Greenvaluehost hacked, customer details exposed to public including customer photo IDs

[drmike]

Because of just how difficult it would be to go through and cross reference IDs to accounts, wouldn't it be better just to inform everyone? Jonny says he'll inform those impacted. He seems like the type that won't follow through.

Since the data was made public through GVH's wrong doings, perhaps someone will ethically use the data contained to contact each individual it impacted individually. I'm almost willing to bet most will not / have not been contacted by GVH and would be surprised to learn that their identities have been made very easy to be stolen. Someone should do the right thing, and as a 3rd party attempt contact to those who have been impacted using their leaked personal details to contact them.

Just my $0.02.

There is no easy way to contact these people are a third party.

There is no database to relate things to.

So you would have to manually look at ID photos and track those people down physically.  Not a small / quick / cheap undertaking.

 

[DomainBop]

So you would have to manually look at ID photos and track those people down physically.  Not a small / quick / cheap undertaking.

Cleaning up in the wake of a breach is never a cheap undertaking unless you try to hide it and that can end up costing you even more. There was a recent study by Symantec that estimated the average cost to a business of a data breach at [$188 x (number of records compromised)] which is probably why many insurers now offer data breach response insurance to help cover the cost of notifications, forensics, possible lawsuits, etc (example: The Hartford).

 

[splitice]

Sigh, not unexpected that this would happen sooner or later.

In the rare case we take uploads of files  we ask the customer choose a 3rd party upload service. And recommend that it includes a delete function / own hosting.  Surprised people are using WHMCS attachments, put the onus on the customers rather than yourself for control and data erasure - no one wants that liability - especially with gov id's and the likes. I would also recommend if you do need proof of ID that rather than Gov ID, use a different verification piece (i.e phone, addressed letter, etc) a gov id is a serious liability to hand over as in many cases can be used to authenticate you with gov agencies and the likes in combination with details that can be extracted from facebook.

 

[RTGHM]

There is no easy way to contact these people are a third party.

There is no database to relate things to.

So you would have to manually look at ID photos and track those people down physically.  Not a small / quick / cheap undertaking.

images.google.com

Reverse Image Search on a clear picture of face if any, type in common social medias, hope you get lucky.

 

[Munzy]

You're on the wrong forum to be looking to try and reuse a leaked SQL password.


I'm not here to exploit it, just curious if it is in there.


Their excuses are absolutely hilarious. "Loophole", "cloud".. had a good laughing fit over that line of BS.

 

[drmike]

You're on the wrong forum to be looking to try and reuse a leaked SQL password.


I'm not here to exploit it, just curious if it is in there.


Their excuses are absolutely hilarious. "Loophole", "cloud".. had a good laughing fit over that line of BS.

Let us not fight... Where is the SQL password stored?  Anyone know?  

 

[Munzy]

http://docs.whmcs.com/Installing_WHMCS

 

[lowesthost]

This company gets better with age, like a nice bottle of red.

I just loved this quote

PCI 101 "directory list disabled"  and for storing client data ID  should have been deleted immediately 

Whats next for them. I need them for my daily drama since burst disappeared  

 

[WebSearchingPro]

http://docs.whmcs.com/Installing_WHMCS

From my understanding the file was a backup of the entire whmcs directory which included the configuration.php file you are looking for. GVH was supposedly using a cluster of frontend servers that talk to a central mysql server so someone could have infact dumped the database if they were quick enough since the IP and pass would be in the configuration.php. 

If GVH used IP address filtering on the MySQL server this wouldn't be possible, but I'm sure we all know that they didn't.

 

[Aldryic C'boas]

GVH was supposedly using a cluster of frontend servers that talk to a central mysql server

... for WHMCS?  That's one of the more ridiculous things I've heard this year, and anyone that actually believed such a claim should be ashamed of themselves.

 

[KuJoe]

... for WHMCS?  That's one of the more ridiculous things I've heard this year, and anyone that actually believed such a claim should be ashamed of themselves.

Why is that? WHMCS has a license configuration specifically for this type of setup so I'm sure others are doing it, not saying that GVH has this setup but I'm wondering if your response is towards WHMCS supporting that kind of setup or GVH's ability to set something like that up?

