Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code Spaces data and backups deleted by hackers

codespaces.com

Post reply on HN
Print view View original

71–80 of 85 posts

Re: Code Spaces data and backups deleted by hackers

#71

Post by tzs »

jacquesm wrote: post #43
rcthompson wrote: post #42

Earlier quoted context omitted.

Probably because of the part where they say this isn't the whole story: "This took place over a 12 hour period which I have condensed into this very brief explanation, which I will elaborate on more once we have managed our customers needs."

That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, immediately alert amazon to lock the account completely? So many questions. Anyway, they'll be updating thi…

> How could this mysterious hacker have known they had no other backups?

I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled customers who leave, a few more disgruntled customers they have to placate with freebies, and making them more likely to pay next time an extortionist comes around.

I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company.

He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up.

For instance, here are some examples for 18 USC 1030(a)(5), which covers causing damage or loss on a computer via unauthorized access, assuming no other factors that increase the sentence:

       LOSS    MONTHS           FINE

       $10k       0-6    $ 1k  - 10k
       $30k      6-12    $ 2k  - 20k
       $70k     10-16    $ 3k  - 30k
      $120k     15-21    $ 4k  - 40k
      $200k     21-27    $ 5k  - 50k
      $400k     27-33    $ 6k  - 60k
     $1,000k    33-41    $ 7.5k- 75k
     $2,500k    41-51    $ 7.5k- 75k
     $7,000k    51-63    $10k - 100k
    $20,000k    63-78    $12.5k-125k
    $50,000k    78-97    $12.5k-125k
   $100,000k    97-121   $15k - 150k
   $200,000k   121-151   $17.5- 175k
   $400,000k   151-188   $17.5- 175k
   above that  188-235   $20k - 200k
Trying to cost someone a few thousand dollars worth of damage and instead killing their $10 million dollar company, for instance, changes it from 6 months tops to 5 years minimum. Ouch.

Re: Code Spaces data and backups deleted by hackers

#72

Post by jacquesm »

tzs wrote: post #71
jacquesm wrote: post #43

Earlier quoted context omitted.

That could be it. But there is a certain dissonance about this whole thing, I try to imagine myself in the same situation and the whole thing weirds me out. How could this mysterious hacker have known they had no other backups? Have they talked to LE at all at this point? Why not string the guy along, buy time, immediately alert amazon to lock the account completely? So many questions. Anyway, they'll be updating thi…

> How could this mysterious hacker have known they had no other backups? I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled c…

> I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. > He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and/or fine by moving the severity level of the offense way up.

That's plausible. It makes some sense that if you destroy something that you should be responsible for that. At the same time, even for a hacker the assumption that there would be back-ups would be a fairly logical one, though I'd hate to be in a position of fielding that defense.

Re: Code Spaces data and backups deleted by hackers

#73

Post by jacquesm »

guiambros wrote: post #65
mentat wrote: post #51

Earlier quoted context omitted.

Seriously, if your root account and all full admin accounts aren't using MFA you're just asking for it. Also if you're not using purpose specific access keys, you're just asking for it. If the first thing you do isn't calling AWS support, wow...

Couldn't agree more. Everything under a single platform, no MFA, no (real) offsite backup, and on top of that they spent 12 hours corresponding with the attacker, instead of immediately calling Amazon to ask their help to shut down everything, while they still had time? I'm sorry, but this is a succession of things not to do in terms of system operations. Probably the team never managed mission critical platforms bef…

How many companies have not yet learned that lesson? There are probably a lot of codespaces on AWS. My reasoning is that if you make it so that a developer can set up a virtual datacenter but does not have the background of actually running such an installation then you're going to have to assume that it is probably quite fragile.

Software people tend to make all kinds of assumptions about hardware that do not work out in practice.

Re: Code Spaces data and backups deleted by hackers

#75

Post by opendais »

6c6db4ab wrote: post #68
opendais wrote: post #58

Earlier quoted context omitted.

> Why not to a big disk sitting on a computer in your house? I used to do this to save the $6 and backup locally. Unfortunately, it stopped being practical once the backups hit 3-4 GB since they'd interfere with my internet access in the morning. Realistically, what I'd do, is have each founder [or just any 2 technical folk really] each setup seperate accounts at two vendors [e.g. Backupsy + Kimsufi] and have the VM…

> I used to do this to save the $6 and backup locally. Unfortunately, it stopped being practical once the backups hit 3-4 GB since they'd interfere with my internet access in the morning. 3-4 GB of data each day? I backup data from my personal laptop to digitalocean droplet ($5 month) and then during the night backup droplet (which also stores my mail and other stuff) to the disc connected to raspi in my home. Increm…

> 3-4 GB of data each day?

