Archief - HOSTING: bluguy.com hacked

Since Olly left its been in the hands of various other people before it got handed to me. Neither Olly nor the previous guys the ran Bluguy are contactable about anything so I've had to find all the ins and outs of the system they put together completely blind.

Its a terrible thing to say, but the day galactic crashed was the day I found out Bluguy had two linux servers.

Over the last couple of months the Bluguy support tickets have mounted and mounted and in just the last week we had managed to get them under control and we were responding to tickets within 24 hours. Things were looking up. We still had to manually vett all signups due to the amount of fraudulant signups we get and manually create all CPanel accounts because our billing system refuses to even try to create them for us. But things were looking up.

We were preparing the old galactic server to be put into service sometime next week. We had wiped the Linux OS from it and installed FreeBSD, and operating system which I am far more familiar with. I had spent a good couple of lunchtimes and eveings reading the OpenBSD Packet Filter documentation so to write a good and secure set of firewall rules.

Now a group of Iranian *!£@%#¬ (trying to find symbols on my keyboard) broke into Cassandra we presume though the Microsoft FrontPage Extensions service though it could well be through some Linux kernel exploit I really don't know because I didn't setup the system so I dont know how secure it was setup to be. As I mentioned earlier the billing system wont auto create accounts anymore and the same thing goes for suspending and deleting accounts, so its entirely possible that an old website that was still running but no long "active" was running some old software which was a security risk. In trying to trace the breach we did notice a number of Mambo CMS based sites, Mambo is what Joomla used to be called. So yeah, pretty old and there have been some pretty shocking security holes in Joomla that I've seen. Then theres every system administrators most hated application, the ever popular phpBB.

So just what did the attackers do?
Well they (and this is why I really suspect FrontPage Extensions) replaced every single index.* (thats any file beginning with "index." if you dont know globbing) on the server with the anti catholic, anti semitic propaganda messages I am assuming nearly all of you have seen.

So why does this lead you to suspect FrontPage Extensions?
Well Microsoft FrontPage Extensions on a Unix or Linux server needs the rights to manipulate so many things that it wont run unless its root. Imagine leaving your house keys under a big keys here blinking sign and leaving your house unlocked and going for a 6 month holiday. Microsoft have even ceased supporting and developing FrontPage Extensions. Though its one of those "things" that most control panels just install because its so popular. This particular functionality is being removed from the replacement galactic server. If you need it, well I am sorry but you'll have to go find a webhost who doesnt give a toss about security and the safety of your files. We do care about the security and safety of your files even though over the past month or two it really doesnt look like it. It kills me every time something like this goes wrong and each time I wonder if Bluguy can survive it. I am really shaken at this last event and am really unsure of the overall outcome of this attack, I hope that Bluguy survives it, I was starting to enjoy running it this last week or so.

So what are we doing now?
Well as many of you have noticed FTP has been disabled. This is just while we migrate all the user account data to the replacement galactic server. Please please bear with us on this new server, we were going to use this week to properly test the firewall so if any service is not working properly then please please let us know via tickets. You can even title it "FAO: Geoff - Firewall" and I'll try to resolve the problem as quickly as I can. Though please include information about what you were trying to do

So once the user accounts have been migrated to the new server what happens?
Well, we will notify you via email that the move is complete and include information of any changes that may need to be made. In particular we are changing the nameservers that will be used, but we will also add the IP address for ns1.bluguy.com to the new nameservers temporarily while we migrate domains over. I'm going to have to get very intimate and friendly with the Nominet Automaton I think.

As I mentioned above FrontPage extensions will be disabled. All shell accounts will be revoked. You may submit a request for access, but you will need to have a good reason for it.

I am hoping that this will help to relieve some of the fear, uncertainty and doubt that has been flying around these forums regarding this problem.

Klik om te vergroten...