Security Flaw Hits VAserv; Head of LxLabs Found Hanged 413
Keldrin_1 writes "The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."
Well (Score:4, Insightful)
There's yer problem... (Score:1, Insightful)
Why? Why!?
Re:There's yer problem... (Score:4, Insightful)
Backup your own damn data. If you trust your webhoster to do it for you, you're a lost cause.
Can we stick to the tech? (Score:5, Insightful)
My condolences (Score:5, Insightful)
Re:Well (Score:5, Insightful)
Yea, Jesus. Someone take their job a little too seriously?
If you ever seriously think of killing yourself over your job, it's time to get a new job.
Re:Well (Score:2, Insightful)
Disrespectful (Score:5, Insightful)
Re:Well (Score:5, Insightful)
I guess there's not much to say...
takes a very different meaning to me than the moderators or you could have seen in this comment.
Hackers = murderers? (Score:2, Insightful)
I'm sure this guy was already unstable but can't help but believe that the attacks were what finally pushed him over the edge. Legally this would be difficult to prosecute as murder but morally those little script kiddies who so impressed with themselves should consider the unintended consequences of their actions. We are all responsible for our own actions (suicide) but should be equally concerned with how our actions affect others (hackers).
Re:Well (Score:5, Insightful)
If you ever seriously think of killing yourself over your job, it's time to get a new job.
Probably good advice generally, but I wonder how many of those defaulting on their mortgages due to a layoff will react positively to hearing it.
Sometimes that shitty job is all you've got.
Re:Disrespectful (Score:5, Insightful)
Sickening, but not surprising. Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check. Remove via anonymity the social cues that inhibit these instincts, and we end up with the appalling comments here.
Re:Hackers = murderers? (Score:3, Insightful)
Oh, please. They had sufficient time for a relatively simple exploit to be patched. This guy stalled them with vague non-responses and shit never got done, so milw0rm posted it publicly. That's what security folks do. It's not their fault that he decided that fixing the software he put his reputation behind wasn't worth it.
Re:Mixed feelings (Score:4, Insightful)
Re:Well (Score:3, Insightful)
I don't know if its been said yet... (Score:4, Insightful)
Brilliant Idea! (Score:2, Insightful)
Why don't you round them up, put identifying badges on them, and then try killing them yourse-
Oh wait.
Godwin's law, dammit.
Re:Well (Score:1, Insightful)
Normally I hate fuzzy continental philosophy, but this is the time to trot out the existentialism.
All that shit is meaningless. House, car, job, social standing, everything. Your family matters, your life matters. You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.
Yea, its a step. A huge change. But there could be anything on the other side of that door, things you never even knew you wanted because you were so blinded by what you had and what you thought you had to have.
Don't get blinded by the habits of your life to the point where you think your job and the lifestyle it supports is worth more than your life. The only thing constraining your choices is you, and the fear of unknown consequences.
Re:Well (Score:5, Insightful)
But if you really are /that/ stressed about your job [...]
It might not have anything to do with on-the-job stress. It seems that there were some other things going on in his life at the time. Lots of people, when their personal lives go to shit, begin to define themselves, more and more, by their jobs. When the rest of their life sucks, their job is where they are valuable, potent, skilled, respected, and needed.
If you lose that, and you begin to think that your job performance is just as terrible as your performance in the rest of your life, That's when you find people at risk for suicide; they've just had their last leg kicked out from underneath them.
For some people, a job is the only good thing in their life. Failing at that, as they perceive they've failed at every other aspect of life, is sometimes enough to drive someone over the edge. And no, a job at McDonald's won't mitigate that feeling.
Re:Disrespectful (Score:3, Insightful)
Killing yourself pretty much removes your right to a lot of sympathy. Lot of people are talking about "honor" like killing yourself is the honorable way out, but really it's not. The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.
Re:Disrespectful (Score:3, Insightful)
Re:Disrespectful (Score:2, Insightful)
respect for the dead (Score:4, Insightful)
is not appreciated by those who think they are immortal
ie, teenaged idiots
that the world is full of teenaged idiots (most of whom are not chronologically actual teenagers) should not surprise you or disappoint you
just a simple ugliness of life you need to learn to accept, like people who throw their garbage on the ground or talk loudly at movies, its another example of the tragedy of the commons
sure you could declare a high holy moral crusade against boorish insensitivity, but its like trying to stop the sun from rising and setting: a lot of people are ignorant assholes, status permanent, and even those you might actually be able to educate are quickly replaced by more morons
Re:Well (Score:5, Insightful)
Now imagine the single mom with two children. Imagine the 68 year old woman who takes care of her husband who had a stroke.
