Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#61

Post by dusted »

SoftTalker wrote: post #14

Don't pay it. Send them notice, by registered letter, that the charges are fradulent. If a credit card was charged, try to initiate a chargeback/fraud claim. Once you pay it, you lose all leverage. You're much less likely to ever get any money back. Probably consult with a lawyer. Cloud hosting charges are basically all profit for the hosting company. They didn't really lose anything except a bit of electricity. In m…

Playing the devils advocate here (though, to be honest, I am very much a hosted-on-premise kind of angry old man here)..

Allowing that is a slippery slope for a cloud host. If people can simply say "oh, someone used our credentials to do that thing that cost a lot of money" as a get-out-of-bill card..

If they were legitimately hacked, as in, the intruder did NOT simply obtain their access credentials, but actually bypassed the security system itself (hacking into the actual azure host, or exploiting a technical glitch in the azure login system) then, of course they should forgive the bill (and apologize to their customers)..

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#62

Post by nurettin »

I asked microsoft support to vaive the past two months of billing because I left open a database cluster which I created for testing purposes. They promptly replied, took me through the steps and vaived the bills.

So maybe just file a support ticket, or have your distributor file a ticket for you?

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#63

Post by qolop »

dusted wrote: post #61
SoftTalker wrote: post #14

Don't pay it. Send them notice, by registered letter, that the charges are fradulent. If a credit card was charged, try to initiate a chargeback/fraud claim. Once you pay it, you lose all leverage. You're much less likely to ever get any money back. Probably consult with a lawyer. Cloud hosting charges are basically all profit for the hosting company. They didn't really lose anything except a bit of electricity. In m…

Playing the devils advocate here (though, to be honest, I am very much a hosted-on-premise kind of angry old man here).. Allowing that is a slippery slope for a cloud host. If people can simply say "oh, someone used our credentials to do that thing that cost a lot of money" as a get-out-of-bill card.. If they were legitimately hacked, as in, the intruder did NOT simply obtain their access credentials, but actually by…

It's definitely not a slippery slope. Firstly it's a drop in the ocean for cloud providers. Secondly, there's some effort required in establishing whether it was a case of stolen credentials or not. Not everyone is going to put in that effort to lie. And finally, you're forgetting that most cloud users are enterprises and small business that have some moral compass and aren't going to lie to the cloud providers to their face.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#65

Post by igorkraw »

janosdebugs wrote: post #41
justsomehnguy wrote: post #28

Earlier quoted context omitted.

Please, demand what you can have a hard limit on spending for the service/account or just a banal pre-pay. It's amaz ing what I can have a pre-paid account for a VPS hosting in Nicaragua, yet Amazon doesn't have this as an option. /rant

What is AWS/Azure supposed to do if you run out of funds? Delete your resources? Storage costs money too, simply shutting down the services won't quite cut it. VPS consumption is relatively easy to predict, complex cloud services are not.

Ask the customer to pay collateral when enabling this for a service, then use that to pay for the data storage in the shutdown grace period, reimburse it (or count it against future use) if it was never used. You can also easily add this on all the elastic services,e.g. your price per GB simply goes up a bit for S3 in the first month, until the amount of data you have is fully in your "insurance".

Or, you know, price it in and do your own risk estimates to make this a seemless experience, but AWS got away with not offering anything, so I'm already assuming you want to be passing all the cost to the customer (heck, amazon, if you are reading this, you can even skim a little bit of the "insurance" money! )

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#66

Post by madaxe_again »

kelnos wrote: post #53
madaxe_again wrote: post #44

I’m sorry to hear this, this is a tough situation. Microsoft might, but are unlikely, to help you out. Similar situation with your bank. Neither face a legal obligation to help you, just potential bad PR if they don’t. Your best bet may be bankruptcy. It sounds terrible, but assuming you have an LLC/Ltd company, you can clear out your coffers, wind up, pay them pennies on the dollar, if anything, and start a new busi…

> Microsoft might, but are unlikely, to help you out. Is that true? I have no experience with Microsoft, but I've heard quite a few stories of Amazon crediting AWS accounts when customers write in to say their account was compromised. Or even cases when the customer themselves screwed up some permissions in a way that ended up costing an arm and a leg. Hard to believe this practice would be unique to AWS.

You hear the stories with the happy outcomes - I would wager this is selection bias at work, as I’ve seen several instances firsthand where the outcome has been that the bill stands.

It’s still worth trying, as a first resort, of course, but it isn’t something I’d count on.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#67

Post by ivanchaz »

That's unfortunate situation. It happened to me once before (though, we was using AWS that time. And, I believe the cost was smaller than the one you have right now).

