{"id":70106,"date":"2014-07-01T14:15:19","date_gmt":"2014-07-01T18:15:19","guid":{"rendered":"http:\/\/rbachnet.wwwmi3-ss40.a2hosted.com\/index.php\/"},"modified":"2021-08-01T15:36:31","modified_gmt":"2021-08-01T19:36:31","slug":"another-cloud-implosion","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/another-cloud-implosion\/","title":{"rendered":"Another Cloud Implosion"},"content":{"rendered":"<p><a href=\"https:\/\/web.archive.org\/web\/20200130173056\/http:\/\/www.inspirationalandspiritualpoetry.com:80\/2013_01_16_archive.html\" target=\"_blank\" rel=\"noopener noreferrer\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-103943\" title=\"Another Cloud Implosion\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/cloud_storm-1.png?resize=135%2C95&#038;ssl=1\" alt=\"Another Cloud Implosion\" width=\"135\" height=\"95\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/cloud_storm-1.png?resize=150%2C106&amp;ssl=1 150w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/cloud_storm-1.png?resize=75%2C53&amp;ssl=1 75w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/cloud_storm-1.png?w=361&amp;ssl=1 361w\" sizes=\"auto, (max-width: 135px) 100vw, 135px\" \/><\/a><strong>Code Spaces<\/strong>, formerly a popular cloud-based source code <strong>hosting service<\/strong> run by\u00a0<a title=\"Ablebots\" href=\"https:\/\/www.pcworld.com\/article\/439918\/hacker-puts-full-redundancy-codehosting-firm-out-of-business.html\" target=\"_blank\" rel=\"noopener noreferrer\">AbleBots<\/a> from New Jersey was forced to close.\u00a0<em><a title=\"Infosecurity\" href=\"http:\/\/www.infosecurity-magazine.com\/view\/38954\/code-spaces-demise-exposes-cloud-security-failings\/\" target=\"_blank\" rel=\"noopener noreferrer\">Infosecurity<\/a><\/em>\u00a0<a title=\"Code Spaces Demise Exposes Cloud Security Failings\" href=\"http:\/\/www.infosecurity-magazine.com\/view\/38954\/code-spaces-demise-exposes-cloud-security-failings\/\" target=\"_blank\" rel=\"noopener noreferrer\">reports<\/a> that after an attacker managed to get access to its <strong><a title=\"Amazon\" href=\"http:\/\/www.amazon.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Amazon<\/a><\/strong>\u00a0(<a title=\"NASDAQ : AMZN\" href=\"https:\/\/www.tradingview.com\/symbols\/NASDAQ-AMZN\/\" target=\"_blank\" rel=\"noopener noreferrer\">AMZN<\/a>)\u00a0Web Services EC2 control panel and delete most of its customers\u2019 data. \u00a0According to an explanation on the <a title=\"Cloud Spaces\" href=\"http:\/\/www.codespaces.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Code Spaces<\/a> website, the firm was a victim of <strong>DDoS<\/strong> with the apparent attempt to <strong>extort<\/strong> &#8220;a large fee to resolve the DDOS.&#8221;<\/p>\n<p style=\"text-align: justify;\">As the firm attempted to restore control of its machines, the attacker escalated the attack, the site says;<\/p>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-103945\" title=\"hanging out a closed sign\" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/closed-out-of-business-1.png?resize=90%2C94&#038;ssl=1\" alt=\"hanging out a closed sign\" width=\"90\" height=\"94\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/closed-out-of-business-1.png?resize=143%2C150&amp;ssl=1 143w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/closed-out-of-business-1.png?resize=72%2C75&amp;ssl=1 72w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/closed-out-of-business-1.png?w=346&amp;ssl=1 346w\" sizes=\"auto, (max-width: 90px) 100vw, 90px\" \/><\/p>\n<p style=\"text-align: justify; padding-left: 30px;\"><em>&#8230; the intruder had prepared for this and had already created a number of backup logins to the panel and upon seeing us make the attempted recovery of the account he proceeded to randomly delete artifacts from the panel &#8230; We finally managed to get our panel access back but not before he had removed all EBS snapshots, S3 buckets, all AMI&#8217;s, some EBS instances and several machine instances. In summary, most of our data, backups, machine configurations, and offsite backups were either partially or completely deleted.<\/em><\/p>\n<p style=\"text-align: justify;\">Code Spaces marketed itself as a trusted provider offering &#8220;Rock Solid, Secure and Affordable Svn Hosting, Git Hosting and Project Management&#8221; and a \u201cfull recovery plan\u201d with <span style=\"color: #333333;\"><strong>full redundancy, duplication, and distribution<\/strong> of the data across three different geographical data centers<\/span>\u00a0if things went wrong. According to the <em>Infosecurity<\/em> blog despite the marketing hype the Code Spaces sites is folding up its\u00a0tent and <strong>hanging out a closed sign<\/strong> by saying;<\/p>\n<p style=\"text-align: justify; padding-left: 30px;\"><em><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-103941 size-full\" title=\"cost of refunding customers who have been left will put Code Spaces in an irreversible financial position \" src=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/face_palm1-1.jpg?resize=95%2C112&#038;ssl=1\" alt=\"cost of refunding customers who have been left will put Code Spaces in an irreversible financial position \" width=\"95\" height=\"112\" srcset=\"https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/face_palm1-1.jpg?w=95&amp;ssl=1 95w, https:\/\/i0.wp.com\/rbach.net\/wp-content\/uploads\/face_palm1-1.jpg?resize=64%2C75&amp;ssl=1 64w\" sizes=\"auto, (max-width: 95px) 100vw, 95px\" \/>Code Spaces will not be able to operate beyond this point, the cost of resolving this issue to date and the expected cost of refunding customers who have been left without the service they paid for will put Code Spaces in an irreversible position both financially and in terms of on-going credibility.