Ask Slashdot: My Host Gave a Stranger Access To My Cloud Server, What Can I Do? 176
zzzreyes writes "I got an email from my cloud server to reset the admin password, first dismissed it as phishing, but a few emails later I found one from an admin telling me that they had given a person full access to my server and revoked it, but not before 2 domains were moved from my account. I logged into my account to review the activity and found the form the perpetrator had submitted for appointment of new primary contact and it infuriated me, given the grave omissions. I wrote a letter to the company hoping for them to rectify the harm and they offered me half month of hosting, in a sign of good faith. For weeks I've been struggling with this and figure that the best thing to do is to ask my community for advice and help, so my dear slashdotters please share with me if you have any experience with this or know of anyone that has gone through this. What can I do?"
Talk to a Lawyer (Score:5, Interesting)
It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.
Go ahead, I bet it's in there and I've never even read one of these things myself. Which, don't lose heart if it is, a lawyer can probably sacrifice a few kittens, babysit the judge's nephew for free and come out with some sort of "unreasonable burden" to parse that whole thing upon completion of the transaction. I don't know, I know that people are slowly starting to become more reasonable about massive ToS documents.
Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake. What I would do is send them another message saying you find their consolation gift unacceptable and you're moving all your business away from them. Then I would do that. Then, I would simply write up a detailed account of these events with a tl;dr of "got F'ed in the A by XYZ Inc" and just go out and drop that on every single forum and review site you can find for domain names and hosting. Why not hit the Better Business Bureau while you're at it? Then I'd let those ferment and field questions in my free time because, hey, revenge releases a special kind of endorphin, right? Then you could be done with it or you could just send them endless requests for reimbursement with the fallout being more zero star reviews and a possible visit from your non-existent lawyer. And why not? They deserve the reputation they have exhibited to you.
And whenever I go off and do something like this and I get sick of the effort, I justify everything by imagining that if I don't do this they'll just screw over god knows how many other customers. So you're doing a public service.
Re:Talk to a Lawyer (Score:4, Insightful)
Re:Talk to a Lawyer (Score:4, Informative)
That's not really true, lawyers will very often threaten a suit before filing if doing so would be advantageous. For example, if the mere existence of a lawsuit would bring to light facts that a company would rather not make public, they may be willing to offer a settlement prior to any filing. But once the suit is filed and on the public record, the damage is done, and they may decide at that point they may as well fight to the end. Now the real truth is that non lawyers who threaten to sue generally don't, and lawyers know that. Basically, if you write a letter to your colo facility telling them you're considering the merits of a lawsuit, they'll ignore it. If your lawyer writes the same letter, they'll probably take it more seriously.
Re:Talk to a Lawyer (Score:5, Informative)
Yes, exactly. On a couple of occasions a sternly worded letter from a lawyer has worked wonders for me.
My favorite was when a company who owed me for months of contract work suddenly got a case of we-can't-afford-to-pay. My lawyer wrote a letter explaining that under California law, wages had to be paid before anything else, and encouraged them to contact the very energetic state agency in charge of enforcing that if they were unclear. It was a masterpiece of subtle menace, and I got a wire transfer for the whole amount two days later. Total cost to me: a few hundred bucks. A decade later, he's still my lawyer.
Re:Talk to a Lawyer (Score:5, Interesting)
The threat of a suit has considerably more weight when it arrives on letterhead from a law office.
But all that aside... TELL US WHO THE PROVIDER WAS!
Re:Talk to a Lawyer (Score:5, Insightful)
Re: (Score:2)
the ones who actually sue don't tell you until you're being served.
Not generally true, although true for some. That's what the whole "cease-and-desist" letter thing is about.
Re: (Score:3, Funny)
Re:Talk to a Lawyer (Score:5, Informative)
When you visit a lawyer for the first time, you shouldn't be doing it with a mind to threaten a lawsuit. You're going for advice. You probably have some kind of contract that governs your relationship with the hosting provider. You might not have had a lawyer read it before you signed it; do that now. Then you can ask exactly what the hosting provider may be liable for, and where they may have effectively covered their own asses. If you do think you might want to threaten a lawsuit, it's important first to know whether you have a leg to stand on.
Empty threats to sue may sound like hot air. A letter on an attorney's letterhead that specifies the ways in which the hosting provider is in breach of contract will probably be taken seriously. And 90 percent of the time, the issue will be resolved before it ever gets to court. Nobody wants court.
