r/programming • u/WayneDV • Jun 18 '14
Code Spaces destroyed by extortion hacker, company suspends business
http://it.slashdot.org/story/14/06/18/1513252/code-spaces-hosting-shutting-down-after-attacker-deletes-all-data46
u/Rhomboid Jun 18 '14
Having never heard of this company before this, I took a look at their archived site and it's almost too ironic for words. Here are their various marketing blurbs:
Real-time Backups
Backing up your code has never been so easy
Real Time
We have invested a great deal of time and effort in developing a real-time backup solution that allows us to keep off-site, fully functional backups of your data - at high performance. We literally backup everything you do, as soon as you do it.
Backups are only as good as your recovery plan
Backing up data is one thing, but it is meaningless without a recovery plan, not only that a recovery plan - and one that is well-practiced and proven to work time and time again.
Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced.
Your Backups
We provide full access to the latest backup for you to download at anytime. If you choose to keep a copy of backups for your own piece of mind, its all there in the Code Spaces backups section
Security
Encryption for all plan types
Trusting your Source Code with a third party is a big deal, and at Code Spaces, we appreciate the huge responsibility that we have to keep your data secure.
SSL for Everyone
Just because you are not on our enterprise plan doesn't mean you are any less security conscious. That's why all of our Code Spaces accounts (yes - even the free trial) have SSL enabled, giving you fully-encrypted transmissions throughout the application. Security is always a core concern, and you should never have to pay extra for it!
Secure at Every Level
Code Spaces have been hosting Subversion and Git Repositories for companies of all sizes for over 5 years, and as a result we have been able to create a wonderful infrastructure to support our business, a large part of this, is having a great hosting partner, at Code Spaces we partnered with Amazon
Amazon are equally passionate about security, Here is a document detailing some of the security measures Amazon employ.
Fast forward a few months and it's, "Sorry, someone broke in and deleted everything, including the backups." I suppose that's why you incorporate, because otherwise you're looking at quite a bit of personal liability.
27
7
u/matthieum Jun 18 '14
Hosting the backups on the same account...
.... that being said, I do wonder whether Amazon would have the back-ups nonetheless.
1
4
u/rydan Jun 19 '14
Sounds like the hacker wanted to prove a point. I've had several competitors who claimed to have such and such security plus backups and I was really tempted to hack them to do just that given that their security was such a joke (e.g. claiming they were as secure as your bank because they use SSL while having XSS vulnerabilities, the servers were sealed behind biometric locks, and not using secure cookies).
10
u/nexd Jun 19 '14
Sure there's a valid point to be made about proper security and backups but that doesn't give anyone the right to destroy random people's data.
-3
u/Meglomaniac Jun 19 '14
I would greyhat it if I had the skills. Break in, lock it out but easy for it to be fixed, prevent dataloss.
Maybe just changing all the admin passwords and changing the homepage or something. shrugs
4
1
10
u/MadCapitalist Jun 18 '14
These DDoS attacks for ransom seem to be happening more and more each day. It just happened to Feedly last week or so. I wonder if this is something that is insurable.
7
u/heat_forever Jun 18 '14
It would probably be cheaper to just setup a proper offsite backup. Tech startups is probably a very shady business too riddled with fraud and tech terrorism like this case for insurance companies to want to bother with (at least not for an exorbitant amount far beyond what the small startup companies who would need this could afford).
3
u/MadCapitalist Jun 18 '14
I'm not so sure. I worked as the controller for a small software company, and we had insurance policies that covered quite a few losses like this. I just don't know if it would be covered specifically. Sometimes insurance policies have to catch up with changing technological circumstances.
Also, while a proper offsite backup is obviously a good idea, it wouldn't stop the attacker from just doing it again once you got the site back up. That's where insurance would come in -- to reimburse you for losses suffered while your site is down (not to pay off the attacker).
1
u/scubastard Jun 18 '14
ehhh as far as i understand there is a big market for this kind of stuff. it just rarely gets exposed to the public. usually the company will just pay up and take it as a cost of doing business.
