Code Spaces data and backups deleted by hackers
codespaces.com
Code Spaces data and backups deleted by hackers
1–10 of 85 posts
Re: Code Spaces data and backups deleted by hackers
#2If your backups were remotely deletable from a SPOF, then you didn't have backups.
Re: Code Spaces data and backups deleted by hackers
#3That's extraordinary .. but it does drive home the distinction between "backup" and "online second copy of your data". Proper backups should be offline when not in use.
Re: Code Spaces data and backups deleted by hackers
#4Why is it possible to destroy an entire enterprise by compromising an Amazon account? Where the fuck is their 2FA? What about a cooling off period before committing changes like deleting all of your storage? Amazon's infrastructure seems to be built without essential safeguards.
Re: Code Spaces data and backups deleted by hackers
#5Saw this earlier today. That's rough. Obviously they had some problems with their architecture (backups shouldn’t be able to be deleted like that), but it's still pretty messed up. I hope they catch the guy. I won't help Code Spaces, but whoever it was deserves to be caught.
Re: Code Spaces data and backups deleted by hackers
#6Saw this earlier today. That's rough. Obviously they had some problems with their architecture (backups shouldn’t be able to be deleted like that), but it's still pretty messed up. I hope they catch the guy. I won't help Code Spaces, but whoever it was deserves to be caught.
s/I/It/
Re: Code Spaces data and backups deleted by hackers
#7Why is it possible to destroy an entire enterprise by compromising an Amazon account? Where the fuck is their 2FA? What about a cooling off period before committing changes like deleting all of your storage? Amazon's infrastructure seems to be built without essential safeguards.
> Amazon's infrastructure seems to be built without essential safeguards
Their amazon's infrastructure
Re: Code Spaces data and backups deleted by hackers
#8Why is it possible to destroy an entire enterprise by compromising an Amazon account? Where the fuck is their 2FA? What about a cooling off period before committing changes like deleting all of your storage? Amazon's infrastructure seems to be built without essential safeguards.
Amazon AWS has 2FA, clearly not used (unless it actually was an inside job).
As for the cooling off period, I'm not sure. Perhaps you can get the contents back, but it may be cost prohibitive.
Re: Code Spaces data and backups deleted by hackers
#9All I can say is this:
If you can delete it with a single control panel, it doesn't count as an offsite back. Fire the devops
Re: Code Spaces data and backups deleted by hackers
#10All I can say is this: If you can delete it with a single control panel, it doesn't count as an offsite back. Fire the devops
DevOps means different things to different people.
most people use the term to mean 'a coder who can configure apache'
this whole incident reeks of a lack of OpSec and general Ops knowledge.
Lack of offsite backups is one thing, but if you're using cloud infrastructure you never place all eggs in one basket.
your instances have to be disposable and reproducible, at the first hint of a break in my default action is to torch and rebuild.