Forgot your password?
typodupeerror
Security

Ask Slashdot: My Host Gave a Stranger Access To My Cloud Server, What Can I Do? 176

Posted by samzenpus
from the was-that-the-wrong-thing-to-do? dept.
zzzreyes writes "I got an email from my cloud server to reset the admin password, first dismissed it as phishing, but a few emails later I found one from an admin telling me that they had given a person full access to my server and revoked it, but not before 2 domains were moved from my account. I logged into my account to review the activity and found the form the perpetrator had submitted for appointment of new primary contact and it infuriated me, given the grave omissions. I wrote a letter to the company hoping for them to rectify the harm and they offered me half month of hosting, in a sign of good faith. For weeks I've been struggling with this and figure that the best thing to do is to ask my community for advice and help, so my dear slashdotters please share with me if you have any experience with this or know of anyone that has gone through this. What can I do?"
This discussion has been archived. No new comments can be posted.

Ask Slashdot: My Host Gave a Stranger Access To My Cloud Server, What Can I Do?

Comments Filter:
  • Talk to a Lawyer (Score:5, Interesting)

    by eldavojohn (898314) * <eldavojohn.gmail@com> on Wednesday April 04, 2012 @04:37PM (#39576869) Journal
    That's it. That's the truth and that's how 99% of ask Slashdot answers start and end. It's good advice. Everything that follows hereafter is my own, uneducated, horseshit assumptions on how things (should) be.

    It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.

    Go ahead, I bet it's in there and I've never even read one of these things myself. Which, don't lose heart if it is, a lawyer can probably sacrifice a few kittens, babysit the judge's nephew for free and come out with some sort of "unreasonable burden" to parse that whole thing upon completion of the transaction. I don't know, I know that people are slowly starting to become more reasonable about massive ToS documents.

    Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake. What I would do is send them another message saying you find their consolation gift unacceptable and you're moving all your business away from them. Then I would do that. Then, I would simply write up a detailed account of these events with a tl;dr of "got F'ed in the A by XYZ Inc" and just go out and drop that on every single forum and review site you can find for domain names and hosting. Why not hit the Better Business Bureau while you're at it? Then I'd let those ferment and field questions in my free time because, hey, revenge releases a special kind of endorphin, right? Then you could be done with it or you could just send them endless requests for reimbursement with the fallout being more zero star reviews and a possible visit from your non-existent lawyer. And why not? They deserve the reputation they have exhibited to you.

    And whenever I go off and do something like this and I get sick of the effort, I justify everything by imagining that if I don't do this they'll just screw over god knows how many other customers. So you're doing a public service.
    • by Eponymous Hero (2090636) on Wednesday April 04, 2012 @04:45PM (#39577013)
      agree with all except that, in general, when someone makes threats to sue they are usually full of hot air. the ones who actually sue don't tell you until you're being served. companies know this. just spam as much negative publicity as you can and pull your business.
      • Re:Talk to a Lawyer (Score:4, Informative)

        by Anonymous Coward on Wednesday April 04, 2012 @04:50PM (#39577099)

        That's not really true, lawyers will very often threaten a suit before filing if doing so would be advantageous. For example, if the mere existence of a lawsuit would bring to light facts that a company would rather not make public, they may be willing to offer a settlement prior to any filing. But once the suit is filed and on the public record, the damage is done, and they may decide at that point they may as well fight to the end. Now the real truth is that non lawyers who threaten to sue generally don't, and lawyers know that. Basically, if you write a letter to your colo facility telling them you're considering the merits of a lawsuit, they'll ignore it. If your lawyer writes the same letter, they'll probably take it more seriously.

        • Re:Talk to a Lawyer (Score:5, Informative)

          by dubl-u (51156) * <2523987012&pota,to> on Wednesday April 04, 2012 @11:03PM (#39581051)

          Yes, exactly. On a couple of occasions a sternly worded letter from a lawyer has worked wonders for me.

          My favorite was when a company who owed me for months of contract work suddenly got a case of we-can't-afford-to-pay. My lawyer wrote a letter explaining that under California law, wages had to be paid before anything else, and encouraged them to contact the very energetic state agency in charge of enforcing that if they were unclear. It was a masterpiece of subtle menace, and I got a wire transfer for the whole amount two days later. Total cost to me: a few hundred bucks. A decade later, he's still my lawyer.

      • the ones who actually sue don't tell you until you're being served.

        Not generally true, although true for some. That's what the whole "cease-and-desist" letter thing is about.

