Peter Gabriel's Web Server Stolen

miller60 writes "Web servers hosting musician Peter Gabriel's web site have gone missing from their data center. "Our servers were stolen from our ISP's data centre on Sunday night — Monday morning," reads a notice at PeterGabriel.com. The incident is the latest in a series of high-profile equipment thefts in the past year, including armed robberies in data centers in Chicago and London. How secure is your data center?"

Heist!

[warriorpostman]

Wow. It never even occurred to me that people would execute traditional bank-style heists of data servers.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Probably not very

[KeithIrwin]

There was a talk at ACM CCS a couple of years ago by a guy who specialized in physical security. He runs a company which works as site security testers. He told of being hired to check how secure a client's computers were in a "secure" data-center. The servers were in a floor-to-ceiling cage with a padlock and security cameras. All they had to do was to fake some passes to get into the data center and then either go under the floor or over the ceiling. In this data center, as in most, there was about a 2-foot crawlspace below the floor and another one above the ceiling. Floor-to-ceiling cages don't mean much if you can just go around them, and that's how many "secure" data-centers are set up. Likewise, the security cameras are only useful if someone is watching them, and in the places he tested, no one was. Since he was only testing, he didn't actually steal the machines, but he did put stickers on them to prove that he'd been there.

So, how secure is your data center: probably not very.

Re:Probably not very

[eln]

It blows my mind that people who have a raised floor, and presumably go down into the raised floor all the time in order to run cable or whatever, wouldn't realize that people could get under a cage through the same mechanism.

At the data center where I work, all of the cages are extended beyond the raised floor down to the concrete. Sure, if you had a heavy enough set of bolt cutters you could get through, but the metal detectors and security guards should keep you from getting something like that into the building. Plus, the fact that you would have disappeared under the raised floor for several minutes while you cut through the cage should be noticed.

Granted, I work in a Tier IV data center (getting through security is like going to the airport every morning) and don't expect such a high level of security everywhere, but I would think extending the cages beyond the raised floors (and dropped ceilings if present) would be a no-brainer and would be done at very little cost. In addition, I would think at the very least having cameras on and recording 24/7 shouldn't be that big of an expense.

Interesting (yet scary) anecdote...

[halivar]

I have a friend whose co-located server went down. The Linux partition was screwed, and it needed a reinstall something fierce. I couldn't reach him (he was on vacation), so I drove down to the provider to grab the box. They did not so much as ask for my name; they just let me in, said, "go on in the machine room and grab it." This perturbed me a bit (because the machine clearly had a label that said "Property of [not me]. Do not touch."), but I went in, took it, brought it home, and fixed it up. When I brought it back (with a new install of SuSe and the then newly-released 2.6 stable), the techs remarked that the owner's roommate showed up to see what was wrong with the server. Having been told that an unnamed individual was allowed to make off with the server, he threatened to call the police. The service provider's response to him was, (and I quote), "fuck off."

This feels so unnatural...

[ascii]

To quote a favourite band [vampireweekend.com] of mine:

"But this feels so unnatural
Peter Gabriel too"

Get a better DataCenter

[noc007]

The company I work for has all of its servers in a secure colo. The place offers secured cabinets, secured cages with racks, and even does walled off areas of the datacenter floor with a secured door for high paying customers like Google. The facility is manned 24/7 with cameras all over outside and in. The rear of the facility is fenced and gated.

If you're on the roster for your company with floor access this is the process you have to go through to even get to your server:
-If it's at night, you have to use your RFID badge to get in the front door
-Check in with security and sign out for your key if the door is not a combo lock
-Security needs to buzz you through the first door
-RFID badge and finger print through two or three doors
-Iris scan in the man-trap to get to the datacenter floor
-Combo or the checked-out key to get in to the cabinet or cage

On regular intervals they check the people on the floor to make sure that you're suppose to be there.

I'm not saying this place is a fortified facility that can handle a team of insurgents. However, I'd feel that my equipment is safe from the theft I've been hearing about at some datacenters. For a cabinet with a 1Mbps commit data rate with an actual 10Mbps internet connection and IPs, it's about the same cost of having a T1 to the office.

For those that want to know who we use, it's Quality Tech.

Re:Musicians seem to have crappy luck

[mlts]

On gigs, its not uncommon for people to try to rip off the USB dongles which are used as license keys for VST plugins and various music software. This sucks because it might cause a band not to be able to complete their set if they don't have backup tracks.

Protecting VST keys for desktop or rackmounts is fairly easy -- you have a USB card with an internal port and plug your VST license dongle into that, leaving that inside the machine. However, for laptops its harder and quite easy for someone to walk up, grab the dongle and run off.

Re:Heist!

[vimh42]

Hopefully people will start to become aware of this issue more. I've read similar stories where people show up dressed as IT staff and just walk off with servers and witnesses simply assumed they were legit and just doing maintenance.

Re:Probably not very

[eln]

Sure, and we have multiple layers of security with armed guards posted both outside of the gated parking lot and outside and inside the building itself. That would stop most armed robbers, although if you had a Die Hard type of situation with a whole gang of highly sophisticated thieves, I doubt you could do a whole lot to stop them, short of having Bruce Willis on speed dial.

Re:Musicians seem to have crappy luck

[MsGeek]

No, the Sonic Youth guitars in question had physical modifications done to them. It wasn't just weird tunings. This was a major setback for the band.

Re:Maybe they shouldn't have been dataslumming it

[jimicus]

So his hosting company was the side-project of a prepaid cellphone company? He got what he deserved.

They're a pretty major mobile phone company in the UK, and remarkably adept at forming subsidiaries and acquiring companies.

They're not particularly adept at customer service when things go wrong, but I don't know any organisation that sells mobile phones that is.

Re:Heist!

[Necrobruiser]

people show up dressed as IT staff

What? Wearing jeans, Chuck Taylors, and a tshirt [thinkgeek.com]?

Re:Musicians seem to have crappy luck

[afidel]

Probably special windings, possibly a different style of bridge than is normal for that model. Those are the most common modifications for guitars.

Re:Heist!

[Jellybob]

I'll let them off for not hearing - most of the data centers I've been in have been so noisy you'd be lucky to hear a JCB driving through the walls. Our main one is loud enough that we're legally required to wear ear-defenders now.

There's no excuse for being robbed 4 times though. If I had any hardware there, I'd certainly be moving it.