amuck-landowner

ChicagoVPS / CVPS Hacked. New SolusVM exploit? [PT 2/2]

Magiobiwan

Insert Witty Statement Here
Verified Provider
NOTICE

EDIT: Original thread content here: http://vpsboard.com/topic/984-chicagovps-cvps-hacked-new-solusvm-exploit-pt-1

The thread had to be split into two after some errors. All original posts have been restored in that thread. Further discussion can be had within this thread.

-MannDude

(Sorry Magiobiwan, could not remove your post as it's the first one so I had to edit it to display this message)
 
Last edited by a moderator:

mmance

New Member
Chris has been very vague in his response to me personally today.  

17316044_screenshot.png


I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.
 
Last edited by a moderator:

drmike

100% Tier-1 Gogent
Ran a bunch of lookups for folks here to see if their details were in the dump.

I can confirm if you cancelled your services after the last hack in November - February, your details probably aren't in there.

Anyone else want info looked up, PM me.  

Will be back in a bit.
 

mnsalem

New Member
Just thought to drop by and mention that i just got the email with the report (that update which was posted several hours ago).
 

mmance

New Member
Chris has been very vague in his response to me personally today.  

17316044_screenshot.png


I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.
 
Last edited by a moderator:

saliq

New Member
Chris has been very vague in his response to me personally today.  

17316044_screenshot.png


I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.
If your site and email is same as the username here then you are in it :(
 
Last edited by a moderator:

upsetcvps

New Member
Chris has been very vague in his response to me personally today.  

17316044_screenshot.png


I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.
yes, your e-mail address would not be hard to guess based on your username, Marc ;) 
 
Last edited by a moderator:

mnsalem

New Member
they are indeed working on it! Last time i checked pingdom, 3 out of the 4 servers in atlanta were offline! now Just 1 is left.

Same for Buffalo! 4 servers were down .. now just 2 ... and i happen to be on the one that is down (facepalm)
 

upsetcvps

New Member
they are indeed working on it! Last time i checked pingdom, 3 out of the 4 servers in atlanta were offline! now Just 1 is left.


Same for Buffalo! 4 servers were down .. now just 2 ... and i happen to be on the one that is down (facepalm)
We are probably in the same server.  How do you know what server you are on?
 

TheLinuxBug

New Member
I think this thread should just be closed.  If there is anymore real news about this, I think we can open a new thread, or even better, post it in the cest pit.  There is enough CVPS PR threads open here already.

Cheers!
 

jfreak53

New Member
Thanks mod for cleaning this mess up.

You know cVPS an update no matter how small it is would really be helpful, even if it is small.
 
Last edited by a moderator:

Marc M.

Phoenix VPS
Verified Provider
How much warning do you need as a software provider about your code being poorly written? And why do you write code like this? Sorry, but I can't fault any provider that was hit by this attack, and all I can say is that I am sorry that some of you guys had to suffer because of this:


<?php
if ($_POST['delete']) {
$xc = $db -> query('SELECT * FROM centralbackup WHERE id = \'' . $_POST['deleteid'] . '\'', true);
#[...]
if ($xc[status] == 'failed') {
exec('php /usr/local/solusvm/system/bus.php -- --comm=deletebackup --serverid=' . $xc['bserver'] . ' --nodeid=' . $vdata['nodeid'] . ' --vserverid=' . $vdata['vserverid'] . ' --filename=' . $xc['filename']);
#[...]
}
}
?>
Hasn't anyone decrypted the source? Couldn't they then run a search for dumb execs?
@D. Strout There's been a decoded version floating around the web for a while now, I guess that's how the vulnerability was found and exploited in the first place. Pretty lame, but it is what it is.

Guys, here is something simple that you should do immediately: restrict access to the admin path. Restrict it by IP, with a password, or ideally both. @Kujoe had some good advice as well on how to secure SolusVM.

Kind regards,

Marc
 
Last edited by a moderator:
Top
amuck-landowner