It isn't as cut and dry as "Stop being gluttonous"
Re:Depressed person with problems kills himself (Score:2, Insightful)
Don't use crappy libraries you pulled off some web forum then. Always be suspicious of third party libraries and only use the highest-quality ones.
sorry buddy, that crappy db connection class was made by some former developer who, right now is some kind of phb, and always insist you use his "wonderful" db connection class, of course i could search and use something better, but that time constraint we always have just don't let me do it, i wish i could, but working even weekends just doesn't let me improve the things the way they are
If you can't do either of these things, well, you have no business being a programmer.
again, time constraint, and the single fact i'm the only developer here(you see why i have to work weekends?), plus some IT support i also had to do, so you see, is not lazyness, there's simply no time to do better or improve the actual things
what security folks do (Score:5, Insightful)
Well, not exactly. There is a raging debate over whether this is an appropriate tactic, and this incident will go down in the security text books as an example of why the debate exists. Opposite your opinion is something like, "That's what publicity seeking sociopathic nerds, masquerading as [security folk] do."
There is a fundamental tension between wanting to know if a system you own is vulnerable to some defect, and wanting to keep the exploit code out of the hands of The Bad Guys(TM). In this case, however, it seems pretty clear that simply knowing the name of the product (not even the version) was enough, exploit code wasn't required (as it sometimes is when scanning large numbers of systems that might be at indeterminate patch levels, for example).
There are quite a few actions one could take between "notify the vendor" and "release exploit code" which appear to have been skipped. That's irresponsible, not, "what security folks do".
Frankly, I don't understand how organizations or consultants who do this kind of thing manage to stay in business. If you were a big company with a bunch of interlocking IT systems and limited resources, would you hire someone who had a track record of publishing exploit code before patches were available? Suppose this consultant found some issues, which your organization couldn't respond to as quickly as you would like? Does that consultant become a risk to you now, simply because you didn't fix something in a manner timely enough to suit them? How do you know they wouldn't publish details of your vulnerabilities, because some snot nose punk with an inflated sense of self-righteousness thought you were ignoring him?
I don't operate that way, and neither do any of the fine security consultants who work for me or with me. I work discretely with my clients until they get their problems fixed. That sometimes means doing a lot more work than *should* be required to get the attention of a vendor. However, it has never yet meant publishing exploit code prior to patch availability.
Re:Well (Score:5, Insightful)
How does a genetic predisposition for suicide propagate...?
Re:Well (Score:5, Insightful)
Until then, stfu.
Re:Well (Score:5, Insightful)
But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.
I would be glad to take a job at McDonalds or Starbucks if it only meant that I would not be able to afford a flat-screen TV... I'd be like Kevin Spacey in American Beauty... hanging out with the kids all day, flipping burgers or making frappuchinos in a no-pressure job.
However, I choose put up with my current job because I have a wife and two kids that deserve more from me.
Re:Well (Score:1, Insightful)
A man or woman has kids before they kill themselves. Any other questions, smartass?
Re:There's yer problem... (Score:3, Insightful)
Re:Well (Score:2, Insightful)
Re:Well (Score:2, Insightful)
People kill themselves after they reproduce. Not very difficult.
Re:Well (Score:5, Insightful)
Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.
Spoken like someone who hasn't had to deal with the job market in quite some time.
The economy right now is in rough shape. My son has been looking for a job for six months now with no luck. He isn't looking for anything amazing - just retail, labor, or food service, or something basic like that. Folks aren't hiring.
And your typical McDonalds job isn't going to cut it these days. Most food service/retail positions will be minimum wage, which doesn't go very far. They'll also be hourly, not salaried, so you're screwed if you get injured or sick. They'll also be part-time - your schedule will change from one week to the next so you'll not have reliable income, and there'll be absolutely no benefits.
We're not talking about whether or not you can afford a 50" plasma. We're talking about whether or not you can keep your house and/or car. Whether you'll be able to afford to feed your family. Whether you'll be able to pay the assorted bills.
We try very hard to live well within our means. We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.
