Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 81 posts

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#41

Post by janosdebugs »

justsomehnguy wrote: post #28
sarlalian wrote: post #22

Please setup billing alerts, know what your daily spend should be, add a little for if things grow a little unexpectedly. But you should absolutely be getting alerts if your spend is out of the ordinary for > 2 hours.

Please, demand what you can have a hard limit on spending for the service/account or just a banal pre-pay. It's amaz ing what I can have a pre-paid account for a VPS hosting in Nicaragua, yet Amazon doesn't have this as an option. /rant

What is AWS/Azure supposed to do if you run out of funds? Delete your resources? Storage costs money too, simply shutting down the services won't quite cut it. VPS consumption is relatively easy to predict, complex cloud services are not.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#42

Post by benjaminwootton »

schnebbau wrote: post #34
benjaminwootton wrote: post #21

Earlier quoted context omitted.

I had an incident where a SaaS product went haywire and ran up a $10k bill. I was quite shocked when AWS didn’t write it off and pursued me for the money. You can’t necessarily assume a cloud provider will have your back in these situations.

I accidentally ordered a $200 bottle of wine instead of a $20 bottle at a restaurant once, but didn't realise until after the whole bottle was gone. I was not shocked when the restaurant expected me to pay for it, because obviously I was totally responsible. Why would AWS be any different?

My point was not to assume that cloud providers would write off the cost of errors or security issues.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#43

Post by popotamonga »

janosdebugs wrote: post #41
justsomehnguy wrote: post #28

Earlier quoted context omitted.

Please, demand what you can have a hard limit on spending for the service/account or just a banal pre-pay. It's amaz ing what I can have a pre-paid account for a VPS hosting in Nicaragua, yet Amazon doesn't have this as an option. /rant

What is AWS/Azure supposed to do if you run out of funds? Delete your resources? Storage costs money too, simply shutting down the services won't quite cut it. VPS consumption is relatively easy to predict, complex cloud services are not.

same thing it does when you dont pay. all goes down. databases readonly mode. Eventually it all gets deleted if you dont pay for a another month or so.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#44

Post by madaxe_again »

I’m sorry to hear this, this is a tough situation.

Microsoft might, but are unlikely, to help you out.

Similar situation with your bank. Neither face a legal obligation to help you, just potential bad PR if they don’t.

Your best bet may be bankruptcy. It sounds terrible, but assuming you have an LLC/Ltd company, you can clear out your coffers, wind up, pay them pennies on the dollar, if anything, and start a new business. You may need to go through an lawyer or administrator depending on bankruptcy laws where you are.

I’ve taken a client through this, after a similar situation - they ended up with a vast bill to a supplier brought about by someone else using their credentials, and the supplier not being willing to budge. It cost about a week of time and about $2k in legal fees.

I’ve also been on the receiving end, where I presented a legitimate invoice and rather than pay the client reincorporated and kept the IP - which sucks, but Microsoft will be insured against insolvencies, so I wouldn’t feel bad about it. You’re just allowing their insurer to help everyone out.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#45

Post by benjaminwootton »

schnebbau wrote: post #40
BartjeD wrote: post #38

Earlier quoted context omitted.

... Because building and running a piece of software is a vastly more complicated process than ordering a bottle of wine and drinking it. The way to hell is paved with well intended analogies.

The complexity of the process of causing loss to another does not absolve you from it.

It certainly mitigates it. I have many years of experience with AWS and installed Databricks, an off the shelf product through their SaaS portal.

I certainly feel less responsible and more aggrieved when that situation costs me a lot of money than in the $200 wine example.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#46

Post by highwaylights »

NorwegianDude wrote: post #13

That really sucks and is the risk of using cloud solutions with no spending limit and a lack of monitoring. You should still have someone to keep an eye on it when using cloud solutions. And when you already have someone to keep an eye on it there's a good chance you might be better off managing the infrastructure yourself.

Not really sure how this exact scenario works but if their account was legitimately hacked couldnt the hacker just remove the caps?

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#47

Post by matkoniecz »

janosdebugs wrote: post #41
justsomehnguy wrote: post #28

Earlier quoted context omitted.

Please, demand what you can have a hard limit on spending for the service/account or just a banal pre-pay. It's amaz ing what I can have a pre-paid account for a VPS hosting in Nicaragua, yet Amazon doesn't have this as an option. /rant

What is AWS/Azure supposed to do if you run out of funds? Delete your resources? Storage costs money too, simply shutting down the services won't quite cut it. VPS consumption is relatively easy to predict, complex cloud services are not.

It can be configurable. For my use I would be fine with terminating all activities and use reserve funds to pay for data storage.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#48

Post by [deleted] »

xwolfi wrote: post #15

When that happened to us, we found an article showing Tesla got hacked the same week as us (was aws) and they got the money back, so why not us? We got the money back and fired the guy who had a jenkins opened without password, granting terminal access to anyone.

[deleted]

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#49

Post by imadethis »

highwaylights wrote: post #46
NorwegianDude wrote: post #13

That really sucks and is the risk of using cloud solutions with no spending limit and a lack of monitoring. You should still have someone to keep an eye on it when using cloud solutions. And when you already have someone to keep an eye on it there's a good chance you might be better off managing the infrastructure yourself.

Not really sure how this exact scenario works but if their account was legitimately hacked couldnt the hacker just remove the caps?

Removing the caps should trigger an out-of-band notification such as an email to all stakeholders, ensuring the legit admins will be notified. This should also be the case for admin removal or disabling billing alerts. I have no idea if Azure actually does this though.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#50

Post by vb-8448 »

sarlalian wrote: post #22

Please setup billing alerts, know what your daily spend should be, add a little for if things grow a little unexpectedly. But you should absolutely be getting alerts if your spend is out of the ordinary for > 2 hours.

If a hacker gets control of your account, probably the first thing he will do is disabling all checks. Does Azure(or even AWS/GCP) provide some "non-configurable" default alert?
Post reply on HN