Slashdot Mirror
Code Spaces Hosting Shutting Down After Attacker Deletes All Data
An anonymous reader writes Code Spaces [a code hosting service] has been under DDOS attacks since the beginning of the week, but a few hours ago, the attacker managed to delete all their hosted customer data and most of the backups. They have announced that they are shutting down business.
From the announcement: An unauthorized person who at this point who is still unknown (All we can say is that we have no reason to think its anyone who is or was employed with Code Spaces) had gained access to our Amazon EC2 control panel and had left a number of messages for us to contact them using a Hotmail address. Reaching out to the address started a chain of events that revolved around the person trying to extort a large fee in order to resolve the DDOS.
At this point we took action to take control back of our panel by changing passwords, however the intruder had prepared for this and had already created a number of backup logins to the panel and upon seeing us make the attempted recovery of the account he proceeded to randomly delete artifacts from the panel.
At this point we took action to take control back of our panel by changing passwords, however the intruder had prepared for this and had already created a number of backup logins to the panel and upon seeing us make the attempted recovery of the account he proceeded to randomly delete artifacts from the panel.
Good thing people hosted their stuff on the cloud...
...doesn't seem to work so well.
Koans and fables for the software engineer
So you just unplug your server's network connection from the internet while you fix the damage... oh. cloud stuff needs constant internet connection? hm. well I guess that's it then. It was an honor to serve with you. BOOM!
for air gapped backups.
Which has more power: the hammer, or the anvil?
would you mind going into ebay.com & deleting my account?
Ebay refuses to close it.
At least they had backups of their cloud data in a safe place where no random asshat could just go in and waste the data. That is a code hosting company you can trust with your stuff that is for sure!
ACK
No, because it was all in Amazon. Who needs tape when you have the cloud, right?
So the stuff they had backed up from Amazon to Amazon, was still controlled by the same logins (or the ones the hacker had created).
So when he/she/they started deleting stuff, the backups also got deleted.
Sounds like a brilliant strategy, and an epic demonstration of what can go wrong with the cloud.
If you host your own stuff, you do your own backups. If you backup your cloud data to the cloud using the same stuff as the rest of it ... well, your backups are hardly secure, are they.
So unless Amazon has offsite tape backups (which I highly doubt) ... they're pretty much screwed.
I think this is about the same as backing up your hard drive to itself so you have a spare copy.
Lost at C:>. Found at C.
The guys behind Code Spaces should be issued a citation for Operating While Pwned. If you know admin access is compromised, shut it down out-of-band.
I must be a cynic but my first reaction is to think:
1 - Create cloud based system.
2 - Sell subscriptions for hundreds of $.
3 - Announce hacker attack!
4 - Profit.
If you're a hosted site with important data and your site is compromised, the first & best move is to cut the cord immediately. Contact Amazon (or whomever is hosting the data) and get all access shut down instantly and immediately, thereby ending the attacker's ability to do anything further. This will cause an outage, but at least everything is safe.
Working with Amazon, they can create a new account, give it a strong password, and begin cleaning up the mess with the new account (which the hacker will be unaware of). Now they can, at their own leisure, change passwords, administer accounts, delete crap created by the hacker, etc...Trying to outpace a professional hacker at their own game is a gamble that isn't worth it---especially if no offsite backups exist!!!
Lastly, they should be forwarding all of the email/attacker info to Amazon, Microsoft (Hotmail), and to the authorities. Whether they can be caught or not is up in the air, but odds are almost certain that this attacker has hit other sites and would eventually have different cases correlated to each other.
Safety & security of data is #1, fixing damage caused is #2, and accountability is #3. Securing the site against future attacks is part of #3---there's no reason to put the site up (or leave it up) and risk further attacks, thereby risking data loss or a security breach.
No, because it was all in Amazon. Who needs tape when you have the cloud, right?
A rule of thumb that I've heard was "It's not backed up until on at least 2 different media types, at least 2 different file systems, and stored in at least 2 different physical locations".
Normally things form clouds AFTER going up in smoke. With the 'new technology' it is the opposite.
Not providing for your own OFFLINE BACKUPS is a reckless oversight of such magnitude that I am entirely incapable of having sympathy for these asshats. We need a few examples such as these to serve as cautionary tales for those who think the Cloud is the answer to everything.
This is why git is such an effective code hosting solution. Everyone who has cloned the repository is a potential backup copy.
>Sounds like a brilliant strategy, and an epic demonstration of what can go wrong with the cloud.
No, it's just an example of what can happen to incompetent people. There's no reason to believe that these people would not have also failed to have offline backup with local servers. There was nothing to prevent them from keeping backups locally or on another cloud.
Blaming cloud computing for this is completely idiotic, and about what I expect on the dumbed down Slashdot these days.
This must be where the IRS stored backups of emails.
My password is "invalid" so when I type it wrong I get a message: "Your password is invalid."
....oh never mind.