Slashdot Mirror
Security Flaw Hits VAserv; Head of LxLabs Found Hanged
Keldrin_1 writes "The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."
According to the article, there have been other suicides in the family a few years ago. Let's just discuss tech, and let the personal stay personal.
My condolences to Mr. Ligesh's family.
TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."
I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.
WTB [sig], PST!!!
Yea, Jesus. Someone take their job a little too seriously?
If you ever seriously think of killing yourself over your job, it's time to get a new job.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
I think it is quite disturbing with all of the disrespectful comments on this article. I could Mod some of this, but not all of it. The guy obviously hit hard times with death of two family members by suicide and the tanking of his company. It is clear he had depression in his family and was not able to bear all of this hitting him. It is sickening that so many of you think it is a joke.
Just because you are wrong and I called you out on it doesn't mean I am a Troll.
I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.
-JJS
But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there? Quietly forgetting about it and just hoping that you are the only people who know about the issue and no black-hats out there will find it is simply not an option.
I guess there's not much to say...
takes a very different meaning to me than the moderators or you could have seen in this comment.
If you ever seriously think of killing yourself over your job, it's time to get a new job.
Probably good advice generally, but I wonder how many of those defaulting on their mortgages due to a layoff will react positively to hearing it.
Sometimes that shitty job is all you've got.
Actually, this has almost nothing to do with attacking VMs and more to do with the simple fact that LxLab's code is an extremely poorly written piece of crap from a security standpoint that leaves the VM wide open to attack. Having read through the 24 sample exploits when they were first published on milw0rm, the errors are pretty damn fundamental and indicate a complete ignorance of many of the established best practices in secure coding. It was just a matter of time before one of LxLab's users got hit and hit hard; frankly I'm surprised it took so long.
The only thing that I found surprising about the attack on VAserv is that the perpetrator decided to blow away the servers instead of subvert them for sending spam or hosting related websites; 100,000 web hosts have got to be worth quite a few dollars on the right market. While it sucks to be VAserv or one of their customers right now, it's probably better things went this way than the alternative for everyone else. Of course, it's just a matter of time before the next users of LxLabs HyperVM gets hit - if they haven't been already - and at least some of them are almost certainly going to be end up doing something less than legitimate.
UNIX? They're not even circumcised! Savages!
Can you imagine if a Microsoft executive hung himself every time a vulnerability was discovered in Windows that led to data loss?
TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."
I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.
And very likely a genetic predisposition to suicide as well.
But if you really are /that/ stressed about your job [...]
It might not have anything to do with on-the-job stress. It seems that there were some other things going on in his life at the time. Lots of people, when their personal lives go to shit, begin to define themselves, more and more, by their jobs. When the rest of their life sucks, their job is where they are valuable, potent, skilled, respected, and needed.
If you lose that, and you begin to think that your job performance is just as terrible as your performance in the rest of your life, That's when you find people at risk for suicide; they've just had their last leg kicked out from underneath them.
For some people, a job is the only good thing in their life. Failing at that, as they perceive they've failed at every other aspect of life, is sometimes enough to drive someone over the edge. And no, a job at McDonald's won't mitigate that feeling.
... and that's when the C.H.U.D.'s came at me.
Typical. You do know that most places, you'd be lucky that a full time, minimum wage, McDonalds job will pay for a one bedroom apartment and food for yourself per month. That doesn't include utilities, transportation, clothing, etc.
Now imagine the single mom with two children. Imagine the 68 year old woman who takes care of her husband who had a stroke.
It isn't as cut and dry as "Stop being gluttonous"
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Well, not exactly. There is a raging debate over whether this is an appropriate tactic, and this incident will go down in the security text books as an example of why the debate exists. Opposite your opinion is something like, "That's what publicity seeking sociopathic nerds, masquerading as [security folk] do."
There is a fundamental tension between wanting to know if a system you own is vulnerable to some defect, and wanting to keep the exploit code out of the hands of The Bad Guys(TM). In this case, however, it seems pretty clear that simply knowing the name of the product (not even the version) was enough, exploit code wasn't required (as it sometimes is when scanning large numbers of systems that might be at indeterminate patch levels, for example).
There are quite a few actions one could take between "notify the vendor" and "release exploit code" which appear to have been skipped. That's irresponsible, not, "what security folks do".
Frankly, I don't understand how organizations or consultants who do this kind of thing manage to stay in business. If you were a big company with a bunch of interlocking IT systems and limited resources, would you hire someone who had a track record of publishing exploit code before patches were available? Suppose this consultant found some issues, which your organization couldn't respond to as quickly as you would like? Does that consultant become a risk to you now, simply because you didn't fix something in a manner timely enough to suit them? How do you know they wouldn't publish details of your vulnerabilities, because some snot nose punk with an inflated sense of self-righteousness thought you were ignoring him?
I don't operate that way, and neither do any of the fine security consultants who work for me or with me. I work discretely with my clients until they get their problems fixed. That sometimes means doing a lot more work than *should* be required to get the attention of a vendor. However, it has never yet meant publishing exploit code prior to patch availability.
If you mod me down, I shall become more powerful than you could possibly imagine.
How does a genetic predisposition for suicide propagate...?
Some rather unpleasant comments coming off of you lot.
The poor chap sounds like he'd had a bad decade, and this just topped it off.