EDIT: For those who are curious, if you setup a cluster like this you only need one WHMCS license for the whole cluster, not one per server in the cluster.

 

[DomainBop]

Why is that? WHMCS has a license configuration specifically for this type of setup so I'm sure others are doing it, not saying that GVH has this setup but I'm wondering if your response is towards WHMCS supporting that kind of setup or GVH's ability to set something like that up?

A few possible reasons why the idea of GVH using a WHMCS cluster is ridiculous:

1. if they were using a cluster of WHMCS front ends all of the front ends wouldn't all start showing an Apache 404 error page at the same time.  Then there are the other factors:

2. a demonstrated complete lack of technical knowledge and a demonstrated inability to even follow the simple WHMCS documentation install "further security steps" instructions...imagine what would happen if they tried a complex setup

3. a tiny business whose recent WHT ads state "4000 happy customers" doesn't need multiple front ends for load balancing to handle the traffic to its customer portal.

4. multiple servers for high availability purposes were obviously not being used because, well...it was down...not up

A more likely reason why GVH's mouthpiece told people he was using a cluster: the clowns he idolizes and refers to as "demigods" use a cluster on their Vanilla install and so he decided to impress people by saying he used a cluster too.

Whats next for them. I need them for my daily drama since burst disappeared

The final chapter: they'll be "absorbed" by the demigods

 

[Aldryic C'boas]

Why is that? WHMCS has a license configuration specifically for this type of setup so I'm sure others are doing it, not saying that GVH has this setup but I'm wondering if your response is towards WHMCS supporting that kind of setup or GVH's ability to set something like that up?

Little from column A, a lot from column B.  Keep in mind this is a kid that was constantly begging for help behind the scenes - to the point of allowing a prepubescent child to perform work on live production gear clients were dependant on.  How many times have we seen him make claims, just to be immediately slapped for trying to use buzzwords on technology he didn't understand?  So - no, I see GVH (and all persons involved) simply not having the knowledge and skill to set up something at that level.

DomainBop raised some good points as well - if it were a true cluster and not a load of BS, they wouldn't have run into the problems they did.  His 3rd point I found especially hilarious - does anyone have a link to Johnny Wonder quoting 4000 clients?  That's a very small number in this game, and nowhere near heavy enough to require a 'cluster' - hell, we're talking less activity than a blog with half-decent traffic figures.

Regarding the column A.. I made a comment earlier in this thread that I'm honestly surprised nobody picked up on, about not trusting WHMCS attachments.  Think about that one: you have a closed-source system that allows random users to upload files, and doesn't disclose how said files are read. Sure, you can specify allowed extensions, but tell me I can't disguise some malicious bash as a .jpg and still make it run, and I'll laugh in your face.  And unless you actually know exactly how those uploaded files are being read, you have no idea how badly things can go wrong.

 

[DomainBop]

  His 3rd point I found especially hilarious - does anyone have a link to Johnny Wonder quoting 4000 clients?  That's a very small number in this game, and nowhere near heavy enough to require a 'cluster' - hell, we're talking less activity than a blog with half-decent traffic figures.

His latest WHT VPS offering last week.  To be fair, the ad says "over 4000" and in a few recent WHT posts he has bragged about "4500 customers", but still very small and nowhere near the level of activity that would require a cluster or a dozen or so directors/Vice Presidents and Level 3 techs with 100+ years combined experience.

 

[Aldryic C'boas]

His latest WHT VPS offering last week.  To be fair, the ad says "over 4000" and in a few recent WHT posts he has bragged about "4500 customers", but still very small and nowhere near the level of activity that would require a cluster or a dozen or so directors/Vice Presidents and Level 3 techs with 100+ years combined experience.

Ditto.  Let's put that into perspective: back when we were still around the 10k mark (that's clients with active service, not just a grand total of registered accounts), there were three of us putting in comfortable hours.  Francisco and myself doing dev, and Anthony and myself doing support.  A company as small as his could easily be run solo, with an extra body or two only necessary for 24 hour support.

 

[drmike]

From my understanding the file was a backup of the entire whmcs directory which included the configuration.php file you are looking for. GVH was supposedly using a cluster of frontend servers that talk to a central mysql server so someone could have infact dumped the database if they were quick enough since the IP and pass would be in the configuration.php. 