Also, don't assume this process will lead to you getting absolutely everything you think you deserve. Have some sort of minimum compensation in mind that would allow you to walk away feeling like you've had some justice. Your lawyer will help you figure out this number, too. Negotiations can proceed from there.
But if you won't be happy until the hosting provider is well and thoroughly punished for what they did, you will probably walk away disappointed. Especially if they're a public company, you're not going to be able to shame them into giving you what you want. The civil legal process is there to determine what you may be owed, legally. It's not there to exact vengeance for you. In fact, you'll sleep better at night if you just let that go.
Really, I think the most important thing here is to begin the process of moving to a hosting provider that will give you better service. Everything else is secondary. In fact, I would skip the "negative publicity" part, except in private. Particularly if you're investigating legal options, trash-talking the hosting provider publicly before proceedings begin could work against you. It could even become the source of a counter-suit.
Re: (Score:3)
Re: (Score:2)
This isn't really true at all. Civil lawsuits are not about punishment, but resolving a dispute between two parties. Judges know this and don't always look kindly on a party that rushes to court without trying to negotiate with the other party an out of court solution to the problem.
Thus generally while you SHOULD call a lawyer before contacting the other party who will then contact the other party and try and negotiate a solution (like compensation, or whatever). If that fails, THEN the summons gets sent i
Re:Talk to a Lawyer (Score:5, Informative)
definitely talk to a lawyer. I want to add something to it that you may not know.... some clauses that seem to protect them in one case, can hurt them in another because of legal presedents that interpret those.
For example, one that a friend told me about.... lets say you live here in MA and lease an apartment. Well, there are some legal clauses that can be put in there to protect the landlord from legal fees. However, if they are in there, and the landlord is found to be at fault, then that same clause can be turned around to make them pay instead.
This is not obvious from the wording or just reading the contract, but is well known (to lawyers) legal precident. I forget the exact specifics but....I know a friend of mine is hunting for the last remaining copy of the second page of his rental agreement because he says it contains terms that will get him treble damages in his case with his landlord. (as a landlord myself, I can also say, if the allegations are true...that guy is a douche bag, and has even entered the rented apartment without cause, permission, or even notice... among other things....)
So yes... call a lawyer.
Re: (Score:3)
Ask your lawyer to write a scary letter with threats. This costs a lot less than $5,000, and at least will help you get a little of your own back. Not your money back, of course, but some self-respect.
Their best offer was half a month of free hosting on their dangerously insecure server? What was their second-bast offer, six week of free hosting?
Re: (Score:2, Insightful)
"Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake."
Except that you can sue for legal fees as well.
What I have done in the past & have gotten good results from is to politely decline their offer & tell them that you need your domains returned - just don't be a dick about it. If they say that they can't/won't, tell them that you will be contacting the attorney general & the BBB in regards to the matter.
Re: (Score:3)
I had an issue with my property management company. The full extent of the issue was slow to manifest and in the early stages they had been moderately helpful so I continued to hope they would act in good faith as the problem got worse. Of course they didn't (they are known scum) and would constantly tell they would call back with a response or have a workman call me about taking care of it but nobody ever called. They wanted to replace my damaged hardwood
Brilliant analysis, logical conclusion (Score:3)
What I would do is send them another message saying you find their consolation gift unacceptable and you're moving all your business away from them. Then I would do that. Then, I would simply write up a detailed account of these events with a tl;dr of "got F'ed in the A by XYZ Inc" and just go out and drop that on every single forum and review site you can find for domain names and hosting.
Looks like this is the only recourse in many of these cases. Expect this to be made illegal soon.
Re: (Score:2)
next up: ISP's to be declared 'legal persons' with special rights.
you just wait. you know this is how the modern 'legal' system works.
Re: (Score:3)
Re:Talk to a Lawyer (Score:5, Informative)
I agree that you need to talk to a lawyer, and I am coming from experience since I am a lawyer. My gut reaction is that unless you actually sustained tangible damages (such as loss of business revenue, harm to your business reputation, or having to pay out of pocket expenses to clean up the mess created by the host) you probably don't have much legal recourse against the host. However, depending on the state where you live and the state where the host is located, there may be consumer protection or privacy laws that provide for statutory penalties of some amount for acts such as this.