The odds of me being able to find reliable employment before our savings ran out aren't good. Like I said, folks around here aren't hiring. We could sell the house, if necessary, but I don't know that anyone would buy it. There are plenty of "for sale" signs around town and I don't see them disappearing very quickly. There aren't a whole lot of luxuries we could cut back.
It's a very scary situation to be in, and we aren't even under a pile of debt. I can't imagine what it's like for some of the folks out there.
Re:Disrespectful (Score:5, Insightful)
>Killing yourself pretty much removes your right to a lot of sympathy.
Bullshit. People with mental illness deserve your sympathy. The idea that suicide was some kind of rational selfish response is stupid. Clearly, he had a lot of suffering if he felt he needed to kill himself. These people deserve our sympathy not our disdain. Hopefully, we can teach people, especially young people, that mental illness shouldnt be shameful and if they suspect they have it then they should get treated - not hide it away and have it lead to suicide like this guy.
Re:Narrow escape (Score:5, Insightful)
If I'm reading this right, the point of the web application is to manage the VMs. If it didn't have privilege to manage (or destroy in this case) the VMs, it would be pretty useless.
Re:Disrespectful (Score:5, Insightful)
The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.
I suspect it's much easier to say this when you're not the one having to travel that road. No offense to you is implied by this observation Mr SatanicPuppy, but from a smaller degree of personal experience, it is easier said than done. The depression I entered after my brother's death (sorry, no details for /.) has had some long lasting effects on me, even if it was 11 years, 7 months and 2 days, 15 hours, 30 minutes ago.
Not saying I disagree, but still, easier said than done.
indescribably sad (Score:3, Insightful)
Re:Well (Score:5, Insightful)
You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.
If you think that most job-related suicides have anything to do with material possessions, you're mistaken. Often, a person's job is the only thing in his life that is working at all. For most people, a job is more than a simple paycheck, it's a source of self-esteem, and feelings of potency, competence, and respect.
If every facet of your personal life takes a huge dump on you, you might start feeling powerless. But, if you have a job where you can feel powerful and in control, it's easy to recognize that those feelings of powerlessness are a result of those circumstances, that you are not intrinsically powerless.
But, take away that job, and the emotional support it brings, and you may just have removed the last thing standing between healthily handling life's disappointments, and believing that you are fundamentally powerless to affect change for the better, in your life.
It's very easy, at that point, to stop seeing yourself as a resilient victim of circumstance, and begin to recognize that perhaps the only common thread in all your life's problems is you. For some people, that's when the line is crossed, and suicide is contemplated. It has nothing to do with material possessions, just feelings of guilt and powerlessness.
Re:Mixed feelings (Score:5, Insightful)
But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there?
You're assuming the bolded part is true. Reading through the information on Milw0rm's own site [milw0rm.com], it appears they had an email exchange with someone at LXLabs for two weeks, then decided on their own to release the information. Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients. I hope the guys at Milw0rm get sued into oblivion over this. Their actions were completely irresponsible and directly led to millions of dollars of damage, potentially billions of dollars of damage (over 100,000 accounts were destroyed, assuming those accounts spent on $10 per month on hosting that's millions of dollars in damage to the hosting provider alone). VAServ is based in the UK and LXLabs is based in India; I have no idea what the laws are like in those countries, but let's hope Milw0rm faces criminal charges there over this. Security research is an important field and requires a certain level of trust, accountability, and responsibility for it to function properly. By releasing this information publicly without sufficient notice, Milw0rm breached those traits and deserves to suffer the consequences for doing so.
Re:Well (Score:4, Insightful)
Maybe in some sections of the country, people have to downsize from a Rolls to a Lincoln or go from their Lear Jet to chartering a plane and are hating life, but in most of America, a job loss means loss of a house, loss of basic transportation, and loss of the ability to feed one's family.
People can't just downsize and work at McDonald's. It's not about the 50 inch plasma either. It's getting the kids clothing and school supplies, keeping a homestead, and keeping basic transportation running.
The US isn't like Europe. In the majority of the nation, there just plain no other transportation other than by car. No, bikes don't work either, unless you like being buzzed by semis while trying to pedal into town on the frontage road of an interstate with no shoulder, not to mention being prey for any gangbangers. Yes, you have the BART and NYC's subway system, but for most of America, finding a bus route is a major achievement, and finding a bus route that can get someone to work on time is almost astounding. Of course, someone will chime in that people moved to the suburbs so they suffer what they may. However, most US cities, someone not extremely rich has a pretty bad choice: Raise a family up in the inner city with gunshots ringing out nightly, or buy a house in the suburbs with a reasonably safe chance to raise kids and commute to work.
