Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rely your web startup on Rackspace Cloud? Think again

bencheng.net

Post reply on HN
Print view View original

51–60 of 83 posts

Re: Rely your web startup on Rackspace Cloud? Think again

#51

Post by goosmurf »

Post is lacking information on whether the site was actually a phishing site and who (or which entity) submitted a complaint.

I think verification of the legitimacy of a complaint should be a critical step before disabling a site, otherwise you're prone to DoS.

It would also be good to know what steps the complainant took. Did s/he try to contact Pandaform, or immediately go to Rackspace as the owner of the IP?

Without knowing whether the complaint was legitimate, and what steps Rackspace took to verify this (or not) its tough to say whether their actions were appropriate.

Re: Rely your web startup on Rackspace Cloud? Think again

#52

Post by goosmurf »

neeleshs wrote: post #49
matrix wrote: post #2

I'm thinking Rackspace might well have been in the right on this one. If the customer was in fact phishing, Rackspace was well within their rights to shut down the account. It's really up to the application creator to prevent that abuse. That said, it's good to have a reminder of the risks of outsourcing your hosting. I still think the tradeoff is worth it for experimental products where you don't want to invest too…

May be technology can help a bit here? I think the issue in this case was more about the granularity of "takedown". If there was some kind of an API contract between the infrastructure provider and the application service provider - an API that lets you shutdown a single subdomain, an email service and so on, the situation would be more tolerable.

Or even something simpler - call the account holder's phone and play a simple recorded message that says "hey, its Rackspace, we need you to deal with an urgent issue, please check your email ASAP". Cheap for Rackspace, gives the customer fair warning, and if there's no response within some reasonable time frame then shutdown the machines in question.

Re: Rely your web startup on Rackspace Cloud? Think again

#53

Post by Aegean »

We had a similar problem with another vps provider. Some php script was remotely exploited and sending spam. They disabled the VPS. Our website and email was down for 24 hours. They enabled the VPS the next day for us to look at it. What's worse I was asked to reinstall the VPS and it took me some convincing for them to enable it so I get my data from the server.

Lesson learned? I think you should never have any operations where you don't have full control. This still holds true but it was a bit ironic because to have full control I ran everything on the VPS, effectively transferring full control to the VPS provider! It was the single point of failure.

Now I will transfer each different service to a different provider. Email to rackspace, websites to a host, git services to github and so on.

Re: Rely your web startup on Rackspace Cloud? Think again

#54

Post by royuen »

nl wrote: post #26
royuen wrote: post #14

Earlier quoted context omitted.

Do you think that it is reasonable if someone creates a phishing website on heroku, and all servers on heroku got shut down by amazon in an hour?

No, and that's a strawman argument. That's like asking if it were reasonable for Level 3 to pull the plug on Rackspace if Level 3 got a phishing complaint. If Amazon got complains about Heroku then I'd certainly expect them to be investigated, and in Heroku's case I'd expect Heroku would take over and shutdown the phishing site.

exactly, same in this case. I expect Rackspace should ask pandaform to investigate the case and shutdown the phishing site. I won't expect the whole pandaform would be taken down.

Also pandaform doesn't allow use to put any script or password field in the form, which the quality of the "phishing" form is not as serious as what we thought as a normal phishing site do.

Re: Rely your web startup on Rackspace Cloud? Think again

#55

Post by [deleted] »

mtigas wrote: post #46
edwincheese wrote: post #32

Earlier quoted context omitted.

I think everyone agreed on that the service provide have to investigate and take action on any abuse claim. But what is questioning now is that is it reasonable to shutdown a suspect case of abuse without giving time for the service provider to investigate and respond to this case?

According to http://archive.nyu.edu/bitstream/2451/15020/2/Infosec+BOOK_T... “experimental studies have shown that the bulk of victim credentials are collected within 24 hours of mailing the bait messages.” Once a phishing form is “in the wild,” every minute counts . The burden is on the service (your site) to prevent or quickly act to rectify a situation, but if your provider determines that it must intervene, then…

[deleted]

Re: Rely your web startup on Rackspace Cloud? Think again

#56

Post by [deleted] »

nl wrote: post #44
edwincheese wrote: post #32

Earlier quoted context omitted.