I practice law in Florida, and I get similar inquiries quite often and my first question is generally "what have you lost?". If all you suffered is your own disappointment and frustration with the company, it is not going to be worth the time or effort for you to keep dealing with it. Don't use the company anymore, and feel free to report them to whatever consumer protection agency you feel. But be warned that you should never exaggerate the facts, as I've also seen consumers sued by companies alleging defamation when the customer sprinkles some fantasy in with the truth. Don't put yourself on the wrong side of a lawsuit, because chances are the company will have the resources to sue you and you would be left paying out of pocket to hire an attorney to defend you.
My advice? Talk to a lawyer just to see what your options are. But don't let your emotional response govern over good sense.
legally claimable losses (Score:5, Interesting)
Re:Talk to a Lawyer (Score:4, Informative)
>>> I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property.
Which goes right out the window when the State Law says the opposite. Example: Paypal's EULA said they are not responsible for lost funds, and the judge said that's bullshit and ordered them to return all funds to customers (I got back 100-some dollars).
Plus in this case the stolen domain names were lost through incompetence by the webhost (they accepted incomplete forms). They are liable for damage caused by their inemptitude.
Re:Talk to a Lawyer (Score:4, Informative)
Also consider talking with an executive at the company. Sometimes these conversations can be fruitful.
I once had a dispute with a datacenter that had me sufficiently upset that I was ready to leave. However, I wound up receiving a $15,000 service credit, had my monthly recurring reduced by $3,000/mo, and had them agree to provide detail on how they were going to prevent the problem from recurring. All because I flew to the CEO's office and had a polite (though tense) one hour meeting.
No lawyers or anything. Just a conversation.
Re: (Score:2)
No lawyers or anything. Just a conversation.
Was the "Ultima Ratio Regum" involved or hinted at?
Re: (Score:2)
It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.
No matter what the contract says, they are still responsible and can not be negligent. If you can prove that they screwed up and gave someone else access, then they are negligent.
But to answer the OPs original question, it depends. Do you think they will do it again? Then move hosting companies. Do you want them to pay, then sue them (or at least talk to a lawyer)
Re: (Score:2)
No matter what the contract says, they are still responsible and can not be negligent. If you can prove that they screwed up and gave someone else access, then they are negligent.
This. If they were accepting forms which are obviously incomplete then they were negligent.
But to answer the OPs original question, it depends. Do you think they will do it again? Then move hosting companies.
Um, how do you know the other companies are any better? You might just be trading places with somebody who's moving from the other company to yours after they screwed up.
Re: (Score:3)
That's it. That's the truth and that's how 99% of ask Slashdot answers start and end. It's good advice.
It is usually bad advice. It will cost hundreds of dollars just to talk to a lawyer. The advice you get from the lawyer will be this: spend more money on lawyers. It will cost thousands if you want to the lawyer to actually do anything like, say, write a letter.
Instead, you should look at this unemotionally. What were your actual damages? Then take a quick look at your contract. It probably limits the host's liability severely. Unless you think you have a realistic chance of recovering tens of thou
Re: (Score:3)
Not just move on but reassess your reliance on the cloud and read all that fine print in cloud contracts, I am sure you will find all sorts of exclusions, to limit their liabilities at a complete divergence to their marketing.
So review your hosting, options taking into account the likely realistic difference between marketing and actual performance. Local hosting at a local ISP where you meet with them face to face, might cost a bit more but the real performance, reliability and trust is much more likely
Re: (Score:3)
Re: (Score:2)
Do NOT talk to a lawyer (Score:4, Interesting)
First of all, assess the damage. How much time has it cost you to rectify the situation? Have you got your 2 domains back? If you can come up with a reasonable figure for the time and any commercial damage that has been done, set that against the cost of "lawyering up".
If you asked for this amount. I would expect your service provider would interpret it as the opening round in a negotiation and eventually you'll probably end up with about 50% of what you ask for. So make sure you've included everything in whatever you think you're due. Add on to that the time it will cost you to negotiate a fair settlement.
The only time it's worth the time, trouble and potential cost of involving a third party (who will probably take as much of your time as you'd spend reaching a solution on your own and will almost certainly earn much, much more from this than you'll ever receive: possibly from yourself - and double that for the other guy's lawyer, if you lose) is if you get stonewalled, or counter-sued. If you can possibly reach an agreement without involving others, you stand to get the fastest and most satisfactory outcome. Remember, this is not a money-making opportunity.
You are in a negotiation here (Score:5, Interesting)
I don't thing you need a lawyer - yet.
You are in a negotiation. The company has made you an initial offer - the half-month free hosting - and that initial offer has a dollar value associated with it.