What we did to recover the cost was to contact the account manager for our region at the time. So, maybe you could have better luck trying to find the particular person in linkedin. Or, have you tried opened a ticket from Azure console?

Nonetheless, I hope after everything has been settled down, you won't fire anyone (and treat it as learning opportunity)

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#68

Post by Cthulhu_ »

highwaylights wrote: post #46
NorwegianDude wrote: post #13

That really sucks and is the risk of using cloud solutions with no spending limit and a lack of monitoring. You should still have someone to keep an eye on it when using cloud solutions. And when you already have someone to keep an eye on it there's a good chance you might be better off managing the infrastructure yourself.

Not really sure how this exact scenario works but if their account was legitimately hacked couldnt the hacker just remove the caps?

In theory, yes. Which brings us to the question of liability in the case of hacking.

On the one side, if you got hacked to that degree - root account, MFA, e-mail, etc - you really fucked up, to be very blunt.

On the other, it's down to Microsoft to provide good security and protections - e.g. spending limits, with a "contact us" and mandatory waiting period if you're about to go e.g. 10x over what you normally pay.

Banks (at least here) offer you a kind of insurance; if you get hacked, they can lock your account and return you your money. Their reasoning there is that they messed up and didn't make it obivious enough that you're about to, for example, send X amount of money away. (this is one reason why cryptocurrencies will never replace banks)

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#69

Post by chrisandchris »

kelnos wrote: post #55
schnebbau wrote: post #34

Earlier quoted context omitted.

I accidentally ordered a $200 bottle of wine instead of a $20 bottle at a restaurant once, but didn't realise until after the whole bottle was gone. I was not shocked when the restaurant expected me to pay for it, because obviously I was totally responsible. Why would AWS be any different?

Because the actual cost to AWS for a customer accidentally racking up an expensive bill is minuscule compared to the cost of that bottle of wine to the restaurant. Amazon also has an interest in keeping their customers happy, and keeping usage growing. A customer who gets a refund for accidental or fraudulent usage is much more likely to remain a loyal customer, and hopefully spend more on the platform in the future.…

Everything you say can be vice-versa said and will apply too (or if it does not apply, it's a subjective IMHO).

A restaurant has an interest in keeping customers happy, and keep recurring customers growing.

I would also expect, that the average cloud user made a mistake a professional should not have made and is now trying to get out of it the easy way. I mean, what do you expect if you post your credentials to GitHub (just an assumption)? Same as if you order wine without looking at the price. Your fault.

Also, a single bottle of 200$ is minuscule compared to the monthly/yearly renting fee a restaurant needs to pay, which can be many thousands.

Long story short: IMHO it all comes down to how good one can tell that it's really a mistake and there were multiple mistakes which could hardly be avoided which lead to this issue.

Re: Ask HN: One of our Azure accounts was hacked – how to negotiate the bill?

#70

Post by justsomehnguy »

janosdebugs wrote: post #41
justsomehnguy wrote: post #28

Earlier quoted context omitted.

Please, demand what you can have a hard limit on spending for the service/account or just a banal pre-pay. It's amaz ing what I can have a pre-paid account for a VPS hosting in Nicaragua, yet Amazon doesn't have this as an option. /rant

What is AWS/Azure supposed to do if you run out of funds? Delete your resources? Storage costs money too, simply shutting down the services won't quite cut it. VPS consumption is relatively easy to predict, complex cloud services are not.

Why any VPS provider doesn't delete my VPS outright, instead nagging me for the payment?

Why any e-mail provider doesn't delete my account if the payment weren't received in time?

Why AWS/Az should outright delete my services as soon as the money on my pre-paid account hit $0?

> Storage costs money too, simply shutting down the services won't quite cut it.

Until you give AWS/Az $B in storage costs it costs nothing for them to store your measly couple of TBs of data for a month, till you sort out your money situation.

And to give you a perspective on the situation: I have a service in AWS. Every month AWS sends me tons of letters of how it can't charge me for the service, how this can lead to a service cancelling, what should immediately run and punch in a working card to the account or else.

The thing is what the cost of the service is ... $0.51/month. For $6 I could've had a year of nag-free service, for $60 I could've had a 10 years of nag-free service. I would happily thew not even $60, but $100 to AWS so I could just forget it about it, instead they spend more resources trying to charge me every month and sending me all those scary letters.

> complex cloud services are not.

There is absolutely nothing what would prevent something to alert you (or disable, if you wish so!) if your current spending is 5x or 10x of your previous month. In OP's situation this is 66x difference.

Post reply on HN