        • Re: (Score:3, Funny)

          i'm referring to when people say, "i'm going to sue you if i don't get my way!" a cease-and-desist letter is the first step in actually getting the ball rolling in litigation -- you have to give them a chance to stop. people often send out these letters without angry fist-shaking. and some lawsuits aren't about ceasing and desisting anything. in this situation we're discussing there's nothing for the cloud host to cease. there's no ongoing bad behavior.
      • Re:Talk to a Lawyer (Score:5, Informative)

        by PCM2 (4486) on Wednesday April 04, 2012 @06:39PM (#39578889) Homepage

        When you visit a lawyer for the first time, you shouldn't be doing it with a mind to threaten a lawsuit. You're going for advice. You probably have some kind of contract that governs your relationship with the hosting provider. You might not have had a lawyer read it before you signed it; do that now. Then you can ask exactly what the hosting provider may be liable for, and where they may have effectively covered their own asses. If you do think you might want to threaten a lawsuit, it's important first to know whether you have a leg to stand on.

        Empty threats to sue may sound like hot air. A letter on an attorney's letterhead that specifies the ways in which the hosting provider is in breach of contract will probably be taken seriously. And 90 percent of the time, the issue will be resolved before it ever gets to court. Nobody wants court.

        Also, don't assume this process will lead to you getting absolutely everything you think you deserve. Have some sort of minimum compensation in mind that would allow you to walk away feeling like you've had some justice. Your lawyer will help you figure out this number, too. Negotiations can proceed from there.

        But if you won't be happy until the hosting provider is well and thoroughly punished for what they did, you will probably walk away disappointed. Especially if they're a public company, you're not going to be able to shame them into giving you what you want. The civil legal process is there to determine what you may be owed, legally. It's not there to exact vengeance for you. In fact, you'll sleep better at night if you just let that go.

        Really, I think the most important thing here is to begin the process of moving to a hosting provider that will give you better service. Everything else is secondary. In fact, I would skip the "negative publicity" part, except in private. Particularly if you're investigating legal options, trash-talking the hosting provider publicly before proceedings begin could work against you. It could even become the source of a counter-suit.

        • Also, don't assume this process will lead to you getting absolutely everything you think you deserve.

          Wrong, when a lawyer is involved, and threatening litigation, the amount you get has to cover legal fees and all the other PITA bullshit.

          Got a slight bump in the rear from a lady while at a stop light one day. No one hurt, barely any damage. I asked the insurance "adjuster" for $3500 to settle, he said no. Result: $3500 in cash for me, $3500 for the dealership body shop, and $3500 for the lawyer.

      • by sg_oneill (159032)

        This isn't really true at all. Civil lawsuits are not about punishment, but resolving a dispute between two parties. Judges know this and don't always look kindly on a party that rushes to court without trying to negotiate with the other party an out of court solution to the problem.

        Thus generally while you SHOULD call a lawyer before contacting the other party who will then contact the other party and try and negotiate a solution (like compensation, or whatever). If that fails, THEN the summons gets sent i

    • Re:Talk to a Lawyer (Score:5, Informative)

      by TheCarp (96830) <sjc&carpanet,net> on Wednesday April 04, 2012 @04:48PM (#39577051) Homepage

      definitely talk to a lawyer. I want to add something to it that you may not know.... some clauses that seem to protect them in one case, can hurt them in another because of legal presedents that interpret those.

      For example, one that a friend told me about.... lets say you live here in MA and lease an apartment. Well, there are some legal clauses that can be put in there to protect the landlord from legal fees. However, if they are in there, and the landlord is found to be at fault, then that same clause can be turned around to make them pay instead.

      This is not obvious from the wording or just reading the contract, but is well known (to lawyers) legal precident. I forget the exact specifics but....I know a friend of mine is hunting for the last remaining copy of the second page of his rental agreement because he says it contains terms that will get him treble damages in his case with his landlord. (as a landlord myself, I can also say, if the allegations are true...that guy is a douche bag, and has even entered the rented apartment without cause, permission, or even notice... among other things....)

      So yes... call a lawyer.

    • Ask your lawyer to write a scary letter with threats. This costs a lot less than $5,000, and at least will help you get a little of your own back. Not your money back, of course, but some self-respect.

      Their best offer was half a month of free hosting on their dangerously insecure server? What was their second-bast offer, six week of free hosting?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      "Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake."
      Except that you can sue for legal fees as well.

      What I have done in the past & have gotten good results from is to politely decline their offer & tell them that you need your domains returned - just don't be a dick about it. If they say that they can't/won't, tell them that you will be contacting the attorney general & the BBB in regards to the matter.

      • The letter asserting your rights really is key.

