11–20 of 23 posts
I'm guessing that GoGrid provisioned the server, then sent him an email with his password. After first login, he would have been prompted to change his password, but somebody got to his email before he logged in...
I'm not sure if this person's hack is related (eg an attacker has his portal password/api key/etc) or if it is indicative of vulnerabilities in GoGrid's system.
----------------------
This exact same thing happened to me! I have a crappy little single box with them and I have been reasonably happy with their service (I was originally with servepath before they got bought by GoGrid). I requested a 64-bit upgrade, which they did promptly. I was contacted by customer service to tell me the upgrade was complete and to tell me how to log in, but I had already gone to bed. The customer service rep left a VM message saying "check your customer portal account for instructions on how to log in." The next morning before I leave for work, I'm just about to log in to my fresh box when I get a call from GoGrid saying my server has been compromised, offering to let me pay for a fresh install, or I can lock it down myself immediately. I'm no security expert, but I damn well wasn't going to pay for a reinstall on a box I never logged in to. I finally managed to get them to do the reinstall for free because they had to admit the password that the customer service rep had picked after the reinstall wasn't so hot: "g0grid". Nice job, guys.
Frankly, I don't buy this at all. It is very difficult in 2011 to provision a server that is really vulnerable by default. I suspect that the person who posted this was in some other way compromised, and is blaming it on GoGrid.
I do see some responsibility on a customer securing a box as soon as it is provisioned though, unless it is a managed service.
They should ask users to provide their ssh public keys, and use them to give access to a new provisioned server locking down password-based ssh logins. That's how other players (like AWS) do.
This is basic basic basic security stuff.
So everytime they create a new container, it's got a backdoor.
With a little effort they could use ssh keys instead of passwords... They should ask users to provide their ssh public keys, and use them to give access to a new provisioned server locking down password-based ssh logins. That's how other players (like AWS) do. This is basic basic basic security stuff.
With a little effort they could use ssh keys instead of passwords... They should ask users to provide their ssh public keys, and use them to give access to a new provisioned server locking down password-based ssh logins. That's how other players (like AWS) do. This is basic basic basic security stuff.
However, one thing i don't get: Why is it that people don't log in immediately after it is ready? On Linode it only takes a few minutes to (re)install a VM, but GoGrid might be slower of course.
Below is the post I left on the thread in the link. This exact situation happened to me too. Root cause was the person who installed my OS set the root password to "g0grid". Bulletproof. ---------------------- This exact same thing happened to me! I have a crappy little single box with them and I have been reasonably happy with their service (I was originally with servepath before they got bought by GoGrid). I reques…