Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 81 posts

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#31

Post by poly_morphis »

sarlalian wrote: post #22

Please setup billing alerts, know what your daily spend should be, add a little for if things grow a little unexpectedly. But you should absolutely be getting alerts if your spend is out of the ordinary for > 2 hours.

Slightly unrelated, but I do this for everything involving my personal finances. All of my credit cards have mobile apps that instantly push notifications whenever they are used. My bank app sends me notifications for any withdrawal or deposit. I even have alerts for my investments. I guess I'm just adamant in knowing exactly where (and when) my money comes or goes.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#32

Post by nickcox »

Lorin wrote: post #26
bearjaws wrote: post #5

AWS would reimburse this if it was the first time. Maybe some hope for MS to do the same?

Note this is only for 'real' money - if you are under one of their service credit programs that credit is gone like the wind.

That was exactly my experience with an Azure overspend at a previous startup. The real cost was forgiven but the credits weren't.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#33

Post by ajb »

sarlalian wrote: post #22

Please setup billing alerts, know what your daily spend should be, add a little for if things grow a little unexpectedly. But you should absolutely be getting alerts if your spend is out of the ordinary for > 2 hours.

Can you even do you do that on AWS? Best I could find for the total spend is the cloudwatch EstimatedCharge metric, which only updates once a day (at least last time I checked)

Apart from that you seem to be limited to monitoring individual resources, or using some external service that enunerates everything

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#34

Post by schnebbau »

benjaminwootton wrote: post #21
bearjaws wrote: post #5

AWS would reimburse this if it was the first time. Maybe some hope for MS to do the same?

I had an incident where a SaaS product went haywire and ran up a $10k bill. I was quite shocked when AWS didn’t write it off and pursued me for the money. You can’t necessarily assume a cloud provider will have your back in these situations.

I accidentally ordered a $200 bottle of wine instead of a $20 bottle at a restaurant once, but didn't realise until after the whole bottle was gone. I was not shocked when the restaurant expected me to pay for it, because obviously I was totally responsible.

Why would AWS be any different?

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#36

Post by cmeacham98 »

ajb wrote: post #33
sarlalian wrote: post #22

Please setup billing alerts, know what your daily spend should be, add a little for if things grow a little unexpectedly. But you should absolutely be getting alerts if your spend is out of the ordinary for > 2 hours.

Can you even do you do that on AWS? Best I could find for the total spend is the cloudwatch EstimatedCharge metric, which only updates once a day (at least last time I checked) Apart from that you seem to be limited to monitoring individual resources, or using some external service that enunerates everything

It's updated only 3 times a day, but I would read this: https://docs.aws.amazon.com/cost-management/latest/userguide...

Disclaimer: I work on AWS, although nowhere near billing

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#37

Post by onion2k »

oasisbob wrote: post #18
xwolfi wrote: post #15

When that happened to us, we found an article showing Tesla got hacked the same week as us (was aws) and they got the money back, so why not us? We got the money back and fired the guy who had a jenkins opened without password, granting terminal access to anyone.

Why was that guy running Jenkins without a password?

Years ago when I actually did any devops running services without a password was common. They would configured to only be accessible using SSH from a locked down IP range. It's far more secure than password based access (if you get it right).

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#38

Post by BartjeD »

schnebbau wrote: post #34
benjaminwootton wrote: post #21

Earlier quoted context omitted.

I had an incident where a SaaS product went haywire and ran up a $10k bill. I was quite shocked when AWS didn’t write it off and pursued me for the money. You can’t necessarily assume a cloud provider will have your back in these situations.

I accidentally ordered a $200 bottle of wine instead of a $20 bottle at a restaurant once, but didn't realise until after the whole bottle was gone. I was not shocked when the restaurant expected me to pay for it, because obviously I was totally responsible. Why would AWS be any different?

... Because building and running a piece of software is a vastly more complicated process than ordering a bottle of wine and drinking it.

The way to hell is paved with well intended analogies.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#39

Post by cmeacham98 »

causi wrote: post #23
gigel82 wrote: post #20

Earlier quoted context omitted.

To play the devil's advocate, why would Azure be liable for OP's security lapse? This would've been much easier if someone stole your credit card and bought things with it (the CC company would help with the chargeback).

Because it wasn't OP who was hacked? The victim of the crime is Azure, not OP. If I have an Xbox account and someone hacks it and buys a bunch of games, it is the criminal who is deceiving Microsoft into thinking they are someone else. Microsoft trying to charge me for something someone else did would just be a second incidence of fraud. I could leave my Amazon account open on my desk and, assuming I could prove it w…

I'm not a lawyer, so this is not a legal prescription (I do not know who is legally liable in this scenario, I suspect it depends a lot on the details).

That said, it seems like for society to work as it does we need people to take some level of responsibility over their action and inaction related to account security. If I live in the world you describe all online services will be forced to make you upload a photo ID for each purchase to confirm it is you.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#40

Post by schnebbau »

BartjeD wrote: post #38
schnebbau wrote: post #34

Earlier quoted context omitted.

I accidentally ordered a $200 bottle of wine instead of a $20 bottle at a restaurant once, but didn't realise until after the whole bottle was gone. I was not shocked when the restaurant expected me to pay for it, because obviously I was totally responsible. Why would AWS be any different?

... Because building and running a piece of software is a vastly more complicated process than ordering a bottle of wine and drinking it. The way to hell is paved with well intended analogies.

The complexity of the process of causing loss to another does not absolve you from it.
Post reply on HN