        I had an issue with my property management company. The full extent of the issue was slow to manifest and in the early stages they had been moderately helpful so I continued to hope they would act in good faith as the problem got worse. Of course they didn't (they are known scum) and would constantly tell they would call back with a response or have a workman call me about taking care of it but nobody ever called. They wanted to replace my damaged hardwood

    • What I would do is send them another message saying you find their consolation gift unacceptable and you're moving all your business away from them. Then I would do that. Then, I would simply write up a detailed account of these events with a tl;dr of "got F'ed in the A by XYZ Inc" and just go out and drop that on every single forum and review site you can find for domain names and hosting.

      Looks like this is the only recourse in many of these cases. Expect this to be made illegal soon.

      • next up: ISP's to be declared 'legal persons' with special rights.

        you just wait. you know this is how the modern 'legal' system works.

        • by Trahloc (842734)
          Just curious, but if your email account is hacked how is an ISP supposed to know if its really you or not? "Obviously wrong information" can mean almost nothing. How many people have English as their 4-5th languages online? Why should the burden of proof be on the ISP to prove you're you beyond the username and password you were given? I've caught these sort of errors and have prevented a multitude of hacked email accounts to avoid also compromising the servers within our control, but damn the governmen
    • Re:Talk to a Lawyer (Score:5, Informative)

      by Anonymous Coward on Wednesday April 04, 2012 @05:00PM (#39577307)

      I agree that you need to talk to a lawyer, and I am coming from experience since I am a lawyer. My gut reaction is that unless you actually sustained tangible damages (such as loss of business revenue, harm to your business reputation, or having to pay out of pocket expenses to clean up the mess created by the host) you probably don't have much legal recourse against the host. However, depending on the state where you live and the state where the host is located, there may be consumer protection or privacy laws that provide for statutory penalties of some amount for acts such as this.

      I practice law in Florida, and I get similar inquiries quite often and my first question is generally "what have you lost?". If all you suffered is your own disappointment and frustration with the company, it is not going to be worth the time or effort for you to keep dealing with it. Don't use the company anymore, and feel free to report them to whatever consumer protection agency you feel. But be warned that you should never exaggerate the facts, as I've also seen consumers sued by companies alleging defamation when the customer sprinkles some fantasy in with the truth. Don't put yourself on the wrong side of a lawsuit, because chances are the company will have the resources to sue you and you would be left paying out of pocket to hire an attorney to defend you.

      My advice? Talk to a lawyer just to see what your options are. But don't let your emotional response govern over good sense.

      • by dutchwhizzman (817898) on Wednesday April 04, 2012 @11:09PM (#39581085)
        Having to completely reinstall the server because of possible back doors left by the "thief". Business value of the domains stolen. These are most definitively damages that are a direct result of the fact that they let a stranger on his cloud server. Possible damages include lost revenue that can be proven by either actual cancellations and possibly statistics, monetary equivalent of lost reputation (reduced business income) and overhead costs like legal fees, time taken to sort out the incident and such. Even if you only take 8 hours to reinstall the server at a modest rate of $50/hour you are looking at $400 in damages. I doubt you'd be paying much more than that for an average cloud server for a whole year, so the settlement offer they give is nowhere near your costs and what your claim should be.
    • Re:Talk to a Lawyer (Score:4, Informative)

      by cpu6502 (1960974) on Wednesday April 04, 2012 @05:03PM (#39577353)

      >>> I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property.

      Which goes right out the window when the State Law says the opposite. Example: Paypal's EULA said they are not responsible for lost funds, and the judge said that's bullshit and ordered them to return all funds to customers (I got back 100-some dollars).

      Plus in this case the stolen domain names were lost through incompetence by the webhost (they accepted incomplete forms). They are liable for damage caused by their inemptitude.

    • Re:Talk to a Lawyer (Score:4, Informative)

      by Anonymous Coward on Wednesday April 04, 2012 @05:14PM (#39577545)

      Also consider talking with an executive at the company. Sometimes these conversations can be fruitful.

      I once had a dispute with a datacenter that had me sufficiently upset that I was ready to leave. However, I wound up receiving a $15,000 service credit, had my monthly recurring reduced by $3,000/mo, and had them agree to provide detail on how they were going to prevent the problem from recurring. All because I flew to the CEO's office and had a polite (though tense) one hour meeting.

      No lawyers or anything. Just a conversation.

      • by TheLink (130905)

        No lawyers or anything. Just a conversation.

        Was the "Ultima Ratio Regum" involved or hinted at?

    • by chrismcb (983081)

      It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.

