Live data from Hacker News

Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

news.ycombinator.com

31–40 of 83 posts

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#31
post #25

I've been in the exact same situation with AWS ( http://cl.ly/SHOu ). It was a nerve recking couple of days but I contacted AWS support and they were extremely good. They helped me secure my machine and then cancelled the 1.4K payment they were going to take from my account. In all the whole process took 2.5 weeks and I only had to pay $15 for the I/O requests. The best thing I can recommend is to talk to your host a…

In aws, you can set up billing alerts, so they will email you if you go over X per month. It's a good idea to set that up, so at least you'll be alerted as soon as possible if you get hacked.

This is how you handle it. Billing alarms at the highest priority. I expect mine to fire off around the 20th of each month. I expect the second alarm to never fire.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#32
post #10

1. Report the incident to the police. Right now. 2. Report it to the VPS provider. Explain that you've reported it to the police. Ask for their cooperation in investigating the problem. You do not have to pay. If they try to force you to pay, depending on your country, you'll probably end up in small claims court where you'll find judges are very reasonable people who usually side with the little guy. (IANAL)

MAKE SURE you file a police report , and are diligent in recording and logging everything and have a long paper trail.

Including ALL customer support interaction , police logs, diary , journal, etc.

Judges will show favor if you have a paper trail.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#33

Earlier quoted context omitted.

Am I right in assuming that "pr0n" is some kind of 1337, 80s hackerish misspelling of "porn"?

Yes. There's some semantic information associated with the choice of that misspelling, though.

I assume that was a pr0n whinger?

I used that intentionally to prevent the association of HN with the other form of the word. It is polite IMHO.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#34
PSA: Set up billing alerts! You should always have a notification sent to you when your monthly bill exceeds one or more dollar amounts. For example, if you're using AWS, Amazon CloudWatch lets you set an alarm on a billing metric to notify you automatically.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#35
post #21

To prevent such incidents Linode have alerts of traffic/cpu/disk thresholds. For example you can configure notification if your bandwidth utilization more than N Mbit/s in duration more than N minutes. Very useful for DDoS prevention.

Make sure you tune those alerts appropriately and know when your systems should be doing things that will trip them. We've had a couple of boxes that regularly trip cpu warnings during normal operation, but only inside specific time windows. Knowing what's not normal is vitally important with this stuff.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#36
post #17
post #14

Earlier quoted context omitted.

There is one great reason to go to the police: it establishes a paper trail documenting that a crime was committed. It isn't necessary that the police catch the bad guys for that paper trail to be advantageous. (Examples: police reports make CC disputes and legal declarations much easier and more likely to be given weight as other than self-serving explanations of a deadbeat. It may also trigger insurance policies ei…

ok, so he should go to the police but that has nothing to do with helping HIM...

Sorry for being pretty brief earlier, as I was on a cell phone. Here's how a police report can help him, in a few ways:

1) In dealing with the company that is billing you, a police report sends a strong, costly signal that "This is not a routine commercial transaction! A crime has been committed!" which will throw an exception in the billing process that will get caught elsewhere in the company. The accounts receivable department is scored on collecting revenue. That is, to a first approximation, the only thing they care about. The legal department, anti-abuse department, etc etc, is not scored on revenue impact.

You're much more likely to have a productive conversation with them that involves waiving the $4k than you will with Accounts Receivable. AR's calculation goes something like "We'd prefer getting $4k over getting $0." The rest of the company thinks "We'd prefer writing off an uncollected invoice -- costs us $0 -- versus spending hundreds of dollars an hour dealing with the legal process for an unbounded amount of time."

2) Assuming that European credit card providers work on the same heuristics as US ones, "I filed a police report" means their response to your chargeback will virtually invariably be "Wait, an actual criminal case? Eff that, sorry merchant, we do not get paid to litigate on your behalf. Best of luck figuring this out after we give the customer their money back." (Conversely they use police reports as a bar for treating claims of fraud seriously, for example, in the case of "family fraud." If you ever say, for example, "My wife bought that but I didn't let her?" the very next question will be "Have you filed a police report against her for stealing from you?" and if you haven't the very next thing they'll say will be "Well, work it out with her then -- the charge stands. Thxmuchbye!")

3) "Theft" is such a wonderfully useful word for dealing with insurance companies. (HNers might say "No theft happened! It was actually..." No, guys, really, theft happened.) It may be covered under your homeowner's insurance -- depends on the particulars of your policy -- and would almost certainly be covered if you had business insurance. It also may be covered under the VPS provider's insurance, in which case they may decide that rather than trying to ring water from a stone (you) that filing a claim is the quicker way to get paid. (I rather doubt, as a businessman with an insurance policy, that they'd jeopardize their future insurability over a $4k claim, because that is tiddliwinks, but risk management is exactly why that policy exists.)

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#39
Incidentally, since many HNers probably come at this from a mental model of "Anything which appears on an invoice is non-negotiable and simply must be paid": a B2B service provider which collects payment after services are rendered is knowingly taking on credit risk and has already priced non-collectability of some accounts into their services. You may be overestimating how much drama is required for someone at their company to say "Wow, really? OK, sorry about that. I'll write it off."

This is one of many, many, many reasons why we don't generally do cost-based pricing and, when we do do cost-based pricing, the markup is absolutely phenomenal. It has to include risk premiums. As long as it do include risk premiums, you don't have to sweat the small stuff like e.g. an uncollectable $4k invoice. (n.b. Small stuff! $4k hiccups are utterly routine events and largely dealt with by processes rather than by treating them as sudden emergencies, even if they feel like that to natural humans.)

Post reply on HN