An attacker deleted Code Spaces' servers and backups in 12 hours, and the company shut down

transcript

In about 12 hours, a company's data and backups were deleted. And the attacker didn't even have the keys to its servers.

Code Spaces hosts code for its customers. On Amazon's cloud. 17 June 2014. A flood of junk traffic hits. That happens a lot. But someone is inside their cloud control panel. They left messages. Contact this Hotmail address. Then the demand: a large fee to stop the DDoS.

Good news first. The intruder doesn't have their private keys. No server access. So the team changes passwords to take the account back. But here's the catch. The intruder had already made backup logins. They see the recovery attempt. And start deleting.

The control panel doesn't need server keys. It manages everything. All the disk snapshots. Deleted. The S3 buckets. All the machine images. Deleted. Several machines too. Over a 12 hour period.

Git repos and some SVN repos could still be exported. Every backup and snapshot? Gone. The database volumes too.

The same statement announced the end. The cost, plus refunds, put them in an irreversible position. They ceased trading.

One login can delete data and backups? Then you have one copy. Keep backups in another account. With different credentials.

Full story in the article.