      No matter what the contract says, they are still responsible and can not be negligent. If you can prove that they screwed up and gave someone else access, then they are negligent.
      But to answer the OPs original question, it depends. Do you think they will do it again? Then move hosting companies. Do you want them to pay, then sue them (or at least talk to a lawyer)

      • by Joce640k (829181)

        No matter what the contract says, they are still responsible and can not be negligent. If you can prove that they screwed up and gave someone else access, then they are negligent.

        This. If they were accepting forms which are obviously incomplete then they were negligent.

        But to answer the OPs original question, it depends. Do you think they will do it again? Then move hosting companies.

        Um, how do you know the other companies are any better? You might just be trading places with somebody who's moving from the other company to yours after they screwed up.

    • That's it. That's the truth and that's how 99% of ask Slashdot answers start and end. It's good advice.

      It is usually bad advice. It will cost hundreds of dollars just to talk to a lawyer. The advice you get from the lawyer will be this: spend more money on lawyers. It will cost thousands if you want to the lawyer to actually do anything like, say, write a letter.

      Instead, you should look at this unemotionally. What were your actual damages? Then take a quick look at your contract. It probably limits the host's liability severely. Unless you think you have a realistic chance of recovering tens of thou

      • by rtb61 (674572)

        Not just move on but reassess your reliance on the cloud and read all that fine print in cloud contracts, I am sure you will find all sorts of exclusions, to limit their liabilities at a complete divergence to their marketing.

        So review your hosting, options taking into account the likely realistic difference between marketing and actual performance. Local hosting at a local ISP where you meet with them face to face, might cost a bit more but the real performance, reliability and trust is much more likely

      • You can talk to many lawyers without spending a dime. When I get into a problem and need a lawyer I don't go with the first or even the fifth. I shop until I find the one with my attitude on the subject. There are a *bunch* of lawyers all with varying degrees of ineptitude/competence. Your post is a load bullshit.

    • by Sketchly (1354369)
      I suspect you'll be hearing from XYZ Inc.'s lawyers, soon.
    • by petes_PoV (912422) on Wednesday April 04, 2012 @06:11PM (#39578527)

      First of all, assess the damage. How much time has it cost you to rectify the situation? Have you got your 2 domains back? If you can come up with a reasonable figure for the time and any commercial damage that has been done, set that against the cost of "lawyering up".

      If you asked for this amount. I would expect your service provider would interpret it as the opening round in a negotiation and eventually you'll probably end up with about 50% of what you ask for. So make sure you've included everything in whatever you think you're due. Add on to that the time it will cost you to negotiate a fair settlement.

      The only time it's worth the time, trouble and potential cost of involving a third party (who will probably take as much of your time as you'd spend reaching a solution on your own and will almost certainly earn much, much more from this than you'll ever receive: possibly from yourself - and double that for the other guy's lawyer, if you lose) is if you get stonewalled, or counter-sued. If you can possibly reach an agreement without involving others, you stand to get the fastest and most satisfactory outcome. Remember, this is not a money-making opportunity.

    • by DG (989) on Wednesday April 04, 2012 @06:54PM (#39579071) Homepage Journal

      I don't thing you need a lawyer - yet.

      You are in a negotiation. The company has made you an initial offer - the half-month free hosting - and that initial offer has a dollar value associated with it.

      You have been inconvenienced, and it took time to rectify the problem. Your inconvenience and time also has a dollar value associated with it. So what is it?

      I would work out the value of what you lost, add 20% for general hassle costs, and present that as a counter-offer to the company.

      I would also work out the minimum value for which I would settle. It's less than getting everything I want (which you might get) but enough to counter-balance the additional hassle of hiring a lawyer and all those extra expenses.

      Then negotiate. If they present an offer that is above your settle value, take it. If they don't, THEN you call the lawyer. Not only is this likely to arrive at a mutually agreeable solution without lawyers taking a cut, if you do wind up hiring a lawyer, you give him more to work with "my client made a perfectly acceptable counter offer and you refused it" etc.

      Lawyers can be a useful tool, and sometimes they are necessary, but a reasonable negotiation can also work. You just need to understand your position first.

      DG

    • by AK Marc (707885)

      It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.

      No contract may void law. Negligence is outside all contracts. You don't have the right to sign away liability for neglegence. Just like you can't sign yourself into slavery. If they were negligent in allowing access, you would likely win any such lawsuit, regardless of the contents of the contract. It just results in your legal bills being higher, as you have more proof to present to nullify the contract while suing for breach of it.