When your business collapses overnight (which is what happened here), you're facing god knows how many lawsuits (which is what would have happened here) and the people you'd turn to for support are dead... Well, I'd imagine what follows are some rather sobering thoughts.
My heart goes out to his remaining family, and those of you modded "Funny" should go gargle some engine coolant.
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
Please. This guy obviously does not speak English as his first language... probably French. When you speak his language as well as he speaks yours, go ahead and be a grammar Nazi.
Until then, stfu.
But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.
I would be glad to take a job at McDonalds or Starbucks if it only meant that I would not be able to afford a flat-screen TV... I'd be like Kevin Spacey in American Beauty... hanging out with the kids all day, flipping burgers or making frappuchinos in a no-pressure job.
However, I choose put up with my current job because I have a wife and two kids that deserve more from me.
No sig for the moment.
Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.
Spoken like someone who hasn't had to deal with the job market in quite some time.
The economy right now is in rough shape. My son has been looking for a job for six months now with no luck. He isn't looking for anything amazing - just retail, labor, or food service, or something basic like that. Folks aren't hiring.
And your typical McDonalds job isn't going to cut it these days. Most food service/retail positions will be minimum wage, which doesn't go very far. They'll also be hourly, not salaried, so you're screwed if you get injured or sick. They'll also be part-time - your schedule will change from one week to the next so you'll not have reliable income, and there'll be absolutely no benefits.
We're not talking about whether or not you can afford a 50" plasma. We're talking about whether or not you can keep your house and/or car. Whether you'll be able to afford to feed your family. Whether you'll be able to pay the assorted bills.
We try very hard to live well within our means. We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.
The odds of me being able to find reliable employment before our savings ran out aren't good. Like I said, folks around here aren't hiring. We could sell the house, if necessary, but I don't know that anyone would buy it. There are plenty of "for sale" signs around town and I don't see them disappearing very quickly. There aren't a whole lot of luxuries we could cut back.
It's a very scary situation to be in, and we aren't even under a pile of debt. I can't imagine what it's like for some of the folks out there.
"Work is the curse of the drinking classes." -Oscar Wilde
You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.
If you think that most job-related suicides have anything to do with material possessions, you're mistaken. Often, a person's job is the only thing in his life that is working at all. For most people, a job is more than a simple paycheck, it's a source of self-esteem, and feelings of potency, competence, and respect.
If every facet of your personal life takes a huge dump on you, you might start feeling powerless. But, if you have a job where you can feel powerful and in control, it's easy to recognize that those feelings of powerlessness are a result of those circumstances, that you are not intrinsically powerless.
But, take away that job, and the emotional support it brings, and you may just have removed the last thing standing between healthily handling life's disappointments, and believing that you are fundamentally powerless to affect change for the better, in your life.
It's very easy, at that point, to stop seeing yourself as a resilient victim of circumstance, and begin to recognize that perhaps the only common thread in all your life's problems is you. For some people, that's when the line is crossed, and suicide is contemplated. It has nothing to do with material possessions, just feelings of guilt and powerlessness.
... and that's when the C.H.U.D.'s came at me.
My opinion is suggesting someone work at McDonalds, which is virtually impossible for an american citizen, is about as cold hearted as suggesting someone work at a call center, which is virtually impossible for an american citizen, more or less for the same business reasons.
I've worked at both McDonalds and a call center, and I'm an American citizen.
I think your definition of "virtual impossibility" is similar to VAserve's definition of "virtual machine security".
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
The core premise of Existentialism is very simple: most people spend their entire lives lying to themselves, and living in a world of imaginary restrictions. It's herd behaviour.
If you build your self-image on something outside of your self you are giving up your right to self-determination. Other people are making your decisions, and deciding how your life is going to be. Your boss can decide, on a whim, how you get to feel about yourself.
The whole problem is that we get trapped in this societal notion of how it's supposed to be, of all the things that we have to do. You have to realize that all those obligations are things you put on yourself. There is nothing you can't walk away from.
Depressing ass philosophy, right? But its still useful. I got stuck in a bitch session with my boss a couple of weeks ago which basically boiled down to, "I'm pissed that the stuff that corporate assigned to you over my head has taken precedence over this thing I wanted you to do."
And in the middle of it, I unclipped my badge and tossed it on my desk, and looked him in the eye. And he shut his mouth, turned around and didn't bother me again for the rest of the week. He could fire me, no problem, but he feared those consequences more than I did, and he knew it.
When you define the boundaries of yourself, and you understand that your choice governs your life, and you know it profoundly, there is a freedom in that that scares the shit out of people who let their lives be defined by others.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
Assuming milw0rm did contact the correct person/people at LXLabs
That's a huge assumption and not one I'm willing to make. However, I am willing to state, without reservation, that Milw0rm are a bunch of asshats who deserve to be sued into oblivion over their callous disregard for the safety of the customers using this software. That's really the worst part of all of this. Most of the people hurt by this had no control over the software getting fixed, had no idea there was a problem until it was too late to do anything about it, and were completely innocent of any mistakes. And yet Milw0rm doesn't care one fig about those people and just releases code that sends their lives and businesses into a tailspin. How do you defend that kind of behavior and call yourself a professional?
God invented whiskey so the Irish would not rule the world.
There is only so much due diligence you can do if their claims are not true.
Phillip.
Property for sale in Nice, France