The best part was that they offered them a credit on their account as compensation. As if they would want to continue their business with a hosting company that allows unauthenticated users to issue commands to their technicians.

I wonder just how much time they'd get from $100,000 in hosting credit.

> Grant said the credit was nowhere near sufficient to cover the company’s loss and as a result his firm is contemplating legal action.

I doubt it was $100,000 in hosting credit. Probably a free year or two or something relatively meaningless.

No doubt, but it's amusing to imagine.

This is Rogers you're talking about. The sell you a shitty expensive connection capped at 60GB, and then they hijack your DNS failures to resolve to their shitty ads page, and throttle your traffic depending on the protocol. If you drive down the street in my city you see wireless access points named "Rogers Sucks Ass".

Not only that, they gave an unauthenticated employee direct access. So your attack vectors are:

- Pretend to be the server owner (potentially difficult, though evidently not in this case).

- Bribe/threaten any support rep, because apparently they have complete control of any customer's server without any form of verification.

What insane customer support system would even let someone have a whiff of private data without verifying that the agent is representing the customer?

>Not only that, they gave an unauthenticated employee direct access.

Now, this is kind of an interesting thing. From what I've seen, lower end datacenters, for example, he.net, often have "free remote hands" - their techs are expected to access your servers. If you go higher end to coresite or equinix? the only people in the building are security. (and /maybe/ a power/hvac person) And while they can get into your stuff (the locks on the racks are a joke) they aren't expected to do so; a security person will get fired for jimmying with your stuff.

As an aside, from what I've seen, he.net has pretty good access control; they check your ID, and then they take a picture of you, and the login system shows the person who is letting you in a picture of you from the last three times you entered. I don't know how strongly they authenticate remote hands requests. He.net also prevents "tailgating" more effectively than most of the other area datacenters.

It's interesting, even within coresite, all the local coresite locations have a fingerprint reader + radio access card access control combo, but at 55 S. market? they don't even try to stop tailgaters, as long as one of you has a badge. at 2972 stender? they put some effort into it, though they aren't as effective as he.net.

I think that he.net is more effective at preventing tailgaters precisely because the user doesn't get an access card. You have to ask one of the he.net security folks to open the door for you every time you leave the datacenter floor, which presents a reasonably non-confrontational way for them to verify everyone has been verified.

At 2972 stender, they are very apologetic, but they do usually stop you. I have, however, seen people get through without verification during busy times. (the 'man-trap' system is imperfectly enforced, in part because it would clog the place up otherwise.)

Of course, these comments are mostly about physical security, and the article was about getting unauthorized remote hands. I didn't use the remote hands much at all at he.net, so I don't know.