    • by hairyfeet (841228)
      Small Claims court. When it isn't worth paying crazy lawyer money filing yourself in small claims court is cheap and most corps would rather just cut a check for $5k than to pay the costs of flying someone to wherever you are and dealing with it. Also small claims court judges aren't bowled over by legalese bullshit and basically just want the facts. you tell what happened, they tell their side, and most judges go by what is reasonable and I'd say handing your domains over to someone else without contacting
    • I agree. I feel this guys pain. I am not exactly sure how you can protect yourself 100% from all the domain grab scams out there. I host with 1&1 and have my domains set for PRIVATE REGISTRATION and CLIENT-TRANSFER-PROHIBITED. I feel this cuts down on phishing and bogus transfer requests. The only other thing I think might be better is to split your hosting and your DNS into two companies. For example, host your data at Rackspace, 1&1, or where-ever and host your DNS at Verisign and transfer yo
      • Ugh 1&1... I received a number of emails from them trying to transfer one of my domain names away from Dreamhost. These weren't fake/phishing emails either. Fortunately my domains at Dreamhost are locked down tight.

        1&1 is one of the worst web hosts out there... cheap yeah... but terrible. Good luck if you need any sort of tech support!
    • by Chrisq (894406)

      Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake.

      Sometimes a letter from a lawyer saying you will take things further is all it takes. In the UK this costs around £30 ($50 USD). I had a warranty company pay up on receiving a letter despite telling me that I was not covered when i wrote or called myself.

  • Tell us who it was. (Score:5, Informative)

    by characterZer0 (138196) on Wednesday April 04, 2012 @04:41PM (#39576939)

    If it was my provider, I'm leaving.

    • by Anonymous Coward on Wednesday April 04, 2012 @04:45PM (#39577015)

      I'd suggest checking the submission tags; there might be a clue there.

    • by CAIMLAS (41445) on Wednesday April 04, 2012 @05:42PM (#39578025) Homepage

      If it were my provider, I'd leave and tell all my friends and acquaintances precisely which provider it is.

      This behavior is worse than inexcusable. Sure, it's a 'cheap' service but the reprecussions for this are massive to the user.

    • by philip.paradis (2580427) on Wednesday April 04, 2012 @07:27PM (#39579489)

      It was apparently Rackspace [rackspace.com], judging by the PDF document [google.com] linked in the original submission.

      • by dubl-u (51156) * <2523987012&pota,to> on Wednesday April 04, 2012 @11:09PM (#39581091)

        Whoa. That puts a different light on things. The poster, who does web development, bought a domain name learning-together.ca which was used by his client Learning Together Inc. Rackspace transferred control of the domain name from the poster to Learning Together, Inc. It seems very weird indeed that the poster is trying to keep control of that domain.

        • Re: (Score:3, Insightful)

          You don't know the business relationship there - regardless, under no circumstance short of court order does Rackspace have the right to arbitrarily grant Learning Together access to an account they do not have authorisation to access. Rackspace did bad here, however you look at it.

          • by dubl-u (51156) * <2523987012&pota,to> on Thursday April 05, 2012 @10:04AM (#39584301)

            Sure, but it makes it an understandable mistake on the part of Rackspace. And if the company gave Rackspace some documentation that the poster was buying the name on behalf of Learning Together, then the transfer may have been proper.

            More importantly, though, it puts the poster in a different light. He concealed material facts in his summary, and on the face of it trying to hold on to a client's domain is shady. It makes me wonder what else he's hidden.

            • I agree that it does change the light the poster is in, but the "mistake" is in no way understandable - Learning Together should never be able to transfer a domain out of someone elses account with anything less than either explicit permission from that account holder, or a court order.

              Its that simple - its not their account, and any disputes or ownership issues reside with the account owner, Rackspace have absolutely no standing here to be doing anything on that account for anyone other than the account ow

        • by nprz (1210658)

          Well, they did it behind his back without contacting him. (Reset your password sounds like it is after the fact).
          And in addition to that, they got all the details of his site: efficiency.ca

          But what I find amazing is filling out NIL for account number and tax ID with a phone # of "519" and this is approved to transfer contacts and results in the release of account information?

          That sounds like a phisher's dream to make it that easy. Of course the phisher wouldn't be real info in the new contact section (as lo

  • by Anonymous Coward

    Step 2 is find a different Hosting provider. There's only, what, several thousand out there!

    • by dgatwood (11270) on Wednesday April 04, 2012 @04:56PM (#39577219) Journal

      No, step 2 is to transfer all of your domains to an account with an actual registrar. Buying domains through a hosting provider is a recipe for disaster. It means that:

      • your email address (assuming it is at that domain),
      • the contents/management of the site itself,
      • management of the domain, and
      • management of SSL certs, if any

      are all protected by a single password, managed by a single team of people, capable of making a single mistake and causing you to lose everything. Your best security is ensuring that no single point of failure can fully compromise things other than the registrar (which is bound by fairly strict rules that make such compromise less likely).