You have been inconvenienced, and it took time to rectify the problem. Your inconvenience and time also has a dollar value associated with it. So what is it?
I would work out the value of what you lost, add 20% for general hassle costs, and present that as a counter-offer to the company.
I would also work out the minimum value for which I would settle. It's less than getting everything I want (which you might get) but enough to counter-balance the additional hassle of hiring a lawyer and all those extra expenses.
Then negotiate. If they present an offer that is above your settle value, take it. If they don't, THEN you call the lawyer. Not only is this likely to arrive at a mutually agreeable solution without lawyers taking a cut, if you do wind up hiring a lawyer, you give him more to work with "my client made a perfectly acceptable counter offer and you refused it" etc.
Lawyers can be a useful tool, and sometimes they are necessary, but a reasonable negotiation can also work. You just need to understand your position first.
DG
Re: (Score:3)
It wouldn't hurt for you first to read up all that legalese you agreed to when you first entered into a "business contract" with these guys. I'll bet that they say somewhere in there that they are not liable for any illegal or unauthorized access/control/etc of your domains and property. And by clicking a checkbox at the end of this fifteen million word tome, you agree not to hold them liable.
No contract may void law. Negligence is outside all contracts. You don't have the right to sign away liability for neglegence. Just like you can't sign yourself into slavery. If they were negligent in allowing access, you would likely win any such lawsuit, regardless of the contents of the contract. It just results in your legal bills being higher, as you have more proof to present to nullify the contract while suing for breach of it.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
1&1 is one of the worst web hosts out there... cheap yeah... but terrible. Good luck if you need any sort of tech support!
Re: (Score:2)
Lawyers cost money, I have no idea how much money this lost you but sometimes it's not worth fronting $5,000 for a lawyer when $500 is at stake.
Sometimes a letter from a lawyer saying you will take things further is all it takes. In the UK this costs around £30 ($50 USD). I had a warranty company pay up on receiving a letter despite telling me that I was not covered when i wrote or called myself.
Tell us who it was. (Score:5, Informative)
If it was my provider, I'm leaving.
Re:Tell us who it was. (Score:5, Informative)
I'd suggest checking the submission tags; there might be a clue there.
Re:Tell us who it was. (Score:4, Interesting)
If it were my provider, I'd leave and tell all my friends and acquaintances precisely which provider it is.
This behavior is worse than inexcusable. Sure, it's a 'cheap' service but the reprecussions for this are massive to the user.
Re:Tell us who it was. (Score:5, Informative)
It was apparently Rackspace [rackspace.com], judging by the PDF document [google.com] linked in the original submission.
Re:Tell us who it was. (Score:5, Interesting)
Whoa. That puts a different light on things. The poster, who does web development, bought a domain name learning-together.ca which was used by his client Learning Together Inc. Rackspace transferred control of the domain name from the poster to Learning Together, Inc. It seems very weird indeed that the poster is trying to keep control of that domain.
Re: (Score:3, Insightful)
You don't know the business relationship there - regardless, under no circumstance short of court order does Rackspace have the right to arbitrarily grant Learning Together access to an account they do not have authorisation to access. Rackspace did bad here, however you look at it.
Re:Tell us who it was. (Score:5, Interesting)
Sure, but it makes it an understandable mistake on the part of Rackspace. And if the company gave Rackspace some documentation that the poster was buying the name on behalf of Learning Together, then the transfer may have been proper.
More importantly, though, it puts the poster in a different light. He concealed material facts in his summary, and on the face of it trying to hold on to a client's domain is shady. It makes me wonder what else he's hidden.
Re: (Score:2)
I agree that it does change the light the poster is in, but the "mistake" is in no way understandable - Learning Together should never be able to transfer a domain out of someone elses account with anything less than either explicit permission from that account holder, or a court order.
Its that simple - its not their account, and any disputes or ownership issues reside with the account owner, Rackspace have absolutely no standing here to be doing anything on that account for anyone other than the account ow
Re: (Score:2)
Well, they did it behind his back without contacting him. (Reset your password sounds like it is after the fact).
And in addition to that, they got all the details of his site: efficiency.ca
But what I find amazing is filling out NIL for account number and tax ID with a phone # of "519" and this is approved to transfer contacts and results in the release of account information?
