ChicagoVPS / CVPS Hacked. New SolusVM exploit? (Content Restored) [PT. 1/2]

[Chankster]

Another update I received:

Dear Customer,

We're getting pretty close to having this issue fully resolved. All nodes, and all customer containers will be back online in the next 24-36 hours. Some containers will have all data intact and others will be fresh installs. For those with fresh installs, we may be able to restore your data from our backups, and if you used Central Backup your information will be available through that facility as well. Further mass-update emails will be sent later today with additional updates. Thank you for your patience and understanding -- we appreciate your business very much.

Josh
Support Guru

 

[Francisco]

We must a play a game.

If I CVPS Ceo what is my next movement ?  This is key question

If I CVPS Ceo : I hire a customer relationship person for communication ...

Isn't that why Adam was hired?

Francisco

 

[leeboof]

Another update I received:

Dear Customer,


We're getting pretty close to having this issue fully resolved. All nodes, and all customer containers will be back online in the next 24-36 hours. Some containers will have all data intact and others will be fresh installs. For those with fresh installs, we may be able to restore your data from our backups, and if you used Central Backup your information will be available through that facility as well. Further mass-update emails will be sent later today with additional updates. Thank you for your patience and understanding -- we appreciate your business very much.


Josh


Support Guru

I got the same, they must be copy pasting into all open tickets.. 

 

[HalfEatenPie]

Well, they probably do have tons and tons of the same tickets...

 

[concerto49]

Isn't that why Adam was hired?


Francisco

Kevin! 

 

[MannDude]

I'm actually curious if he'll change his name in the backend or continue going by the fake name of Kevin Hillstrand. I don't expect the average customer to care who isn't aware of the Adam/Kevin issue.

Customers of CVPS: Has a fellow named Kevin Hillstrand responded to your tickets within the past few days? What about Adam Ng?

 

[leeboof]

I'm actually curious if he'll change his name in the backend or continue going by the fake name of Kevin Hillstrand. I don't expect the average customer to care who isn't aware of the Adam/Kevin issue.

Customers of CVPS: Has a fellow named Kevin Hillstrand responded to your tickets within the past few days? What about Adam Ng?

lol.. 

Only response the last few days has been the copy pasted message from above.

 

[Nth]

I've had Adam, Luc, Chris, and Matthew answer tickets.

 

[codewarrior]

Another update I received:

Dear Customer,


We're getting pretty close to having this issue fully resolved. All nodes, and all customer containers will be back online in the next 24-36 hours. Some containers will have all data intact and others will be fresh installs. For those with fresh installs, we may be able to restore your data from our backups, and if you used Central Backup your information will be available through that facility as well. Further mass-update emails will be sent later today with additional updates. Thank you for your patience and understanding -- we appreciate your business very much.


Josh


Support Guru

Got same generic BS answer, after asking to PLEASE not give another generic BS answer.

Epic fail.

Colossal fail.

Need a new term for this place.

 

[shawn_ky]

Adam, Luc and Chris..

 

[MannDude]

I've had Adam, Luc, Chris, and Matthew answer tickets.

Matthew is likely an alias. In the DB leak 'Matthew B' uses the email address [email protected] which is used for them to register domain names. That's probably Chris, if I were to guess. I've had him use that email address when contacting me in the past about an account ChicagoVPS had with the company I used to work for that was in the name of an old employee. We got it sorted out and changed to be in his name, and that was the email address used.

Interesting to see Adam in the mix. This is a kid who just turned 18 a month ago, who for a couple years was lying about his age, location and name going by 'Kevin Hillstrand'. The leak kind of outed him, despite a lot of us knowing for a long time (Him and the CVPS crew would deny deny deny). By chance was Adam posting as Adam N. or Adam Ng? (Or Adam Jackson, which he also goes by?). Just trying to figure out if this Adam fellow is the old Kevin, or if it's an entirely different person.

 

[xvtv]

Josh / Chris / Thomas / Kevin (mid-may)

 

[srichter]

So they say it's too much work to restore everyone's backup and to open a ticket if you want your backup restored. Then they reply to that ticket with a generic email saying they're restoring anyone anyway and your data might be there or might not...

 

[Nth]

He signed it Adam Ng. On another interesting note; my canned responce letter like chankster's above was signed Matthew not Josh. Wonder if they got colocrossing people copy/pasting that to everyone with an open ticket or if they have a script with amnesia.

 

[MannDude]

Josh / Chris / Thomas / Kevin (mid-may)

Was the Kevin response today?

He signed it Adam Ng. On another interesting note; my canned responce letter like chankster's above was signed Matthew not Josh. Wonder if they got colocrossing people copy/pasting that to everyone with an open ticket or if they have a script with amnesia.

I'm 88% sure Matthew is just another alias, likely used by Chris. The other names may be for CC staff as they are helping CVPS to restore things back to normal but don't want to appear to be involved in doing so. (Although we already know this as other paying customers of Colocrossing had things delayed because their staff was busy working on restoring CVPS customer's data).

Though it is interesting that Adam is finally using his real name. That's a step in the right direction.

 

[Francisco]

I'm 88% sure Matthew is just another alias, likely used by Chris.

Easy way to prove who it is. Pull the adminlogs table of the dbdump for the IP used for actions. There's a slew of CC IP's in the WHT thread to compare to.

Francisco

 

[leeboof]

Latest Update:

I just wanted to update everyone and let them know that things are starting to calm down and return to normal. Communication moving forward will be much better since it is now less hectic and we appreciate everyone’s patience as it has been a long 3 days. Ticket response times will be much better and the pace has really picked up as we are concluding our recovery.

We appreciate your support and patience!

 

[MannDude]

Easy way to prove who it is. Pull the adminlogs table of the dbdump for the IP used for actions. There's a slew of CC IP's in the WHT thread to compare to.


Francisco

Too much effort. Matthew B., the other admin in the DB and I assume the same 'Matthew' answering tickets is Chris Fabozzi. I say this because 'Matthew B.' was using the email [email protected] and I doubt the owner of the company would share his email address with an employee.

 

[concerto49]

Why would Chris need an alias but?

 

[jer]

I had asked about the node being up in pingdom but the vps down. Here's the answer I got, that may help others:

Jer,

Some nodes are online but the containers are damaged. We will have all that sorted in the next 24 hours. We are working extra hard to get this done ASAP.

Thank you for your patience.

---------------
Matthew