I think everyone agreed on that the service provide have to investigate and take action on any abuse claim. But what is questioning now is that is it reasonable to shutdown a suspect case of abuse without giving time for the service provider to investigate and respond to this case?

is it reasonable to shutdown a suspect case of abuse without giving time for the service provider to investigate and respond to this case? Yes, if there are enough complaints and harm that may come from it is serious enough.

[deleted]

Re: Rely your web startup on Rackspace Cloud? Think again

#57

Post by notahacker »

royuen wrote: post #54
nl wrote: post #26

Earlier quoted context omitted.

No, and that's a strawman argument. That's like asking if it were reasonable for Level 3 to pull the plug on Rackspace if Level 3 got a phishing complaint. If Amazon got complains about Heroku then I'd certainly expect them to be investigated, and in Heroku's case I'd expect Heroku would take over and shutdown the phishing site.

exactly, same in this case. I expect Rackspace should ask pandaform to investigate the case and shutdown the phishing site. I won't expect the whole pandaform would be taken down. Also pandaform doesn't allow use to put any script or password field in the form, which the quality of the "phishing" form is not as serious as what we thought as a normal phishing site do.

In the case of Heroku, I'd expect them to be able to shut the phishing site down within the 40 minute period Rackspace apparently gave Pandaforms before shutting the whole service down themselves.

I'm sure if Pandaforms had done this (which is difficult when you're a much smaller startup than Heroku) then their server would have been left untouched.

You can argue that Heroku would have most likely got a phone call and that Pandaforms deserve the same treatment, but I don't think that they'd have been allowed to leave phishing sites up for any period of time without their servers being placed in jeopardy either.

Re: Rely your web startup on Rackspace Cloud? Think again

#58

Post by lsc »

ntoshev wrote: post #50
lsc wrote: post #16

this will happen at any responsible web host. If you are hosting phishing sites, expect to get taken down. This trickles up. if you run a hosting company, and you get enough complaints that you don't deal with, then yeah, you will get shut down or asked to leave. That said, I think especially for higher-priced services, a phone call would be nice. (Note: I don't call my customers, though this is a policy I've conside…

What do you think about granularity of filtering: do not take all your customers' servers down, just filter the offending pages/services at network level until they sort it out.

again it's a matter of cost. If you only have one IP, and say, many domains on that one IP, only one of which is a phishing site, it is a /whole lot/ of work for me (who really can only mess with things at the network level) to selectively take out one domain or one url. I mean, it can be done, but the equipment and expertise required to pull it off would drive up my costs.

Now, if I was a 'fully managed' provider that had a login on all my customer boxes, in that case, assuming the problem was a customer of a customer phishing rather than a compromised server, it would be fairly easy to log in and fix it. But that's not how I'm set up.

Re: Rely your web startup on Rackspace Cloud? Think again

#59

Post by lmz »

I wonder if this abuse monitoring service can be outsourced somehow. Pay a team of people around the world to monitor the abuse email address and hand them the kill switch for so they can respond immediately to take down one account only instead of the hosting provider taking down the whole server.

Re: Rely your web startup on Rackspace Cloud? Think again

#60

Post by chopsueyar »

goosmurf wrote: post #51

Post is lacking information on whether the site was actually a phishing site and who (or which entity) submitted a complaint. I think verification of the legitimacy of a complaint should be a critical step before disabling a site, otherwise you're prone to DoS. It would also be good to know what steps the complainant took. Did s/he try to contact Pandaform, or immediately go to Rackspace as the owner of the IP? Witho…

Their actions are inappropriate.

The majority of commentors here assume guilty until proven innocent.

In fact, the author of the article has still been unable to identify the "phishing" form. Was there even really a phishing form?

With all this anti-phishing technology built into modern browsers, why is it Rackspace's responsibility to "protect" users from "alleged" phishing sites?

For copyright, we have the DMCA (for better or worse). Perhaps we need some similar sort of due process for hosting providers or cloud providers.

Most appalling is Rackspace's lack of transparency in handling this.

Pandaform was never contacted by the complainant. The complainant only contacted Rackspace. Rackspace assumed, without investigation, the complaint was legitimate and gave the guy notice via email.

Also, the real rub, is the fact the Rackspace would terminate his account if he got a second complaint.

So, it is not necessary to have an actual phishing form on his site to have his Rackspace hosting terminated. Someone simply needs to allege this to Rackspace, and his account and data will be gone forever.

That is fanatical? Again, I cannot recommend Rackspace.

Post reply on HN