That sounds like a phisher's dream to make it that easy. Of course the phisher wouldn't be real info in the new contact section (as lo
Re: (Score:2)
It seems very weird. One rents something when one can't afford to buy it. Domain names cost very little, so they should just own the domain outright, especially as it's the one whose name matches the legal entity. As far as I'm concerned, any web site developer that doesn't insist that the client own the domain name in a case like this is at best negligent.
But it's also the kind of thing a shady operator would do to take advantage of naive clients.
As the Lawyer response has been given... (Score:2, Informative)
Step 2 is find a different Hosting provider. There's only, what, several thousand out there!
Re:As the Lawyer response has been given... (Score:5, Insightful)
No, step 2 is to transfer all of your domains to an account with an actual registrar. Buying domains through a hosting provider is a recipe for disaster. It means that:
are all protected by a single password, managed by a single team of people, capable of making a single mistake and causing you to lose everything. Your best security is ensuring that no single point of failure can fully compromise things other than the registrar (which is bound by fairly strict rules that make such compromise less likely).
Re: (Score:3)
This. Also, use at least two registrars, one for the domain where you handle your nameservers and another for the domains that point to them. And have a backup e-mail address on file for at least the first of those two.
You have to play the "how can some moron royally screw me?" game (as you've apparently just learned).
Re: (Score:2)
Well you had to choose one at some point. The way to do that the first time is to look around until you can write up a short list of maybe four or five options. Eventually you will narrow that down to one. If you later realize that you made the wrong choice, reassess the other options on your original shortlist and pick a second choice.
Re: (Score:3)
My 2c on picking a hosting provider (speaking as a freelance web developer with a couple hundred SME websites I manage hosting for) is:
Don't place a lot of trust/money with a company you've never used, i.e If you're looking to get a virtual/dedicated server from a new company start off by hosting one website/domain with them and see how you are treated, how they come across, quality of support
Who? (Score:2)
Re:Who? (Score:5, Informative)
Re: (Score:2)
Seems fanatical support is coming back around to bite them in the ass.
Ohh - you want root access to one of our customer's server accounts? Let me bend over backwards to help you with that!
Anyone could have added that tag. (Score:5, Insightful)
I wouldn't make any decision based on that, as any user can add tags to a story.
Re: (Score:2)
Clearly you didn't, since it's in the title of one of the submenus on that front page.
Or you have a retarded definition of "every" or "link".
If you value security and your data (Score:5, Insightful)
Your provider has de-facto admitted that they messed up. These things happen. The only question is whether they would truly respond in a professional manner. If they do, and they agree to the following, do the following, and move on. Contact them, and request them to:
* Provision a new virtual host for you.
* You will copy all your existing data into your new virtual host, using your own copies of whatever you use the host for. You do have your own copies of everything, and you don't trust the host with the entirety of your data, right?
* For convenience, I think it's ok to copy some data directly from your compromised host, provided that you're comfortable with whatever verification steps you deem are necessary to certify that it hasn't been tampered with. Data, no code.
* When your migration is complete, your provider will swap in your replacement virtual host in place of the compromised one, which they'll decomission.
Of course, for the duration of your migration, your host will not charge you for the second virtual host. You might consider negotiation with your host for an additional discount, as compensation for the work you have to do as a result of their security breach. I think that free hosting for however long it takes you to migrate, that is, no charge for the new virtual host, and billing suspended for your compromised host, would be fair. If that's the two weeks they're already willing to give you, then that's that.
Re:If you value security and your data (Score:5, Insightful)
Your provider has de-facto admitted that they messed up. These things happen.
Um...not really, not if the hosting provider is doing things the right way. And that's the problem. I will elaborate...
The only question is whether they would truly respond in a professional manner. If they do, and they agree to the following, do the following, and move on. Contact them, and request them to:
* Provision a new virtual host for you.
This will not address the fact that there's clearly an issue with the underlying processes and procedures that should have prevented this in the first place. This was a *process* breakdown, not a question of architectural segregation. A new virtual host, (improperly) protected by the same procedural controls, is no more secure.
* You will copy all your existing data into your new virtual host, using your own copies of whatever you use the host for. You do have your own copies of everything, and you don't trust the host with the entirety of your data, right?
See above, about "process breakdown."
* For convenience, I think it's ok to copy some data directly from your compromised host, provided that you're comfortable with whatever verification steps you deem are necessary to certify that it hasn't been tampered with. Data, no code.
See above, again, about "process breakdown."
* When your migration is complete, your provider will swap in your replacement virtual host in place of the compromised one, which they'll decomission.