      • This. Also, use at least two registrars, one for the domain where you handle your nameservers and another for the domains that point to them. And have a backup e-mail address on file for at least the first of those two.

        You have to play the "how can some moron royally screw me?" game (as you've apparently just learned).

  • by BronsCon (927697)
    I'm curious to know which hosting provider this was.
  • by mrsam (12205) on Wednesday April 04, 2012 @04:45PM (#39577001) Homepage

    Your provider has de-facto admitted that they messed up. These things happen. The only question is whether they would truly respond in a professional manner. If they do, and they agree to the following, do the following, and move on. Contact them, and request them to:

    * Provision a new virtual host for you.

    * You will copy all your existing data into your new virtual host, using your own copies of whatever you use the host for. You do have your own copies of everything, and you don't trust the host with the entirety of your data, right?

    * For convenience, I think it's ok to copy some data directly from your compromised host, provided that you're comfortable with whatever verification steps you deem are necessary to certify that it hasn't been tampered with. Data, no code.

    * When your migration is complete, your provider will swap in your replacement virtual host in place of the compromised one, which they'll decomission.

    Of course, for the duration of your migration, your host will not charge you for the second virtual host. You might consider negotiation with your host for an additional discount, as compensation for the work you have to do as a result of their security breach. I think that free hosting for however long it takes you to migrate, that is, no charge for the new virtual host, and billing suspended for your compromised host, would be fair. If that's the two weeks they're already willing to give you, then that's that.

    • by Shoten (260439) on Wednesday April 04, 2012 @05:02PM (#39577325)

      Your provider has de-facto admitted that they messed up. These things happen.

      Um...not really, not if the hosting provider is doing things the right way. And that's the problem. I will elaborate...

      The only question is whether they would truly respond in a professional manner. If they do, and they agree to the following, do the following, and move on. Contact them, and request them to:

      * Provision a new virtual host for you.

      This will not address the fact that there's clearly an issue with the underlying processes and procedures that should have prevented this in the first place. This was a *process* breakdown, not a question of architectural segregation. A new virtual host, (improperly) protected by the same procedural controls, is no more secure.

      * You will copy all your existing data into your new virtual host, using your own copies of whatever you use the host for. You do have your own copies of everything, and you don't trust the host with the entirety of your data, right?

      See above, about "process breakdown."

      * For convenience, I think it's ok to copy some data directly from your compromised host, provided that you're comfortable with whatever verification steps you deem are necessary to certify that it hasn't been tampered with. Data, no code.

      See above, again, about "process breakdown."

      * When your migration is complete, your provider will swap in your replacement virtual host in place of the compromised one, which they'll decomission.

      See above, about "process breakdown." I keep saying it because none of these points addresses that problem, which is the root cause of this and the source of future risk of the same nature.

      Of course, for the duration of your migration, your host will not charge you for the second virtual host. You might consider negotiation with your host for an additional discount, as compensation for the work you have to do as a result of their security breach. I think that free hosting for however long it takes you to migrate, that is, no charge for the new virtual host, and billing suspended for your compromised host, would be fair. If that's the two weeks they're already willing to give you, then that's that.

      The problem is that something non-technical failed here. It wasn't a buffer overflow, it wasn't a bad firewall rule, it wasn't a zero-day vulnerability. The title of the Slashdot topic is the key: "My Host Gave a Stranger Access". Unless that Host changes what they did wrong the first time, it doesn't matter which server within their control you reside on, or if you're supposed to be there all by yourself. It comes down to if they can demonstrate to you, transparently, what they did wrong and what they have done to fix it. It sounds like there's been a lack of transparency as to the breach, at least at first; that is not a good sign. Good luck, but you may have to take your business elsewhere.

  • by mark-t (151149) <markt@@@lynx...bc...ca> on Wednesday April 04, 2012 @04:47PM (#39577039) Journal

    Seriously?

    Take your business elsewhere, if they value your privacy and security that little.

    • by MarkGriz (520778)

      My thoughts exactly. They could offer me free hosting for life and I'd still tell them to piss off.

      • by mark-t (151149)

        Well... free hosting for life isn't anything to sneeze at. It's subjective of course...

        But half a month? Come on!

        It's like leaving your waiter a tip of exactly five cents on a $50 meal. It's just insulting.

    • by coofercat (719737)

      I do agree with you, but...

      Once upon a long time ago, I had a virtual host on a shared web hosting server. I FTP'ed my stuff onto the box, and then realised I could get /etc/passwd, which had encrypted passwords in it (shadow wasn't especially prevalent back then). I ran the file through crack and pulled a dozen passwords out. I sent the cracked file to the admins (back then they were so small the admins actually got emails to support@ rather than it going to a call tracker and call centre). I got an email

  • 1) Check your agreement with them to make sure you didn't already agree to waive their liability for any mistakes they make.

