GreenValueHost forced password reset - Security breach?
- Thread starter MannDude
- Start date
- Status
hellogoodbye
New Member
This is getting beyond ridiculous.
For all that people slag on GVH and its teenaged chief of operations running the joint, I think whoever that is launching this DDoS attack is the real child here. The earlier compromise (and I do consider it to be a compromise, irregardless of their own definition of the term) was already crossing the line, but at least it revealed something useful-- that GVH had failed to harden basic security with their WHMCS. This however serves absolutely no purpose besides being a dick just because he can.
For all that people slag on GVH and its teenaged chief of operations running the joint, I think whoever that is launching this DDoS attack is the real child here. The earlier compromise (and I do consider it to be a compromise, irregardless of their own definition of the term) was already crossing the line, but at least it revealed something useful-- that GVH had failed to harden basic security with their WHMCS. This however serves absolutely no purpose besides being a dick just because he can.
drmike
100% Tier-1 Gogent
That is true. Assuming they have that much filtering and connectivity dedicated to such... not making a judgement either way... cause...
What is going to happen way before then is a puny VPS is going to blow up IO on container and probably ruin the entire server. Ending up in null, and or more properly a service suspension.
DomainBop
Dormant VPSB Pathogen
conspiracy theory: Jon is upset that nobody started any new GVH threads today so he's DDoSing himself to get attention. 
My suggestion to GVH would be STFU and not give any details about the attack to anyone until the attack is completely mitigated. DDoS attackers epenis sizes (and the intensity of their attacks) tend to increase each time their victims publicly post about the attacks.
drmike
100% Tier-1 Gogent
I ran out of popcorn ... so I went back to being helpful... Ho hum...
Ramnode had like 200+ load on that server, due to attack... so Layer 7 they have, meh... what shall I call it?
People diss CloudFlare, me included, but up it went. Things were alright. Then CF started straight passing traffic. Growl.
So CF back in place now.... and more heavy duty linebacker blocks put up... Whee...
http://www.downforeveryoneorjustme.com/greenvaluehost.com
Let's see how long this magic carpet ride lasts.
Done offering free mob protection for tonight.
Ramnode had like 200+ load on that server, due to attack... so Layer 7 they have, meh... what shall I call it?
People diss CloudFlare, me included, but up it went. Things were alright. Then CF started straight passing traffic. Growl.
So CF back in place now.... and more heavy duty linebacker blocks put up... Whee...
http://www.downforeveryoneorjustme.com/greenvaluehost.com
Let's see how long this magic carpet ride lasts.
Done offering free mob protection for tonight.
Were they using free or paid CloudFlare? Free or the $25/mo plan is useless against attacks. And if they didn't change their IPs then CF won't be of any use anyhow.
Layer 7 DDoS attack protection is only available for Business ($200/month) and Enterprise (~$5000/month) plans.
https://www.cloudflare.com/plans
https://www.cloudflare.com/plans
drmike
100% Tier-1 Gogent
"It's not just you! http://greenvaluehost.com looks down from here."
This is why you have staff around the clock or get your lazy princess ass out of bed, or never go to bed when someone is burning your castle down.
Kids though, they have a bed time or they might get grounded and their i-devices untethered.
This is why you have staff around the clock or get your lazy princess ass out of bed, or never go to bed when someone is burning your castle down.
Kids though, they have a bed time or they might get grounded and their i-devices untethered.
drmike
100% Tier-1 Gogent
Well they were to start with base CF.. and tier up appropriately.... Much of this botnet would be pre-bad-listed with CF and get captcha'd by CF or dealt with otherwise by them. The botnet is still running on compromised machines that were put on lists nearly 2 months ago.
As for the IP previously exposed, unsure what they did there. I run nested onion-like layers with throwaway front end IPs for this reason. GVH does not.
I'll say it once, this is the type of stuff that seperates the boys from the men - the real providers from the hobby hosts. Other companies I know / deal with / etc. run monitoring of everything. An outage like this forces someone with some ability out of bed even on Christmas. An hour into this and other staff gets woke up and policies are in place for what to do (and if not, people are just that damn good).
There are plenty of inept companies of all sizes that would fail like this. So not grinding GVH. People sleeping during stuff like this with crap ongoing, I have no love for it. Impacted customers shouldn't be sunshine, rainbows and daisies either about it.
Last edited by a moderator:
Actually the best thing they can do is go to bed and worry about it later. They can either throw money at the problem or wait for the attacker to get bored, and waiting doesn't cost a dime. Sure, they can't take any new sales while their website is down but if the trade-off is not having to pay costly mitigation fees and bandwidth overages then so be it.
Now if this truly is a layer 7 attack then there are much cheaper mitigation methods out there than CloudFlare that are much more effective.
Last edited by a moderator:
drmike
100% Tier-1 Gogent
True to some extent Mr. KuJoe!
Problem is, since I went to looking, is that ability for customers to log into panels seems to be hosed also. WHMCS appears down along with their website.
Someone with services now or prior can maybe confirm if other direct URLs to Solus are also down.
Problem is, since I went to looking, is that ability for customers to log into panels seems to be hosed also. WHMCS appears down along with their website.
Someone with services now or prior can maybe confirm if other direct URLs to Solus are also down.
SolusVM is working fine.
https://solusvm.securenetworkpanel.com/login.php
https://solusvm.secureserverpanel.com/login.php
https://solusvm.securenetworkpanel.com/login.php
https://solusvm.secureserverpanel.com/login.php
drmike
100% Tier-1 Gogent
Thank you... hopefully people have such handy....
Their SSL certificate is fubared...
-------------------------------
This Connection is Untrusted
solusvm.securenetworkpanel.com uses an invalid security certificate. The certificate is only valid for solusvm.secureserverpanel.com (Error code: ssl_error_bad_cert_domain)
Well on the plus side, it's not a school night, so hopefully no homework to do, and maybe the parents will extend their bedtime slightly. :lol:
- Status