See above, about "process breakdown." I keep saying it because none of these points addresses that problem, which is the root cause of this and the source of future risk of the same nature.
Of course, for the duration of your migration, your host will not charge you for the second virtual host. You might consider negotiation with your host for an additional discount, as compensation for the work you have to do as a result of their security breach. I think that free hosting for however long it takes you to migrate, that is, no charge for the new virtual host, and billing suspended for your compromised host, would be fair. If that's the two weeks they're already willing to give you, then that's that.
The problem is that something non-technical failed here. It wasn't a buffer overflow, it wasn't a bad firewall rule, it wasn't a zero-day vulnerability. The title of the Slashdot topic is the key: "My Host Gave a Stranger Access". Unless that Host changes what they did wrong the first time, it doesn't matter which server within their control you reside on, or if you're supposed to be there all by yourself. It comes down to if they can demonstrate to you, transparently, what they did wrong and what they have done to fix it. It sounds like there's been a lack of transparency as to the breach, at least at first; that is not a good sign. Good luck, but you may have to take your business elsewhere.
Re: (Score:3)
Do you have encrypted disks that only you know the passphrase for? How do you enter the passphrase? If the answer to these isn't "yes" and "directly on console", your hosting company has access, or can get it if they want it:
If the answer to the first question is no, then they can simply boot with init=/bin/sh and change your root password.
If the answer to the second question isn't "directly on the console" they can insert an interception and grab your passphrase next time you reboot.
No computer is secure
The offered only half a month of hosting???? (Score:5, Insightful)
Seriously?
Take your business elsewhere, if they value your privacy and security that little.
Re: (Score:2)
My thoughts exactly. They could offer me free hosting for life and I'd still tell them to piss off.
Re: (Score:2)
Well... free hosting for life isn't anything to sneeze at. It's subjective of course...
But half a month? Come on!
It's like leaving your waiter a tip of exactly five cents on a $50 meal. It's just insulting.
Re: (Score:2)
I do agree with you, but...
Once upon a long time ago, I had a virtual host on a shared web hosting server. I FTP'ed my stuff onto the box, and then realised I could get /etc/passwd, which had encrypted passwords in it (shadow wasn't especially prevalent back then). I ran the file through crack and pulled a dozen passwords out. I sent the cracked file to the admins (back then they were so small the admins actually got emails to support@ rather than it going to a call tracker and call centre). I got an email
Here's what I'd do (Score:2)
1) Check your agreement with them to make sure you didn't already agree to waive their liability for any mistakes they make.
2) Sue them for loss and punitive damages.
And people wonder why I'm against the cloud. (Score:5, Informative)
As long as your data is out of your hands it is extremely vulnerable. The hosting company only cares about the money you pay them and little else. If they're hacked, too bad. If they're servers are down, too bad. if the justice department comes with a request, all your data belong to them. Host your own systems on your own property and make your own "in-house" backups. The cloud by definition is vaporware.
Re:And people wonder why I'm against the cloud. (Score:4, Insightful)
This really doesn't have anything to do with "the cloud" - its plain old hosting, and everyone needs a domain registrar in order to hold a domain. In this case the registrar fucked up and allowed access to an account they shouldn't.
Never accept anything (Score:5, Insightful)
Your second mistake may have been to accept the free hosting. It is quite possible that by accepting you have just cut yourself out of any future ability to seek redress.
Re: (Score:2)
Lawsuit or bust (Score:3)
Stop trusting other people to manage your servers. (Score:2)
I don't mean that as a flippant smart-alec remark, I mean it as real advice. You probably do have legal recourse about which you should consult a lawyer, but after its all said and done your servers are still going to be in the hands of someone else, who can do this again.
Re: (Score:2)
Domain names are *always* going to be in the hands of someone else...
Business in "Cloud" (Score:2)
I very much agree with others that said the gift as well as the act is not enough to justify staying with that service provider. I'm guessing that if it happened once, it can easily happen again. Sounds like they need to change some policies in order to protect people, and policies generally take a long time to fix.
Now that we have that out of the way, I have to ask the more meaty questions. Do you really put high risk data on servers that you don't own? Do you really trust anyone but your company with
You have few options... (Score:5, Interesting)
I used to work at a major domain name registrar before I went into business for myself. I have heard of dozens of cases like yours, and in short you are toast.
