ChicagoVPS / CVPS Hacked. New SolusVM exploit? [PT 2/2]

210 posts in this topic

Posted (edited)

NOTICE

 

EDIT: Original thread content here: http://vpsboard.com/topic/984-chicagovps-cvps-hacked-new-solusvm-exploit-pt-1

 

The thread had to be split into two after some errors. All original posts have been restored in that thread. Further discussion can be had within this thread.

 

-MannDude

 

(Sorry Magiobiwan, could not remove your post as it's the first one so I had to edit it to display this message)

Edited by MannDude
Trying to fix stuff.

Share this post


Link to post
Share on other sites

Posted

Chris has been very vague in his response to me personally today.  

 

17316044_screenshot.png

 

I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.

Share this post


Link to post
Share on other sites

Posted

Ran a bunch of lookups for folks here to see if their details were in the dump.

 

I can confirm if you cancelled your services after the last hack in November - February, your details probably aren't in there.

 

Anyone else want info looked up, PM me.  

 

Will be back in a bit.

Share this post


Link to post
Share on other sites

Posted

Just thought to drop by and mention that i just got the email with the report (that update which was posted several hours ago).

Share this post


Link to post
Share on other sites

Posted

Chris has been very vague in his response to me personally today.  

 

17316044_screenshot.png

 

I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.

Share this post


Link to post
Share on other sites

Posted

Chris has been very vague in his response to me personally today.  

 

17316044_screenshot.png

 

I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.

If your site and email is same as the username here then you are in it :(

Share this post


Link to post
Share on other sites

Posted

Chris has been very vague in his response to me personally today.  

 

17316044_screenshot.png

 

I also had someone grep my username for the Client Area in the stolen data.  It came back 0 results.

yes, your e-mail address would not be hard to guess based on your username, Marc ;) 

Share this post


Link to post
Share on other sites

Posted

 

 

From Pingdom's monitoring shows 19 servers that are broken....

Share this post


Link to post
Share on other sites

Posted

they are indeed working on it! Last time i checked pingdom, 3 out of the 4 servers in atlanta were offline! now Just 1 is left.

Same for Buffalo! 4 servers were down .. now just 2 ... and i happen to be on the one that is down (facepalm)

Share this post


Link to post
Share on other sites

Posted

they are indeed working on it! Last time i checked pingdom, 3 out of the 4 servers in atlanta were offline! now Just 1 is left.

Same for Buffalo! 4 servers were down .. now just 2 ... and i happen to be on the one that is down (facepalm)

We are probably in the same server.  How do you know what server you are on?

Share this post


Link to post
Share on other sites

Posted

We are probably in the same server.  How do you know what server you are on?

 

I am on 192.227.129.xxx subnet ... that's BUF19. through the CP back in its working days.

Anything in buffalo other than that will be on BUF17

Share this post


Link to post
Share on other sites

Posted

I think this thread should just be closed.  If there is anymore real news about this, I think we can open a new thread, or even better, post it in the cest pit.  There is enough CVPS PR threads open here already.

 

Cheers!

Share this post


Link to post
Share on other sites

Posted

This is just ridiculous.  Closed.  

Share this post


Link to post
Share on other sites

Posted

Ok this topic has been re-opened after cleaning up a bit.  Please keep the discussion focused on the topic.  The other discussion can be found here: http://vpsboard.com/topic/777-personal-arguments/

Share this post


Link to post
Share on other sites

Posted

Thanks mod for cleaning this mess up.

 

You know cVPS an update no matter how small it is would really be helpful, even if it is small.

Share this post


Link to post
Share on other sites

Posted

Jfreak, we are still working to get the remaining nodes online.

Share this post


Link to post
Share on other sites

Posted

How much warning do you need as a software provider about your code being poorly written? And why do you write code like this? Sorry, but I can't fault any provider that was hit by this attack, and all I can say is that I am sorry that some of you guys had to suffer because of this:

<?php
if ($_POST['delete']) {
    $xc = $db -> query('SELECT * FROM centralbackup WHERE id = \'' . $_POST['deleteid'] . '\'', true);
    #[...]
    if ($xc[status] == 'failed') {
           exec('php /usr/local/solusvm/system/bus.php -- --comm=deletebackup --serverid=' . $xc['bserver'] . ' --nodeid=' . $vdata['nodeid'] . ' --vserverid=' . $vdata['vserverid'] . ' --filename=' . $xc['filename']);
    #[...]
    }
 }
?>
Hasn't anyone decrypted the source? Couldn't they then run a search for dumb execs?

 

@D. Strout There's been a decoded version floating around the web for a while now, I guess that's how the vulnerability was found and exploited in the first place. Pretty lame, but it is what it is.

 

Guys, here is something simple that you should do immediately: restrict access to the admin path. Restrict it by IP, with a password, or ideally both. @Kujoe had some good advice as well on how to secure SolusVM.

 

Kind regards,

Marc

Share this post


Link to post
Share on other sites

Posted

Has anyone heard back from Solus yet?

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now