    2) Sue them for loss and punitive damages.

  • by Paleolibertarian (930578) on Wednesday April 04, 2012 @04:49PM (#39577069) Journal

    As long as your data is out of your hands it is extremely vulnerable. The hosting company only cares about the money you pay them and little else. If they're hacked, too bad. If they're servers are down, too bad. if the justice department comes with a request, all your data belong to them. Host your own systems on your own property and make your own "in-house" backups. The cloud by definition is vaporware.

  • by DaveV1.0 (203135) on Wednesday April 04, 2012 @04:52PM (#39577135) Journal

    Your second mistake may have been to accept the free hosting. It is quite possible that by accepting you have just cut yourself out of any future ability to seek redress.

  • by Krakadoom (1407635) on Wednesday April 04, 2012 @04:57PM (#39577249)
    Truth is it's probably not worth it to file a suit, but if you can afford the fees and such and dont much care about the financial side of it, it's a good way to get peace of mind. If you dont want to be out of pocked, all you can do is take it as a life lesson and next time you get password reset emails, act on them. Personally I would take the "Half a month of hosting as a good faith gesture" as a slap in the face and give em hell for it.
  • I don't mean that as a flippant smart-alec remark, I mean it as real advice. You probably do have legal recourse about which you should consult a lawyer, but after its all said and done your servers are still going to be in the hands of someone else, who can do this again.

  • I very much agree with others that said the gift as well as the act is not enough to justify staying with that service provider. I'm guessing that if it happened once, it can easily happen again. Sounds like they need to change some policies in order to protect people, and policies generally take a long time to fix.

    Now that we have that out of the way, I have to ask the more meaty questions. Do you really put high risk data on servers that you don't own? Do you really trust anyone but your company with

  • by Tolvor (579446) on Wednesday April 04, 2012 @05:04PM (#39577373)

    I used to work at a major domain name registrar before I went into business for myself. I have heard of dozens of cases like yours, and in short you are toast.

    Scammers look for valuable domain names that are in vulnerable accounts that have public emails addresses on free email servers (hotmail, gmail, yahoo, sbcglobal, comcast...) and that can be registered. Or it can be an old phone number that can be used, or some simple paperwork that can be faxed in that the scammer has access to.

    The registrars try to protect the domain name and send out warning emails that major account changes are occurring. If those emails are ignored and the domain names get transferred out, it is too late. It is unbelievably difficult (ICANN dispute) to reverse a transfer and force a domain name back once that transfer has finished.

    You ignored the email, so unfortunately it is your own fault. Just as it would be your fault if you ignored an official notice that you are required to show up for jury duty thinking it was spam, and afterwards get fined or arrested. Just as if you ignore the car alarm going off in the parking lot as a false alarm and in fact your car was jacked does not mean the alarm company is at fault. The fact that you ignored it means that you did not take needed and necessary steps to protect your property.

    You need to read the registrars terms of service and legal agreement that you agreed to. I am familiar with most of the major registrars and they all specifically cover this situation (basically that the onus is on you to protect your services). The registrars do this to protect themselves from lawyers.

    The only realistic course of action is for you to register a new domain name, sad as that may be. Or pay the hostage fee to whoever took the domain name which will probably be in the thousands of dollars.

    I wish you luck.

    • Or pay the hostage fee to whoever took the domain name which will probably be in the thousands of dollars.

      If there's a way to pay them, wouldn't there be a way to sue them? They do seem to have falsified documents, presumably committed wire fraud, and ultimately must have stolen something of value. Are these scoundrels all outside jurisdictions where they can be touched?

      • by Tolvor (579446)

        Surprisingly, not really. Domain names are property, and domain transfers are a result of an agreement between two people on the sale of a domain name. Once that domain name has transferred it is up to the holder on whether to sell the domain, and for how much.

        About a year ago BT Telecom anonymously purchased a domain name from a person that was holding the domain name for a major new service they were offering. The person later found out that he could have sold it for far more money had he known who the bu

        • So if a person wants to sell the domain name afterward, it proves nothing, and alters nothing. What a person does with there own property is completely up to them.

          Except in this case they seem to have acquired it through fraud. I'm not seeing the connection with the BT example, in which the transaction is above board and more a matter of seller's remorse.

    • by quantaman (517394)

      It seems to me that this system just invites the lawyers.