Scammers look for valuable domain names that are in vulnerable accounts that have public emails addresses on free email servers (hotmail, gmail, yahoo, sbcglobal, comcast...) and that can be registered. Or it can be an old phone number that can be used, or some simple paperwork that can be faxed in that the scammer has access to.
The registrars try to protect the domain name and send out warning emails that major account changes are occurring. If those emails are ignored and the domain names get transferred out, it is too late. It is unbelievably difficult (ICANN dispute) to reverse a transfer and force a domain name back once that transfer has finished.
You ignored the email, so unfortunately it is your own fault. Just as it would be your fault if you ignored an official notice that you are required to show up for jury duty thinking it was spam, and afterwards get fined or arrested. Just as if you ignore the car alarm going off in the parking lot as a false alarm and in fact your car was jacked does not mean the alarm company is at fault. The fact that you ignored it means that you did not take needed and necessary steps to protect your property.
You need to read the registrars terms of service and legal agreement that you agreed to. I am familiar with most of the major registrars and they all specifically cover this situation (basically that the onus is on you to protect your services). The registrars do this to protect themselves from lawyers.
The only realistic course of action is for you to register a new domain name, sad as that may be. Or pay the hostage fee to whoever took the domain name which will probably be in the thousands of dollars.
I wish you luck.
Re: (Score:3)
Or pay the hostage fee to whoever took the domain name which will probably be in the thousands of dollars.
If there's a way to pay them, wouldn't there be a way to sue them? They do seem to have falsified documents, presumably committed wire fraud, and ultimately must have stolen something of value. Are these scoundrels all outside jurisdictions where they can be touched?
Re: (Score:2)
Surprisingly, not really. Domain names are property, and domain transfers are a result of an agreement between two people on the sale of a domain name. Once that domain name has transferred it is up to the holder on whether to sell the domain, and for how much.
About a year ago BT Telecom anonymously purchased a domain name from a person that was holding the domain name for a major new service they were offering. The person later found out that he could have sold it for far more money had he known who the bu
Re: (Score:2)
So if a person wants to sell the domain name afterward, it proves nothing, and alters nothing. What a person does with there own property is completely up to them.
Except in this case they seem to have acquired it through fraud. I'm not seeing the connection with the BT example, in which the transaction is above board and more a matter of seller's remorse.
Re: (Score:2)
It seems to me that this system just invites the lawyers.
If it was easy to reverse a domain transfer that could be shown to have been fraudulent then domain stealing would be a much less lucrative business. (granted, I'm not sure how easy that system would be to implement)
Welcome to cloud computing. (Score:2)
We've been combating similar schemes in other externally originating services (ex: stealing domains) for years. Is anyone shocked that people are phishing access to cloud computing accounts?
When your resources are internal and set up properly, a bad guy has to first defeat your physical security before they can even start trying to defeat your software security. Requests for access coming from the outside are immediately suspect. But in "the cloud", *every* request is an outside request, and the service
Trademark your domains (Score:5, Informative)
It's helpful to register trademarks on your important domains, if they're unique enough. This means a quick win in a UDRP proceeding, and gives you the option of suing anyone who ended up with your domain. It's about $400 per domain.
More importantly, own your domains. If WHOIS doesn't have your name and address in "Registrant", you do not own the domain. You're just renting it from somebody. Your hosting provider should never have their name in there. This really matters when there's a dispute. Deal directly with your domain registrar. Do not deal with them through a hosting service.
"Private registration" works the same way. The "private registration" service owns the domain, and you have a contractual relationship with them, at best. See what happened when RegisterFly went bust. [wikipedia.org]
find a new host, post reviews (Score:2)
This doesn't seem difficult to me. You have a month's free hosting. That's the time window you need in order to find new hosting and make sure the transition goes smoothly.
You should also post descriptions of your experiences in relevant forums like webhostingtalk.com and hostingdiscussion.com.
An old story (Score:2)
I used to work for your host's primary competition, and while they have been bought up and chopped to pieces, their terrible approach to customer service is the stuff of legends.
The Random Reboot Lottery was an hourly occurrence, as one poorly trained data center monkey after another went swinging from rack to rack pressing all of the shiny buttons. The Random Restore Lottery was a daily thing, as the same reboot monkeys removed the hard drives from the wrong machines and replaced them with default images.
We can't help you ... (Score:2)
... if you don't give enough details like the name of the hoster, dates of events, what domains were transferred, yada, yada, yada. You know if you took this to a lawyer (the best thing to do, really) they need all this info and more. If you want us to help, we need it, too.