It is just a snapshot of the entire database.

Re: Code Spaces data and backups deleted by hackers

#76

Post by gtirloni »

jacquesm wrote: post #34
lugg wrote: post #31

Earlier quoted context omitted.

Thanks for the cache just getting to this. Edited because someone didn't like my original tone. Was a bit rushed to be honest. Few things seem off about this: - Offsite backups were also deleted, I don't think they had offsite backups, or at least backups you could legitimately say were "off site." - EC2 has two factor auth, why you wouldn't use this for your business I don't know. [1] - Corresponding with extortioni…

There is something about this whole story that feels weird, I can't name it but it is as if this isn't the whole story.

Hindsight is a bitch. Of course using 2-factor auth was the way to go, of course offsite backups have to really be "off site" (and not available to anyone with access to AWS control panel to delete), etc, etc, etc.

Now there are many "of courses" for the owners (that external people already knew, but it doesn't help their situation). It seems that for them these things weren't so obvious as they are now... the unknown unknowns.

Sad story but I'd call lessons learned for them, no news for the rest of the Internet.

Re: Code Spaces data and backups deleted by hackers

#77

Post by danielweber »

jacquesm wrote: post #72
tzs wrote: post #71

Earlier quoted context omitted.

> How could this mysterious hacker have known they had no other backups? I don't think we can infer that he knew that. It seems more likely to me that he expected the outcome of deleting all their Amazon stuff he could reach would be that they would be down for a day or two as they reconfigured everything and then restored from offsite backups, costing them overtime or comp time for their IT guys, a few disgruntled c…

> I would not at all be surprised if the extortionist is very surprised that they did not have other backups and his actions have probably killed the company. > He's probably also somewhat worried, as this probably knocks the monetary damages up enough to (1) make it much more likely that this will get some serious law enforcement attention, and (2) if he is ever caught and convicted greatly increase his sentence and…

If I throw a rock into your garage, and knock over your precariously balanced anvil onto a Lamborghini, that's 100% on me.

http://en.wikipedia.org/wiki/Eggshell_skull

Re: Code Spaces data and backups deleted by hackers

#78

Post by chiph »

notwedtm wrote: post #59
__david__ wrote: post #52

Earlier quoted context omitted.

> Where would these backups go? Why not to a big disk sitting on a computer in your house? The server doesn't push to it, the home computer pulls from the server (via a cron job or something). That way an attacked can come in from somewhere else. It doesn't have to be perfect, and it shouldn't be your only backup. But having something like that is great for catastrophes like this.

and then your house burns down, floods, is robbed.

I keep a backup of my home data at the office (encrypted volume). Plus another one at a family member's house halfway across the continent (disks are exchanged at family get-togethers)

It's not hard - you just need to do it.

Re: Code Spaces data and backups deleted by hackers

#79

Post by csixty4 »

gaadd33 wrote: post #62
twistedpair wrote: post #57

Reminds me of LiveJournal's dead harddrive induced closure. When will startups learn how it's done?

When did that happen? I was under the impression that LiveJournal was still around however it was mostly popular in Russia. Any links to that?

Definitely still around. My wife uses it daily and is part of several communities.

Re: Code Spaces data and backups deleted by hackers

#80

Post by GrinningFool »

6c6db4ab wrote: post #68
opendais wrote: post #58

Earlier quoted context omitted.

> Why not to a big disk sitting on a computer in your house? I used to do this to save the $6 and backup locally. Unfortunately, it stopped being practical once the backups hit 3-4 GB since they'd interfere with my internet access in the morning. Realistically, what I'd do, is have each founder [or just any 2 technical folk really] each setup seperate accounts at two vendors [e.g. Backupsy + Kimsufi] and have the VM…

> I used to do this to save the $6 and backup locally. Unfortunately, it stopped being practical once the backups hit 3-4 GB since they'd interfere with my internet access in the morning. 3-4 GB of data each day? I backup data from my personal laptop to digitalocean droplet ($5 month) and then during the night backup droplet (which also stores my mail and other stuff) to the disc connected to raspi in my home. Increm…

The problem with incremental backups is that once data at the source gets corrupted, you lose it in both places.

Full backups are less efficient, but significantly safer.

Post reply on HN