ChicagoVPS / CVPS Hacked. New SolusVM exploit? (Content Restored) [PT. 1/2]

[Magiobiwan]

Well, looks like CVPS has also fallen victim to the latest SolusVM Exploit. Given their CP page anyways. 



Take a look for yourself! https://manage.chicagovps.net:5656/

Someone posted this on LET, but nobody had posted here. YET.

EDIT: TO COMMENT ON THIS THREAD PLEASE VISIT PART 2 HERE: http://vpsboard.com/topic/758-chicagovps-cvps-hacked-new-solusvm-exploit-pt-22/

-MannDude

 

[Magiobiwan]

Well, looks like CVPS has also fallen victim to the latest SolusVM Exploit. Given their CP page anyways. 



Take a look for yourself! https://manage.chicagovps.net:5656/

Someone posted this on LET, but nobody had posted here. YET.

 

[Francisco]

Is it just a DB dump?

You should censor the image

Francisco

 

[drmike]

Umm link doesn't work on CVPS and the 4chan file has been pulled:

This file is no longer available because of claim by  4shared Support Team.

 

 

 

 

 

[earl]

Lately it seems this is a tough business to be in..

 

[drmike]

ChicagoVPS is a total crap heap.

This is the second hack since November.

Yeah, there is a full database dump floating around too it seems.

Did anyone see what was in that database passwords file?

 

[Magiobiwan]

I didn't grab it myself, but I hear (from thread on LET) it's the same stuff as was in the RamNode one. Names, Emails, Client IDs, Hashed PW, Original Root PW, IPs, Hostnames, OS, Virt Type, etc. 

 

[drmike]

Oh look, Kevin is indeed Adam Ng:

(12,'adamng','50f1ba0c5fe73f19bbf09cc728f2526e57910c23','[email protected]','Adam','Ng','Active',1,1354156121,'1','sysinfo:true,susvps:true,rlsinfo:true|clusterstats:true,userstats:true,clientact:true,updates:true,sysmess:true|','control:true,sett

ings:true|usage:true,info:true,note:true|','nodeinfo:true,nodebuttons:true,nodegraphs:true|','')

 

[MannDude]

0_o

 

[mpkossen]

ChicagoVPS is a total crap heap.

This is the second hack since November.

Yeah, there is a full database dump floating around too it seems.

Did anyone see what was in that database passwords file?

Could also be due to a SolusVM exploit.

Several people on LET confirm their information is in the file. I'm just assuming it's a dump of the customer table or maybe even a full dump.

 

[HalfEatenPie]

Yikes!  Not another one!  

 

[Amitz]

Maybe #gothacked is the new #winning?

 

[drmike]

Could also be due to a SolusVM exploit.

Several people on LET confirm their information is in the file. I'm just assuming it's a dump of the customer table or maybe even a full dump.

It's a full SolusVM dump.  Same sort of dump as the November #failing 

 

[MannDude]

So does this DB have all the same info as their last one did? If so, that's very worrying. If it's a full DB dump of SolusVM then I'd assume it has emails, passwords (hashed, can be easily unhashed), IP addresses, etc, etc.

Not good at all. Was this Robert Clarke too? Haha.

 

[peterw]

Post on LEB:

Lol:


Attention providers:
In roughly 12 hours I will be disclosing 3 zero day vulnerabilities on solusvm.
I suggest you take backups fast or else hackers will abuse this. I have tried contacting solusvm to fix it however I have been ignored.
They stated the vuln is “not important at this time”
Good luck.

June 17, 2013  2:36 pm

 

[MannDude]

Oh look, Kevin is indeed Adam Ng:

(12,'adamng','50f1ba0c5fe73f19bbf09cc728f2526e57910c23','[email protected]','Adam','Ng','Active',1,1354156121,'1','sysinfo:true,susvps:true,rlsinfo:true|clusterstats:true,userstats:true,clientact:true,updates:true,sysmess:true|','control:true,sett

ings:true|usage:true,info:true,note:true|','nodeinfo:true,nodebuttons:true,nodegraphs:true|','')

Ha, been saying it all along. No one cares. Adam Ng IS Kevin Hillstrand. No one would admit to anything. The kid just turned 18 a month or so ago.

 

[drmike]

If it's a full DB dump of SolusVM then I'd assume it has emails, passwords (hashed, can be easily unhashed), IP addresses, etc, etc.

 

Yep it's the same type of info.  Obviously, current data though.

 

[drmike]

Ha, been saying it all along. No one cares. Adam Ng IS Kevin Hillstrand. No one would admit to anything. The kid just turned 18 a month or so ago.

Yeah Holestained is Adam Ng.      Yep, he was a minor while employed by CVPS and URpad.

Yes, Adam and Chris lied again about who Hillstrand was.

Did WHT ban Hillstrand yet?  They should.

 

[MannDude]

Yep it's the same type of info.  Obviously, current data though.

Yikes. Wonder who else has been hit who hasn't been made public yet.

 

[drmike]

Yikes. Wonder who else has been hit who hasn't been made public yet.

 

Just heard someone say they have 3 VPSes down at CVPS now.

Anyone else have things down over there?