I've been in the exact same situation with AWS ( http://cl.ly/SHOu ). It was a nerve recking couple of days but I contacted AWS support and they were extremely good. They helped me secure my machine and then cancelled the 1.4K payment they were going to take from my account. In all the whole process took 2.5 weeks and I only had to pay $15 for the I/O requests. The best thing I can recommend is to talk to your host a…
In aws, you can set up billing alerts, so they will email you if you go over X per month. It's a good idea to set that up, so at least you'll be alerted as soon as possible if you get hacked.
Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
31–40 of 83 posts
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#321. Report the incident to the police. Right now. 2. Report it to the VPS provider. Explain that you've reported it to the police. Ask for their cooperation in investigating the problem. You do not have to pay. If they try to force you to pay, depending on your country, you'll probably end up in small claims court where you'll find judges are very reasonable people who usually side with the little guy. (IANAL)
Including ALL customer support interaction , police logs, diary , journal, etc.
Judges will show favor if you have a paper trail.
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#33Earlier quoted context omitted.
Am I right in assuming that "pr0n" is some kind of 1337, 80s hackerish misspelling of "porn"?
Yes. There's some semantic information associated with the choice of that misspelling, though.
I used that intentionally to prevent the association of HN with the other form of the word. It is polite IMHO.
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#34Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#35To prevent such incidents Linode have alerts of traffic/cpu/disk thresholds. For example you can configure notification if your bandwidth utilization more than N Mbit/s in duration more than N minutes. Very useful for DDoS prevention.
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#36Earlier quoted context omitted.
There is one great reason to go to the police: it establishes a paper trail documenting that a crime was committed. It isn't necessary that the police catch the bad guys for that paper trail to be advantageous. (Examples: police reports make CC disputes and legal declarations much easier and more likely to be given weight as other than self-serving explanations of a deadbeat. It may also trigger insurance policies ei…
ok, so he should go to the police but that has nothing to do with helping HIM...
1) In dealing with the company that is billing you, a police report sends a strong, costly signal that "This is not a routine commercial transaction! A crime has been committed!" which will throw an exception in the billing process that will get caught elsewhere in the company. The accounts receivable department is scored on collecting revenue. That is, to a first approximation, the only thing they care about. The legal department, anti-abuse department, etc etc, is not scored on revenue impact.
You're much more likely to have a productive conversation with them that involves waiving the $4k than you will with Accounts Receivable. AR's calculation goes something like "We'd prefer getting $4k over getting $0." The rest of the company thinks "We'd prefer writing off an uncollected invoice -- costs us $0 -- versus spending hundreds of dollars an hour dealing with the legal process for an unbounded amount of time."
2) Assuming that European credit card providers work on the same heuristics as US ones, "I filed a police report" means their response to your chargeback will virtually invariably be "Wait, an actual criminal case? Eff that, sorry merchant, we do not get paid to litigate on your behalf. Best of luck figuring this out after we give the customer their money back." (Conversely they use police reports as a bar for treating claims of fraud seriously, for example, in the case of "family fraud." If you ever say, for example, "My wife bought that but I didn't let her?" the very next question will be "Have you filed a police report against her for stealing from you?" and if you haven't the very next thing they'll say will be "Well, work it out with her then -- the charge stands. Thxmuchbye!")
3) "Theft" is such a wonderfully useful word for dealing with insurance companies. (HNers might say "No theft happened! It was actually..." No, guys, really, theft happened.) It may be covered under your homeowner's insurance -- depends on the particulars of your policy -- and would almost certainly be covered if you had business insurance. It also may be covered under the VPS provider's insurance, in which case they may decide that rather than trying to ring water from a stone (you) that filing a claim is the quicker way to get paid. (I rather doubt, as a businessman with an insurance policy, that they'd jeopardize their future insurability over a $4k claim, because that is tiddliwinks, but risk management is exactly why that policy exists.)
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#37Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#38Stop using providers which charge a ridiculous price for bandwidth (like AWS). There are many excellent alternatives where a TB costs only a few dollars/euros.
Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?
#39This is one of many, many, many reasons why we don't generally do cost-based pricing and, when we do do cost-based pricing, the markup is absolutely phenomenal. It has to include risk premiums. As long as it do include risk premiums, you don't have to sweat the small stuff like e.g. an uncollectable $4k invoice. (n.b. Small stuff! $4k hiccups are utterly routine events and largely dealt with by processes rather than by treating them as sudden emergencies, even if they feel like that to natural humans.)