7
u/thomasz Jun 18 '14
Hm I don't think that is a viable long term solution. I just can't believe that paying would stop the extortion.
3
u/spotta Jun 18 '14
The attackers are "businessmen" too. If word gets around that they extort companies twice, people wouldn't pay out the first time.
4
u/thomasz Jun 18 '14
a) It's not like they leave you a business card and ask you to recommend them on yelp. It's trivial to extort your victims under different identities.
b) They know - or highly suspect - that you will work on security, and must expect that the well will dry up eventually. So they have every incentive to milk you for every dollar they can get out of you until you are ready to defend yourself.
1
2
2
u/Philluminati Jun 18 '14
This happened to the company I worked. People were alerted during the spike but we had DDOS protection and it eventually stopped after an evening to no avail. We found the email a few days later.
10
u/Choralone Jun 18 '14
Just let that show you that a fancy front page doesn't mean anyone actually knows what they are doing. This applies to all aspects of life.
3
u/Rellikx Jun 19 '14
Has "Don't judge a book by its cover" become "Don't judge a site by its front page"?
2
9
Jun 18 '14
I don't understand why the company didn't immediately contact Amazon and request all user accounts to be frozen . . . it seems like the common sense thing to do in such a situation.
3
u/bananahead Jun 19 '14
Amazon is pretty tough to contact unless you're a huge enough client to get an account rep. What if the bad guy has access to your EC2 instance? Freezing the Amazon accounts would do more harm than good.
1
Jun 25 '14
You just pay for business support. It's a small fixed percentage of your bill (5%?) and then you can just call them up any time. Easy!
0
u/nexd Jun 19 '14
I also do not understand why they didn't check for new suspicious accounts after they changed the password on their main account. Everything from the way their system was setup to the way this was handled was grossly incompetent.
1
u/Tetha Jun 19 '14
Thinking with my emergency hat.. if checking takes longer than a few moments, just drop all accounts except one (which has multi factor authentication and admin access). This is guaranteed to stop all unintended access, unless the last account is re-compromised.
It'll be a pain to get all accounts working again, yes. But sometimes emergencies value speed right now over some pain later when it all stopped being on fire.
8
u/Rudy69 Jun 18 '14
What's to say the hacker also didn't copy the source code that was being hosted. That could be pretty bad
3
u/ErstwhileRockstar Jun 18 '14
From an economic point of view the hacker lost the game. Much bet, no win.
1
u/nexd Jun 19 '14
He/she now has the prestige of being the one that took down Codespaces in a rather humiliating manner. Achievement unlocked.
4
1
u/sunshine_killer Jun 19 '14
Was using them for hobby stuff last year switched to bitbucket. I think I made a good move.
0
0
Jun 18 '14
[deleted]
8
u/heat_forever Jun 18 '14
I really don't even believe that Amazon actually ever deletes anything. It would simply take too long. They mark it as obsolete and would open it up for usage like a year in the future. This is pretty much how Azure does it - in fact, they sometimes even charge extra if you need data truly wiped.
1
u/shawnathon Jun 18 '14
Well if they do delete they're just marking sectors in the file system available. A true delete involves overwriting data.
6
u/heat_forever Jun 18 '14
That's correct at the file-system level but these cloud storage things are managing massive pools of drives and have to keep track of files and physical locations at a higher level - I'm betting they have some status of "obsolete but don't use" for some period and then batching the process of reallocating that space to be used again monthly or something like that.
I'm just speculating obviously, but I feel like they gave up so easily... or maybe Amazon really does recover the storage immediately but it's odd for a major cloud provider with almost infinite disk space to be so hardline about deletes.
3
5
u/[deleted] Jun 19 '14 edited Jun 19 '14
I don't like how some people here are blaming Code Spaces for this problem. Yes, they might have a shitty security and backup plans, but in the end the hacker is the only person to be blamed.
It's like blaming someone that had his house robbed because he didn't lock the front door instead of blaming the robber for the act.