So the adage that most Americans are just whining that they can only buy a smaller TV or go with a smaller SUV for their 500 pound derriere is pure BS.
Re:Narrow escape (Score:3, Insightful)
I definitely won't be putting any business VAserv's way in the future...
Well, normally, this results in a high level of focus on the problem... So, in the future, they probably won't have problems like this. On the other hand, their competitors will be too busy signing up accounts to patch their systems and any public display of patching (like special extended maint time or a new way of using their product) will make them look just as bad so of course their competitors won't focus on security, leaving them more vulnerable than VAserv...
Except their dude, whom would have focused on security in the near future, is dead now. So maybe that doesn't work too well in this case. Hmm.
Re:It may have been genetic (Score:4, Insightful)
I use the word "honor" in public, and no one laughs at me, but I don't use it to describe acts like this one. This is just as screwed up a notion of honor as the Japanese have. Killing yourself does not absolve you of anything. It does not help anyone. It is at best a gesture, and at worst simple escapism.
The honorable thing to do would have been to fix the problem in the first place, or build a new version from scratch, or shut down the project and provide a migration path. The honorable thing to do after the disaster would have been to patch the biggest holes as fast as possible while providing a migration path to another product. The thing about responsibility for negligence or idiocy is that it requires messy things like restitution, even if no one is making you do it. Suicide is ridiculously self-serving by comparison.
Tragic (Score:5, Insightful)
I've known relations who have opted for suicide, or who have been hospitalized to prevent them. None as close as immediate family, so I can't begin to understand the pain, but in my own way I can dimly see.
One thing that makes this sort of thing doubly painful is that the sorts of minds that can consider suicide a real possibility are often very very close (and sometimes the same) as the minds that are brilliant.
We talk of genius and madness being a razor's edge away from each other, not because it is poetic but because it's true. But you don't have to be a genius to be that razor's edge away from self-destruction. You only have to have a similar biochemistry and/or neurology. There are dozens of conditions linked both to creative talent and self-harm.
Of course, not all suicides are for that reason. Utter despair (which I guess is still biochemical, but it's not a permanent condition) is another reason. There are doubtless many others.
I guess this sort of intellectualizing of suicide is my own way of dealing with the pain I have, for all that it's nothing compared to that of those close to such victims. So long as I intellectualize it, I can imagine that there will someday be solutions which help such people and prevent such tragedies happening.
Re:Well (Score:5, Insightful)
The core premise of Existentialism is very simple: most people spend their entire lives lying to themselves, and living in a world of imaginary restrictions. It's herd behaviour.
If you build your self-image on something outside of your self you are giving up your right to self-determination. Other people are making your decisions, and deciding how your life is going to be. Your boss can decide, on a whim, how you get to feel about yourself.
The whole problem is that we get trapped in this societal notion of how it's supposed to be, of all the things that we have to do. You have to realize that all those obligations are things you put on yourself. There is nothing you can't walk away from.
Depressing ass philosophy, right? But its still useful. I got stuck in a bitch session with my boss a couple of weeks ago which basically boiled down to, "I'm pissed that the stuff that corporate assigned to you over my head has taken precedence over this thing I wanted you to do."
And in the middle of it, I unclipped my badge and tossed it on my desk, and looked him in the eye. And he shut his mouth, turned around and didn't bother me again for the rest of the week. He could fire me, no problem, but he feared those consequences more than I did, and he knew it.
When you define the boundaries of yourself, and you understand that your choice governs your life, and you know it profoundly, there is a freedom in that that scares the shit out of people who let their lives be defined by others.
Re:Mixed feelings (Score:5, Insightful)
Assuming milw0rm did contact the correct person/people at LXLabs
That's a huge assumption and not one I'm willing to make. However, I am willing to state, without reservation, that Milw0rm are a bunch of asshats who deserve to be sued into oblivion over their callous disregard for the safety of the customers using this software. That's really the worst part of all of this. Most of the people hurt by this had no control over the software getting fixed, had no idea there was a problem until it was too late to do anything about it, and were completely innocent of any mistakes. And yet Milw0rm doesn't care one fig about those people and just releases code that sends their lives and businesses into a tailspin. How do you defend that kind of behavior and call yourself a professional?
