Staminus sites offline - massively hacked
- Thread starter wlanboy
- Start date
wlanboy
Content Contributer
And the bin: http://hastebin.com/raw/oweyukamuj
Snip:
FILES:
http://************/chatbot.tar.gz
http://************/lighttpd.tar.gz
http://************/main.tar.gz
http://************/openvpn.tar.gz
http://************/svn.tar.gz
SQL:
http://************/3-9-staminus2.sql
http://************/accountUpdate.sql
http://************/acctserver.sql
http://************/appliance_lan.sql
http://************/full.sql
http://************/ip_limit_history.sql
http://************/ip_limit_profile.sql
http://************/ip_limit.sql
http://************/sp.sql
All interal and protected ips leaked - easily mapped... making their protection useless.
Snip:
FILES:
http://************/chatbot.tar.gz
http://************/lighttpd.tar.gz
http://************/main.tar.gz
http://************/openvpn.tar.gz
http://************/svn.tar.gz
SQL:
http://************/3-9-staminus2.sql
http://************/accountUpdate.sql
http://************/acctserver.sql
http://************/appliance_lan.sql
http://************/full.sql
http://************/ip_limit_history.sql
http://************/ip_limit_profile.sql
http://************/ip_limit.sql
http://************/sp.sql
All interal and protected ips leaked - easily mapped... making their protection useless.
Last edited by a moderator:
Licensecart
Active Member
Interesting there's WHMCS information in it, who uses a very small insecure password for important files? And LOL the same password for the Wordpress... Don't they know Wordpress has even worse security than WHMCS...
Last edited by a moderator:
As of right now, allegations are going around that they're actively covering up complaints and questions about the breach. They appear to be deleting Facebook comments, and deleting and re-posting tweets that have potentially incriminating information.
Forbes has a small section about it: http://www.forbes.com/sites/thomasbrewster/2016/03/11/kkk-staminus-hacked/#7d247e2c6942
Krebs on Security post: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/
I think whoever's managing their PR should be fired immediately. They've allowed a narrative controlled by hearsay, angry customers, and tech/business blogs and magazines. In their position, I would have acknowledged the breach (because I promise you they know and knew), and clearly explained how a subsequent one would be prevented, BEFORE it got out of the PR team's hands.
Forbes has a small section about it: http://www.forbes.com/sites/thomasbrewster/2016/03/11/kkk-staminus-hacked/#7d247e2c6942
Krebs on Security post: https://krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/
I think whoever's managing their PR should be fired immediately. They've allowed a narrative controlled by hearsay, angry customers, and tech/business blogs and magazines. In their position, I would have acknowledged the breach (because I promise you they know and knew), and clearly explained how a subsequent one would be prevented, BEFORE it got out of the PR team's hands.
Last edited by a moderator:
DomainBop
Dormant VPSB Pathogen
If they were really storing credit card info, including card numbers, in plain text (which is a violation of card industry rules) they legally need to notify their customers of the breach (46 states have data breach notification laws) and they need to notify their card processor. If the plain text rumors are true it puts them at risk of being sued (or fined) by their card processors and by customers who had their info leaked
The PR team now also has to deal with the fact that the first page of search results for Staminus on Twitter and Google now turn up KKK images and references, but I guess if their CEO is willing to accept any customer as long as he can make a buck from them then there's no need to feel sorry for him. From Twitter.
...and the headline from Forbes:
Licensecart
Active Member
In the thread linked to on a website (can't remember) there's a link to a paste.ee which has their clear text card details:
Last edited by a moderator:
I guess Trump didn't disavow hard enough last week, which begs the question, who will pay for Staminus' sins if they don't?
Last edited by a moderator:
DomainBop
Dormant VPSB Pathogen
It looks like we have a winner in the piece of shit whose company I wouldn't touch with a 10 foot pole category. A single homed hosting company in Buffalo is taking this opportunity (a database dump with email addresses of a competitor's customers) to spam Staminus customers.
copy of email (from this LET post)
The slime at ServerMania must be taking their cue from the company that was accused of spamming Staminus customers in 2012 after yet another Staminus leak of customer emails. (old WHT thread http://www.webhostingtalk.com/showthread.php?t=1193478 TLDR: BlackLotus said they were innocent and a competitor was trying to smear them
.
copy of email (from this LET post)
The slime at ServerMania must be taking their cue from the company that was accused of spamming Staminus customers in 2012 after yet another Staminus leak of customer emails. (old WHT thread http://www.webhostingtalk.com/showthread.php?t=1193478 TLDR: BlackLotus said they were innocent and a competitor was trying to smear them
.
Last edited by a moderator:
drmike
100% Tier-1 Gogent
Should be expected that anything controversial is going to be behind filtering. It's just how the hate (pun intended) goes. Plenty of legit businesses who have been attempted victims of DDOS extortion behind filtering also. So not everyone behind filtering is on the wrong side of social norms nor bad people.
In an ideal world, no one would have to take shelter. I can't see utopia existing any time soon though. Pass me the pipe.
@Licensecart PM that site info please.
Last edited by a moderator:
drmike
100% Tier-1 Gogent
Tracked down a bit of the data from the Staminus hack... Working on the rest to see how ugly this really is.
