are all responsible for our own actions (suicide) but should be equally concerned with how our actions affect others (hackers).

    1. Re:Hackers = murderers? by FishWithAHammer · · Score: 2, Insightful

      Oh, please. They had sufficient time for a relatively simple exploit to be patched. This guy stalled them with vague non-responses and shit never got done, so milw0rm posted it publicly. That's what security folks do. It's not their fault that he decided that fixing the software he put his reputation behind wasn't worth it.

      --
      "You can either have software quality or you can have pointer arithmetic, but you cannot have both at the same time."
  17. Re:Who else? by FishWithAHammer · · Score: 3, Interesting

    Many/most (cheapvps, fsckvps, etc.) are reselling VAserv stuff, so a lot have been hit hard.

    If they're using HyperVM, stay the hell away.

    --
    "You can either have software quality or you can have pointer arithmetic, but you cannot have both at the same time."
  18. I don't know if its been said yet... by dyingtolive · · Score: 4, Insightful

    but I gotta respect this guy's dedication to the job. If we could get American CEO's to take this level of responsibility when their companies completely faceplant, the world would be a better place.

    --
    Support the EFF and Creative Commons. The war is coming, and they're supporting you...
    1. Re:I don't know if its been said yet... by dyingtolive · · Score: 2, Funny

      People are in strange moods today. Here I am expecting offtopic/funny/maybe redundant, and I get flamebait/interesting. Go figure.

      --
      Support the EFF and Creative Commons. The war is coming, and they're supporting you...
  19. Brilliant Idea! by __aanmys7397 · · Score: 2, Insightful

    Why don't you round them up, put identifying badges on them, and then try killing them yourse-
    Oh wait.

    Godwin's law, dammit.

  20. Woah. by Anonymous Coward · · Score: 5, Funny

    Can you imagine if a Microsoft executive hung himself every time a vulnerability was discovered in Windows that led to data loss?

  21. I'm a VAserv customer by barq · · Score: 4, Informative

    Request: Please no one post links to the VAserv status page. The last thing we need is to /. them right now. Customers have been emailed the URL and we are the only ones who really need to see it (plus it isn't very interesting).

    VAserv have emailed customers to say they will be taken over by BlueSquare (where they do most of their hosting anyway). Probably the best option given the scale of the attack.

    I've got one apparently deleted VPS and one still running. The whole situation is terribly frustrating. However I don't think the lack of information coming from VAserv is due to a lack of effort on their part.

  22. respect for the dead by circletimessquare · · Score: 3, Insightful

    is not appreciated by those who think they are immortal

    ie, teenaged idiots

    that the world is full of teenaged idiots (most of whom are not chronologically actual teenagers) should not surprise you or disappoint you

    just a simple ugliness of life you need to learn to accept, like people who throw their garbage on the ground or talk loudly at movies, its another example of the tragedy of the commons

    sure you could declare a high holy moral crusade against boorish insensitivity, but its like trying to stop the sun from rising and setting: a lot of people are ignorant assholes, status permanent, and even those you might actually be able to educate are quickly replaced by more morons

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  23. what security folks do by Gary+W.+Longsine · · Score: 5, Insightful

    "Oh, please. They had sufficient time for a relatively simple exploit to be patched. This guy stalled them with vague non-responses and shit never got done, so milw0rm posted it publicly. That's what security folks do. It's not their fault that he decided that fixing the software he put his reputation behind wasn't worth it."

    Well, not exactly. There is a raging debate over whether this is an appropriate tactic, and this incident will go down in the security text books as an example of why the debate exists. Opposite your opinion is something like, "That's what publicity seeking sociopathic nerds, masquerading as [security folk] do."

    There is a fundamental tension between wanting to know if a system you own is vulnerable to some defect, and wanting to keep the exploit code out of the hands of The Bad Guys(TM). In this case, however, it seems pretty clear that simply knowing the name of the product (not even the version) was enough, exploit code wasn't required (as it sometimes is when scanning large numbers of systems that might be at indeterminate patch levels, for example).

    There are quite a few actions one could take between "notify the vendor" and "release exploit code" which appear to have been skipped. That's irresponsible, not, "what security folks do".

    Frankly, I don't understand how organizations or consultants who do this kind of thing manage to stay in business. If you were a big company with a bunch of interlocking IT systems and limited resources, would you hire someone who had a track record of publishing exploit code before patches were available? Suppose this consultant found some issues, which your organization couldn't respond to as quickly as you would like? Does that consultant become a risk to you now, simply because you didn't fix something in a manner timely enough to suit them? How do you know they wouldn't publish details of your vulnerabilities, because some snot nose punk with an inflated sense of self-righteousness thought you were ignoring him?

    I don't operate that way, and neither do any of the fine security consultants who work for me or with me. I work discretely with my clients until they get their problems fixed. That sometimes means doing a lot more work than *should* be required to get the attention of a vendor. However, it has never yet meant publishing exploit code prior to patch availability.

    --
    If you mod me down, I shall become more powerful than you could possibly imagine.
  24. Wow. Nice crowd. by EddyPearson · · Score: 5, Funny

    Some rather unpleasant comments coming off of you lot.

    The poor chap sounds like he'd had a bad decade, and this just topped it off.

    When your business collapses overnight (which is what happened here), you're facing god knows how many lawsuits (which is what would have happened here) and the people you'd turn to for support are dead... Well, I'd imagine what follows are some rather sobering thoughts.

    My heart goes out to his remaining family, and those of you modded "Funny" should go gargle some engine coolant.

    --
    You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
  25. Re:There's yer problem... by Bill,+Shooter+of+Bul · · Score: 2, Insightful

    I think many people may have been confused as to what they meant by data back up. There are back ups you need in case you delete all of your data accidentally, or want to go back to a previous revision. Those would be back ups due to web host user screw ups. This wasn't a web host user screw up, it was a web host screw up. The users probably didn't consider it a likely occurrence, and may have believed that the web host should be able to fix a problem that they allowed due to their negligence.

    --
    Well.. maybe. Or Maybe not. But Definitely not sort of.
  26. They comitted suicide... by kmike · · Score: 4, Informative

    five years ago, not a few months.

  27. Summary of Vunerabilities by BrittanyGites · · Score: 3, Interesting

    Summary from http://www.milw0rm.com/exploits/8880 seems pretty serious but quite difficult to fix all of them in 2 weeks.

          Timeline :

          05/21/2009 - sent initial email to vendor with a link to a private
                                    resource for viewing various kloxo hiab575
                                    vulnerability info
          05/23/2009 - received the following: "Thanks for the info. I will
                                    review this and let you know." (no signature)
          05/30/2009 - sent an email asking if there were any updates
          06/01/2009 - received the following: "Sorry for the delay. I am
                                    currently looking into this, and will reply in a couple
                                    of hours time." (no signature)
          06/04/2009 - nothing heard from vendor, and the private resource
                                    containing the vulnerability info still does not
                                    appear to have been accessed

          2 weeks have passed since the initial notification. Vendor appears
          uninterested.

          ISSUE 1 - uid/gid reuse
          ISSUE 2 - unprivileged port use
          ISSUE 3 - default passwords
          ISSUE 4 - useradd string in the process list
          ISSUE 5 - XSS
          ISSUE 6 - remotely create partially user controlled file names
                                and directories. Locally append uncontrolled data to
                                any file
          ISSUE 7 - local users can take control of any file or directory
          ISSUE 8 - local users can take control of any file or directory
          ISSUE 9 - local users can overwrite any file on the box
          ISSUE 10 - yet another symlink attack for local users
          ISSUE 11 - metachar injection, local command execution as root
          ISSUE 12 - web stats world readable password hashes
          ISSUE 13 - local users can overwrite any file on the box
          ISSUE 14 - metachar injection, local command execution as root
          ISSUE 15 - remotely block any - or every - IP addr in hosts.deny
          ISSUE 16 - remote CPU and mem usage DoS
          ISSUE 17 - local users can truncate and control any file
          ISSUE 18 - just 2 more symlinks to own any file on the box
          ISSUE 19 - file manager, view and edit any file
          ISSUE 20 - file manager PT II
          ISSUE 21 - file manager PT III
          ISSUE 22 - local user symlink attack
          ISSUE 23 - local user symlink attack (last one)
          ISSUE 24 - sql injection in the "Forgot Password" form

    --
    Ian
  28. indescribably sad by Presto+Vivace · · Score: 2, Insightful

    very sad story, very sorry to hear about your brother.

  29. Re:Suicide is better than the Bahamas by couchslug · · Score: 2, Informative

    "While suicide should never be celebrated, there's a certain honor in doing it as a result of professional failure."

    It can be the ultimate apology. While your post will be modded Troll, other societies see things differently. Seppuku, anyone?

    --
    "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
  30. TO ALL Re:Well by courteaudotbiz · · Score: 4, Informative

    Yes, I meant hanged. Sorry, english is not my first language.

  31. Tragic by jd · · Score: 4, Insightful

    I've known relations who have opted for suicide, or who have been hospitalized to prevent them. None as close as immediate family, so I can't begin to understand the pain, but in my own way I can dimly see.

    One thing that makes this sort of thing doubly painful is that the sorts of minds that can consider suicide a real possibility are often very very close (and sometimes the same) as the minds that are brilliant.

    We talk of genius and madness being a razor's edge away from each other, not because it is poetic but because it's true. But you don't have to be a genius to be that razor's edge away from self-destruction. You only have to have a similar biochemistry and/or neurology. There are dozens of conditions linked both to creative talent and self-harm.

    Of course, not all suicides are for that reason. Utter despair (which I guess is still biochemical, but it's not a permanent condition) is another reason. There are doubtless many others.

    I guess this sort of intellectualizing of suicide is my own way of dealing with the pain I have, for all that it's nothing compared to that of those close to such victims. So long as I intellectualize it, I can imagine that there will someday be solutions which help such people and prevent such tragedies happening.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:Tragic by jd · · Score: 4, Funny

      Hmmm. Now can you come up with a solution that geeks can actually use in the real world?

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    2. Re:Tragic by jd · · Score: 2, Funny

      I require experimental evidence of this. Send me a dozen for testing purposes.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  32. Re:There's yer problem... by horza · · Score: 5, Informative

    There is only so much due diligence you can do if their claims are not true.

    Phillip.

    --
    Property for sale in Nice, France
  33. Re:There's yer problem... by Glendale2x · · Score: 2, Interesting

    I disagree; it should logically follow that a company should have some kind of disaster recovery plan other than "Oops, it's all gone, but how about a few months of free service?" If that's what customers want and I could get away with then damn, I've been wasting time and money keeping disaster recovery backups offsite. I'm not talking about backups like customers accidentally deleting files, but loss of service due to events beyond your control.

    Yes, you should have copies of your own stuff, the more the better. For vahost even if the "oh crap" backup was a week old that would have been better than the total loss they're selling as "not our fault we dun got hacked".

    --
    this is my sig
  34. Re:There's yer problem... by harryandthehenderson · · Score: 2, Informative

    It doesn't matter; the point of a disaster recovery backup (or plan) is not to protect your clients against accidentally deleting files, but to protect you (and them) from events that are completely outside of your control.

    Who says they didn't have a disaster recovery plan? The issue at hand for many of the sites that have no backups at all for their data is because they chose a plan that explicitly stated that it was unmanaged and that VAserv wasn't going to back up the data for you.