If GVH used IP address filtering on the MySQL server this wouldn't be possible, but I'm sure we all know that they didn't.

So configuration.php is in there and populated with data.

db_username = root ... That isn't normal /secure is it?

cc_encryption_hash is in there too....

Supposedly the MySQL box was IP restricted, so *should* be secure.

 

[Francisco]

Ditto.  Let's put that into perspective: back when we were still around the 10k mark (that's clients with active service, not just a grand total of registered accounts), there were three of us putting in comfortable hours.  Francisco and myself doing dev, and Anthony and myself doing support.  A company as small as his could easily be run solo, with an extra body or two only necessary for 24 hour support.

To be fair we automate anything we can that comes up more than a couple times a week.

If we had to manually deal with everything stallion, monbot, the pony* systems, etc, dealt with, we'd both be bald and excessively russian.

Francisco

 

[Francisco]

So configuration.php is in there and populated with data.

db_username = root ... That isn't normal /secure is it?

cc_encryption_hash is in there too....

Supposedly the MySQL box was IP restricted, so *should* be secure.

Well, the million dollar question is, is the SQL IP public or private? If they have a private LAN then it's fine. If it's public IP's that's rough.

I really do hope they used IP locks and not the tried n' tested %.

Francisco

 

[drmike]

3. a tiny business whose recent WHT ads state "4000 happy customers" doesn't need multiple front ends for load balancing to handle the traffic to its customer portal.

The final chapter: they'll be "absorbed" by the demigods

Well, the customer portal inevitably was under attack on daily basis.

I assume here they were shoving multiple HTTP instances/machines with such on the front side.  The back side though and database = single instances.  Such *could* work and be necessary, however if you can't deal with pedestrian Layer 7 attacks that necessitate such, then I'd expect people smacking stuff that would overload WHMCS and MySQl in other ways (since single instances).

As for the demigods and acquiring GVH,  I mean big picture here not insulting anyone --- but who wants company with heavy annual bought customers on HUGE plans?  By the time you skin their financials and look for income on the bone, monthly amounts aren't going to be enough to cover all those heavily loaded server nodes + provide real support.

So it's just like acquiring 123Systems or BlueVM, that is if CC does, they will have to reach in their own pocket to allocate funds to stabilize such.  Human toll of doing such with 4k containers or customers is a rough month or three.  That's why you see what has happened multiple times with CVPS.   

People can hate on me all they want on Lowend wonderland.  Folks over there need remedial math classes at Grade 1-5 levels.  ---> YOU CAN SELL WHATEVER YOU WANT FOR APPROACHING $0.  Not far off from being a Free VPS provider.  But you aren't going to do that math and actually provide what you advertise and do such with real support that is competent.  No way, no how and definitely not for any sustained consistent period of time.

 

[drmike]

Ditto.  Let's put that into perspective: back when we were still around the 10k mark (that's clients with active service, not just a grand total of registered accounts), there were three of us putting in comfortable hours.  Francisco and myself doing dev, and Anthony and myself doing support.  A company as small as his could easily be run solo, with an extra body or two only necessary for 24 hour support.

Problem is if something really breaks and when it breaks.  Need fresh folks who can conquer the issue and with fresh eyes.  It's doable with small staff, but has to be like you guys with workers who know their stuff and admin who is very competent and with lots of automation and where head admin - this is his life and not a hobby. 

Normally, elsewhere I say other folks can stomach at most 2k containers per active worker.   Less tech knowledge at the top, more staff.

Problem with GVH like so many cheapo companies is the owners aren't tech people, they aren't willing to learn either.  They depend on random "employees" who they are not qualified to know if competent or not, and who LIKELY aren't real qualified as such people aren't working for peanuts in a circus.  (Normally right here I'd go dropping employment number from recently on what average income for various tech workers are all over the United States --- let's just say even the lowest level ONE customer support person makes in legitimate companies, well over 50% of what GVH profits in a year on VPS sales).  So 1-2 real support folks in that budget and nearly ZERO profit or money for expansion, planning, rainy day fund, etc.

Kids will play.  But even children tire eventually, then it's goodnight.