      If it was easy to reverse a domain transfer that could be shown to have been fraudulent then domain stealing would be a much less lucrative business. (granted, I'm not sure how easy that system would be to implement)

  • We've been combating similar schemes in other externally originating services (ex: stealing domains) for years. Is anyone shocked that people are phishing access to cloud computing accounts?

    When your resources are internal and set up properly, a bad guy has to first defeat your physical security before they can even start trying to defeat your software security. Requests for access coming from the outside are immediately suspect. But in "the cloud", *every* request is an outside request, and the service

  • by Animats (122034) on Wednesday April 04, 2012 @05:21PM (#39577659) Homepage

    It's helpful to register trademarks on your important domains, if they're unique enough. This means a quick win in a UDRP proceeding, and gives you the option of suing anyone who ended up with your domain. It's about $400 per domain.

    More importantly, own your domains. If WHOIS doesn't have your name and address in "Registrant", you do not own the domain. You're just renting it from somebody. Your hosting provider should never have their name in there. This really matters when there's a dispute. Deal directly with your domain registrar. Do not deal with them through a hosting service.

    "Private registration" works the same way. The "private registration" service owns the domain, and you have a contractual relationship with them, at best. See what happened when RegisterFly went bust. [wikipedia.org]

  • This doesn't seem difficult to me. You have a month's free hosting. That's the time window you need in order to find new hosting and make sure the transition goes smoothly.

    You should also post descriptions of your experiences in relevant forums like webhostingtalk.com and hostingdiscussion.com.

  • I used to work for your host's primary competition, and while they have been bought up and chopped to pieces, their terrible approach to customer service is the stuff of legends.

    The Random Reboot Lottery was an hourly occurrence, as one poorly trained data center monkey after another went swinging from rack to rack pressing all of the shiny buttons. The Random Restore Lottery was a daily thing, as the same reboot monkeys removed the hard drives from the wrong machines and replaced them with default images.

  • ... if you don't give enough details like the name of the hoster, dates of events, what domains were transferred, yada, yada, yada. You know if you took this to a lawyer (the best thing to do, really) they need all this info and more. If you want us to help, we need it, too.

    • by mmcxii (1707574)
      And we need your passwords too. We won't use them for anything crooked... I swear to God.
  • by PerfectionLost (1004287) <ben@@@perfectresolution...com> on Wednesday April 04, 2012 @05:41PM (#39578017)

    Let me preface this by saying I work at a company (http://www.edgewebhosting.net) that directly competes with rackspace.

    Check your Service Level Agreement (SLA). They are usually not too hard to read, as they are often used as a selling point to people (that said, get a lawyer if you want to get hot and heavy with them). Usually the SLA will say something like this (which is from our SLA):

    Our Guarantee: If your ability to send and receive traffic is impacted for more than 30 minutes, we will credit your account 1/30th of the monthly fees for each 30 minutes of downtime - up to one full month fees in a given billing period for the affected server(s) or service.

    A month and a half of hosting under those terms is pretty comparable. That said, I would recommend switching hosts. Someone gamed their support to get access to your account. Their support mindlessly (or fanatically if you prefer) went and turned off your domain with out verifying what was going on.

  • ...but maybe it's time to get off the fucking cloud.

    • Re: (Score:2, Flamebait)

      by EricTheGreen (223110)

      Fabulous idea!

      And move to .... what exactly? His own private internet, where there's no dependencies on anyone else for DNS/ domain registration and management / etc. ?

      Or is there a killer opportunity involving stone tablets he should switch his business model to?

      • by 1s44c (552956)

        To a co-located, dedicated, or virtual server maybe?

        If running a DNS and web server is more than you can handle you should just outsource it and leave the IT to the IT people.

  • 1 DID YOU GET YOUR DOMAINS BACK??

    2 did you lose any data??

    the absolute lowest you should accept is

    1 their offer
    2 your domains back
    3 an actual physical letter detailing how they will be preventing this from ever happening again (ie you setup some sort of secondary password and or you get a phone call before any change of that type gets processed).
    4 any data lost gets restored from the last backup FOR FREE (assumes they have backups) or you add X more days to your freebie time)

    other than that they have lost

  • Depends on the size of the company and if you can convince the lawyer to do it on his own dime. He could then subpoena customer records and inquire if anyone else has had security issues. How did the security problem happen and how could it have been prevented? No matter what the shrink wrap service licence says their are implied minimum standards and expectations. If people aren't getting what they think they are paying for then it should merit a class action.

    Just this act might make it worth it to you to

  • by DeathElk (883654) on Wednesday April 04, 2012 @07:44PM (#39579679)

    What the hell is a "cloud" server anyway?

  • What host did this?

Pause for storage relocation.

Working...