<\/em><\/p>\n<p style=\"text-align: left;\"><strong><em>rb-<\/em><\/strong><\/p>\n<p style=\"text-align: left;\"><em>Another high-profile <strong>Cloud Computing\u00a0service goes bust<\/strong>. Last year when Nirvanix went belly up I <a title=\"Cloud Exit Plan\" href=\"http:\/\/wp.me\/p2wgaW-gpw\" target=\"_blank\" rel=\"noopener noreferrer\">wrote<\/a> about the need for a cloud exit plan.\u00a0Calum MacLeod, vice president of EMEA at <a title=\"Lieberman Software\" href=\"https:\/\/www.beyondtrust.com\/blog\/entry\/lieberman-software-acquired\" target=\"_blank\" rel=\"noopener noreferrer\">Lieberman Software<\/a> told <a title=\"CIO.com\" href=\"http:\/\/www.cio.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">CIO.com<\/a> that security incidents like this are avoidable if companies take effective steps. He suggested firms should implement:<\/em><\/p>\n<ul>\n<li><em>Certificate-based authentication along with normal user IDs and passwords,<\/em><\/li>\n<li><em>Whitelist applications,<\/em><\/li>\n<li><em>A schedule for changing\u00a0Credentials every few hours for critical applications,<\/em><\/li>\n<li><em>Continuous discovery of the systems and applications to check if there were any changes to account settings, like happened to Code Spaces where new privileged accounts were created to allow the attack to\u00a0continue.<\/em><\/li>\n<\/ul>\n<p><em>He concludes that the Code Spaces incident reads like a <strong>cyberattack<\/strong> 101 scenario, where the failure to properly manage privileged credentials ultimately was the cause of the breach.<\/em><\/p>\n<p><em>Other suggested measure for organizations using AWS would be to enable <a title=\"Multi-factor authentication \" href=\"https:\/\/aws.amazon.com\/iam\/details\/mfa\/\" target=\"_blank\" rel=\"noopener noreferrer\">multi-factor authentication<\/a> for admin logins. Alternatively, to prevent the wholesale loss of files <a title=\"Amazon launches low-cost Amazon Glacier Data archival\" href=\"https:\/\/web.archive.org\/web\/20130515181602\/http:\/\/www.fiercecio.com\/techwatch\/story\/amazon-launches-low-cost-amazon-glacier-data-archival\/2012-08-24\" target=\"_blank\" rel=\"noopener noreferrer\">Amazon Glacier<\/a> could be used for longer-term data archival, to augment regular offline backups.<\/em><\/p>\n<h6>Related articles<\/h6>\n<ul>\n<li><a href=\"https:\/\/web.archive.org\/web\/20160315110755\/http:\/\/www.prweb.com\/releases\/2014\/06\/prweb11925053.htm\" target=\"_blank\" rel=\"noopener noreferrer\">eFolder Acquires Cloudfinder, Empowers Managed Backup and Search for&#8230;<\/a> (prweb.com)<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p style=\"font-weight: inherit; font-style: inherit; text-align: left;\"><em><a title=\"Ralph Bach\" href=\"https:\/\/rbach.net\/index.php\/new-resume\/\" target=\"_blank\" rel=\"noopener noreferrer\">Ralph Bach<\/a>\u00a0has been in IT long enough to know better and has blogged from his\u00a0<a title=\"Bach Seat\" href=\"https:\/\/rbach.net\/\" target=\"_blank\" rel=\"noopener noreferrer\">Bach Seat<\/a> about IT, careers, and anything else that catches his attention since 2005. You can follow him on <a class=\"broken_link\" href=\"http:\/\/www.linkedin.com\/in\/rb48334\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">LinkedIn<\/a>,\u00a0<a href=\"https:\/\/www.facebook.com\/ralph.bach.14\" target=\"_blank\" rel=\"noopener noreferrer\">Facebook<\/a>,\u00a0and\u00a0<a href=\"https:\/\/twitter.com\/rbach48334\" target=\"_blank\" rel=\"noopener noreferrer\">Twitter<\/a>. Email the Bach Seat\u00a0<a href=\"mailto:\/\/bach.seat@gmail.com\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cloud computing firm Code Spaces closed shop due to a breach further showing the risks of unfettered cloud services what is your backup plan for web services?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[173],"tags":[2292,392,1023,173,2155,1748,2157,2158,1507,4,2156],"class_list":["post-70106","post","type-post","status-publish","format-standard","hentry","category-cloud-computing","tag-2292","tag-amazon","tag-amzn","tag-cloud-computing","tag-code-spaces","tag-ddos","tag-ec2","tag-fail","tag-ransomware","tag-security","tag-web-services"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/70106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/comments?post=70106"}],"version-history":[{"count":15,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/70106\/revisions"}],"predecessor-version":[{"id":129231,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/posts\/70106\/revisions\/129231"}],"wp:attachment":[{"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/media?parent=70106"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/categories?post=70106"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rbach.net\/index.php\/wp-json\/wp\/v2\/tags?post=70106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}