Re: (Score:2)
Check Your SLA (Score:3)
Let me preface this by saying I work at a company (http://www.edgewebhosting.net) that directly competes with rackspace.
Check your Service Level Agreement (SLA). They are usually not too hard to read, as they are often used as a selling point to people (that said, get a lawyer if you want to get hot and heavy with them). Usually the SLA will say something like this (which is from our SLA):
Our Guarantee: If your ability to send and receive traffic is impacted for more than 30 minutes, we will credit your account 1/30th of the monthly fees for each 30 minutes of downtime - up to one full month fees in a given billing period for the affected server(s) or service.
A month and a half of hosting under those terms is pretty comparable. That said, I would recommend switching hosts. Someone gamed their support to get access to your account. Their support mindlessly (or fanatically if you prefer) went and turned off your domain with out verifying what was going on.
Not to be reductive... (Score:2, Insightful)
...but maybe it's time to get off the fucking cloud.
Re: (Score:2, Flamebait)
Fabulous idea!
And move to .... what exactly? His own private internet, where there's no dependencies on anyone else for DNS/ domain registration and management / etc. ?
Or is there a killer opportunity involving stone tablets he should switch his business model to?
Re: (Score:2)
To a co-located, dedicated, or virtual server maybe?
If running a DNS and web server is more than you can handle you should just outsource it and leave the IT to the IT people.
my thoughts on this subject (Score:2)
1 DID YOU GET YOUR DOMAINS BACK??
2 did you lose any data??
the absolute lowest you should accept is
1 their offer
2 your domains back
3 an actual physical letter detailing how they will be preventing this from ever happening again (ie you setup some sort of secondary password and or you get a phone call before any change of that type gets processed).
4 any data lost gets restored from the last backup FOR FREE (assumes they have backups) or you add X more days to your freebie time)
other than that they have lost
I'm thinking small class action (Score:2)
Depends on the size of the company and if you can convince the lawyer to do it on his own dime. He could then subpoena customer records and inquire if anyone else has had security issues. How did the security problem happen and how could it have been prevented? No matter what the shrink wrap service licence says their are implied minimum standards and expectations. If people aren't getting what they think they are paying for then it should merit a class action.
Just this act might make it worth it to you to
"Cloud" server? (Score:3)
What the hell is a "cloud" server anyway?
Re: (Score:2)
What host? (Score:2)
What host did this?
Re: (Score:2)
YOU should have sniffed around further just to get that customer's identity and contact info. I once found a big wallet left in a grocery cart in the parking lot. Rather than take it inside to the store where minimum wage people would fondle it and possibly keep it, I rummaged around to find the name of the owner. I caller her and we met at a Subway restaurant. Anyway, after YOU move to another hosting company, be sure to let the other customer know about it.
Re: (Score:2)
Who applied the tag, and how did they know it was Rackspace? Seems like pretty sparse evidence to warrant calling someone a dumbarse.
Re:Protecting the guilty to trap the innocent? (Score:5, Informative)
The tag was applied by the submitter. See the Original submission [slashdot.org] and notice the link to the original source [google.com], which is a letter the submitter wrote to Rackspace about this incident.
Re: (Score:2)
That's very informative (sorry, I'm out of mod points). Thanks.
Re: (Score:2)
There was life before the "cloud".
I'd be surprised if when Rackspace started using the term 'cloud' they actually changed anything aside from the name of the service, most of this 'the cloud' shit is just renting a server.
Re: (Score:2)
I bet a (price per virtual server) * (servers hosted per machine) GT (price per two machines in different datacenters, peering etc).
So they also changed the price. They are doing a little more work.
Re:Co-Locate everything (Score:4, Interesting)
What's wrong with unmanaged dedicated? The provider doesn't know your password so essentially it's the same as co-locating (i.e. the provider can get into it anyway, since they have physical access but they'll have to hack it to do so).
Re: (Score:2)
Is there an SOX requirement here - is this a breach by the hosting company?
Sounds like he's in Canada, so SOX doesn't apply.
You did the "right" thing by writing a letter - email is not legal (in this sense).
I would continue the discussion with the paper documentation you've already started.
While I would say that a letter is the best thing to do, the suggestion that email doesn't have the same legal force is not necessarily true. Phone them and ask if they accept service of legal documents by email -- if they say yes, then it probably does (depending on your exact jursidiction, YMMV).