Re:It may have been genetic (Score:2, Insightful)
Oh, and I'm perfectly accepting of suicide when people are trying to escape pain, boredom, shame, or whatever. I just don't like seeing it confused with honor.
Re:Depressed person with problems kills himself (Score:4, Insightful)
It's enough to make you wish we were real engineers. If an engineer is working on a bridge and his supervisor orders him to use a dangerously weak cable, the engineer has both a moral and legal duty to refuse. The same principle ought to apply to software developers, especially when life and property are at stake.
Re:Well (Score:5, Insightful)
That philosophy can work for a single person, but only at a cost: you'll never be able to make binding commitments. If you want to exercise your freedom to get married, or have kids, you've accepted obligations that you can't just walk away from (or, at least, you really shouldn't). If you want to keep your freedom to risk your job, without being a complete and utter jerk, you have to pass on some things that make some other people's lives deeply meaningful.
Or, to put this another way, if you can't (or won't) choose to enter an obligation you can't walk away from, you don't have as much freedom as a person who can.
Personally, I chose to get married and make a commitment, and we chose together to have a kid. This means that I chose certain obligations. The form of the obligations is guided by societal notions, but the choice was mine in both cases. These choices do govern my life, in ways I fully accept. I'm as free as you are, aside from acknowledging that there are consequences for decisions freely made.
Shut up. (Score:1, Insightful)
Maybe you're only interested in the technical, but many /.ers are interested in the personal and social aspects of this story. You can tell, because they are discussing it. If you don't want to comment on that, don't. If you don't want to read about it, don't. People mod you insightful, but what insight have you brought to the table? You've basically walked into a conversation that you aren't interested in, and told everyone to shut up, without adding anything relevant . You must be great at parties.
Re:Well (Score:3, Insightful)
A man or woman has kids before they kill themselves.
Not at all! For genes to prosper, the do not merely have to allow for themself to transfer.
In this case, the man was 32 years. Well within reproductive range, even in a primitive ages.
If it is in the genes, it means individuals with a tendency to suicide does actually tend to generate more surviving offspring than others.
Obviously there cannot be a direct way for suicide to benefit reproduction. Thus one must look at the group as a whole. One theory could be that suicide of individuals in the face of hardship is a net benefit to the group, freeing up food and resources for the remaining survivors.
Re:Disrespectful (Score:3, Insightful)
Re:Disrespectful (Score:3, Insightful)
I just wanted you to know where I was coming from before I disagreed with you.
The funny thing about it is how people are affected differently by different levels of emotional trauma. I've known people whose whole lives were shattered by their parents going through what I'd consider to be a reasonably amicable divorce.
So trauma is weird. Some people shake it off, other people...not so much. I'm always sympathetic with people who can't take it. I get that.
I'm not really sympathetic with people who dish it out, however. I don't know if this guy has a family or not. He was pretty young, around the age I was when I had my first kid. If he did have a family, I have nothing but contempt for him. If he was having trouble getting over his family members committing suicide, then what possible fucking rationale could he have passing that on to the rest of his family?
Gotta feel bad for his fricking father: that guy had his wife and two of his kids kill themselves. Of course, who's to say that's not misplaced sympathy? The guy could be the reason they all offed themselves.
I don't know. I guess, in my head, I view suicide when you have loved ones and/or dependents to be SO prickish, that frankly, they're probably better off without him. If it were my brother/son/father, I'd be so fucking angry...Not. Even. Words. I can't imagine the level of pissed off I'd feel if my kid offed himself after something stupid like a business crash...THAT?! That is worth your life? Jesus.
Re:Well (Score:5, Insightful)
The way I saw the movie it was about:
A man in the middle of his mid-life crisis, quits his hated job and gets a job in McDonalds ...he also gets a boner about his teenage daughter's friend, but lets be honest, this is Mena Suvari (at her prime!) we are talking about!
His wife, in the middle of her mid-life crisis, gets into an affair with a coworker
His daughter, in the middle of her teenage crisis, hates them both
I really don't see Lester (the protagonist) as a role model; I for one, don't plan to quit my job. However, I can empathize with his feelings and the situation he's in.