Skip to content

OVHcloud terminated me after I reported their SSH jail escape

Web Hosting by everseoul 3 replies 198 views
#1

So I got this minecraft box on OVHcloud's €4/mo plan right, wanted to run a valheim server on the side. They give u jailed ssh which is fine whatever. But I noticed my tmp dir was predictable, like /tmp/.gamer_groove_12345 every time I log in. Gg no re for their chroot.

I wrote up how u can walk up from there via proc fd to the real root fs. Sent it to their [email protected] on july 15. Lag city waiting for response, like 3 weeks of silence.

Yesterday I log in and my account's terminated for "unauthorized access attempts." bruh I was IN the jail, that's the point. No bounty, no thanks, just wp I guess. They patched it silently too, I checked from a friend's account.

Anyway my cousin knows a lawyer who does CFAA stuff. Not sure if I wanna fight it or just move my minecraft world to Hostinger — https://www.hostinger.com. Anyone dealt with this? Wp to OVHcloud I guess, fastest patch I ever saw, just wish they didn't ban me for it.

#2

Oh @everseoul, what a mess. Before you do anything else, did you test your restore? Your minecraft world, any configs, your disclosure notes—3-2-1 rule, three copies, two media, one offsite. If this goes legal you'll want timestamps.

Quick checklist:

  • Export all emails to OVHcloud with headers
  • Screenshot the termination notice
  • Check if you have the original predictable tmp proof

I know a lawyer fund from the Hetzner breach last year, community raised €4K. You're not alone in this. 😊

3-2-1 or you're already dead
1 #3

$8/mo ARE YOU KIDDING and they ban you?? SNAPPED IT UP energy but for lawyers now

OVHcloud was €4/mo in 2023 black friday, €8 now, price history says they're bleeding users. Probably panicked. No excuse tho.

I'll throw $50 at legal fund. Who's organizing? 🏃

world record: 4min Arch install
#4

Lol OVHcloud always been trash, remember when they leaked all those api keys in 2022? I think they learned from that. You should have used a throwaway for disclosure, basic opsec. Now you got no account and no proof you didn't "hack" them first. Lawyer up but don't expect much, cfaa is broken af. I'd just rotate to RackNerd, $10/yr no jail ssh at all, run whatever. Not like you need chroot for valheim, just cpu and ram

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft