Live data from Hacker News

Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

news.ycombinator.com

81–83 of 83 posts

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#81
post #19
post #18

Earlier quoted context omitted.

I've seen AWS credit charges that people intended to make but didn't want. We have some public AMIs that include charges for our product. Twice AWS support contact us to ask if we would credit someone back on the order of $500 out of our pocket because their customer didn't realize running an AMI would incur charges. Yeah, I was pretty surprised by this, too. It seems AWS gives people one freebie, though.

Did you grant the credit? Why or why not?

We did because AWS did and we didn't want to look bad.

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#82
post #48

Anyone have tips on how to secure their Linux VPS? I just set one up and disabled SSH password login, locked down all the ports with iptables (using ufw), and enabled fail2ban. Anything else I should install or configure to make myself a little more secure? Was considering tripwire but I dunno how much a headache it would be with false positives as I change things on the server.

A very common attack vector is through installed web applications. Especially if you run wordpress with a lot of plugins installed, be sure to enable correct read/write settings for /var/www, and update your application frequently. Malicious entities runs 24/7 scans towards indexed URL's attempting to exploit various vulnerabilities, and many of the vulnerabilities allows remote code execution, upload of php files et…

I came across these two tools recently that seem interesting: http://www.rfxn.com/projects/linux-malware-detect/ https://github.com/emposha/PHP-Shell-Detector

Not installed either yet (LMD could really use some .deb packages) but could be a useful alternative to Tripwire

Re: Ask HN: My VPS got hacked and now I'm facing a massive bill. What can I do?

#83
post #10

1. Report the incident to the police. Right now. 2. Report it to the VPS provider. Explain that you've reported it to the police. Ask for their cooperation in investigating the problem. You do not have to pay. If they try to force you to pay, depending on your country, you'll probably end up in small claims court where you'll find judges are very reasonable people who usually side with the little guy. (IANAL)

I hope cyber crime police has improved their working in recent years. 5-6 years ago a Ebay seller defrauded me. I filed a complaint with all the information I had since everything is online and involved bank transactions there had to be a money trail. I never heard back from cyber crime cell. I don't know how many folks were defrauded by that person before and after the incident with me.

Doubtful. I got a call from someone about a month after my GF's iPhone was stolen. He'd bought it on eBay and asked if I'd got a new one yet - her phone gave a number to call and was activation locked.

He wanted to know so maybe I'd give the password so "he wouldn't be ripped off, too". I'll give him credit for having the balls to ask. But (as I later found out) he knew he was buying an "activation locked" iPhone.

I said a few things like how do I know you're not the thief, etc. He pointed me to the eBay listing which, sure enough even had the IMEI with two digits transposed (plausible deniability, I'm sure).

He contacted the seller and said "Tell me why I shouldn't give this phone to its rightful owner and then file a fraud complaint with eBay and get a refund?" Unsurprisingly the seller offered to take the phone back. So he sent it (I didn't care, and while I knew the insurance company was about as unlikely to care as the police were, I didn't want to do anything that might trigger insurance fraud questions - "This phone was reported stolen, unlocked using your credentials. Explain.") and got me the seller's home address.

I contacted the insurance company. They didn't care, just told me to file a police report and send them the case number.

Looked at the seller's profile, quite possibly the sketchiest thing I've ever seen.

Bunches of phones, all "activation locked, no charger". Tablets, no charger. Laptops, no accessories or charger. At least 50 or so.

Gave that info to my local PD. Their response, "We won't investigate. He probably bought it from someone and is selling them. Could have gone through a few people first."

I didn't want the original thief caught but this guy was openly selling stolen gear. Hell, the message on my GFs phone said "I don't care about stealing the phone. Will trade cash for it.".

They weren't interested. Bear in mind, this isn't someone complaining about their car at the impound lot in LA, a la Big Lebowski, this is town of about 40,000 with a well-funded PD (I work for Fire in the same town).

The urge to drive to this jokers house in the middle of the night and pour sugar in his gas tank was one I avoided, but only just.

Post reply on HN