As far as Staminus customers who used a credit card, your data is fully there in a file and details are in PLAINTEXT. Totally a PCI violation and wrong way to handle bankcard data by Staminus and appears to be all customers from when they started this accounting system until current. This is the start of the file:
mysql> select * from credit_card;
+------+-----------------------------------------------+-----------------------------------------------------------+---------------------------------------------+-------------------+----------+---------+-----------+------+------------+
| ID | accountID | firstName | lastName | number | expMonth | expYear | validated | main | cvv |
+------+-----------------------------------------------+-----------------------------------------------------------+---------------------------------------------+-------------------+----------+---------+-----------+------+------------+
| 1 | T--rd | Thomas | W--- | 4--------------3 | 2 | 2009 | 1 | 1 | NULL |
I've dashed out the details to protect the innocent.
IF YOU USED A BANK CARD / CREDIT CARD / DEBIT CARD TO PAY STAMINUS --- CONTACT YOUR BANK AND LOCK THINGS DOWN / GET A NEW CARD ISSUED NOW!!!
As far as Staminus customers who used a credit card, your data is fully there in a file and details are in PLAINTEXT. Totally a PCI violation and wrong way to handle bankcard data by Staminus and appears to be all customers from when they started this accounting system until current. This is the start of the file:
mysql> select * from credit_card;
+------+-----------------------------------------------+-----------------------------------------------------------+---------------------------------------------+-------------------+----------+---------+-----------+------+------------+
| ID | accountID | firstName | lastName | number | expMonth | expYear | validated | main | cvv |
+------+-----------------------------------------------+-----------------------------------------------------------+---------------------------------------------+-------------------+----------+---------+-----------+------+------------+
| 1 | T--rd | Thomas | W--- | 4--------------3 | 2 | 2009 | 1 | 1 | NULL |
I've dashed out the details to protect the innocent.
IF YOU USED A BANK CARD / CREDIT CARD / DEBIT CARD TO PAY STAMINUS --- CONTACT YOUR BANK AND LOCK THINGS DOWN / GET A NEW CARD ISSUED NOW!!!
Last edited by a moderator:
Hrm, yes, true.
*posts perennial drama thread, catalysing next sideshow in the Data Surfacing Security Theatre cycle*
*complains of there being no end to the drama*
Just overclock that logic and formalize it into an endless for loop, chances are the narrative will eventually melt down into a law of diminishing returns.
Last edited by a moderator:
DomainBop
Dormant VPSB Pathogen
CVV numbers should never be stored in any form whether it's encrypted, plain text, or on scraps of used toilet paper. ( see Basic PCI Data Storage Guidelines for Merchants )
drmike
100% Tier-1 Gogent
The schema they have there for storing card details - ALONE - should spell legal implications.
The scumfucks at ServerMania need stopped.
They are nothing more than co-conspirators with the ColoCrossing guys. For a company to dip this low to snag the details and hit customers directly with SPAM means they give no regard and will do anything to lure customers. Hopefully, the type of customers that subscribe to Staminus find ZERO comfort in garbage like Servermania and Colocrossing are doing.
Both of these companies wonder why I've given them so much shit over the years? Boys you just upped my XL serving of unfriendliness that is overdue.
May I remind Colocrossing and Servermania that prior, both of them had puppet facemasked subsidiaries hacked with details public dumped?
copy of email (from this LET post)
The slime at ServerMania must be taking their cue from the company that was accused of spamming Staminus customers in 2012 after yet another Staminus leak of customer emails. (old WHT thread http://www.webhostingtalk.com/showthread.php?t=1193478 TLDR: BlackLotus said they were innocent and a competitor was trying to smear them
The scumfucks at ServerMania need stopped.
They are nothing more than co-conspirators with the ColoCrossing guys. For a company to dip this low to snag the details and hit customers directly with SPAM means they give no regard and will do anything to lure customers. Hopefully, the type of customers that subscribe to Staminus find ZERO comfort in garbage like Servermania and Colocrossing are doing.
Both of these companies wonder why I've given them so much shit over the years? Boys you just upped my XL serving of unfriendliness that is overdue.
May I remind Colocrossing and Servermania that prior, both of them had puppet facemasked subsidiaries hacked with details public dumped?
drmike
100% Tier-1 Gogent
Staminus needs to go fuck off in a confession booth too.
Like not collecting SSNs and Tax IDs + crypto hash on password somehow exempts you from legal action?
I won't say I am making a love package for various attorney generals, but I won't deny it either. I am grabbing the data and seeing beyond PCI compliance busting and entirely retarded plaintext full card details, just what is in there head to toe.
Stupidity like this needs to end with moronic companies. People need to be held accountable.
Like not collecting SSNs and Tax IDs + crypto hash on password somehow exempts you from legal action?
I won't say I am making a love package for various attorney generals, but I won't deny it either. I am grabbing the data and seeing beyond PCI compliance busting and entirely retarded plaintext full card details, just what is in there head to toe.
Stupidity like this needs to end with moronic companies. People need to be held accountable.
Last edited by a moderator: