[important]Exploit!

[MattW]

Interesting development!

http://www.webhostingtalk.com/showpost.php?p=8569905&postcount=1187

 

[Brent W]

Glad I don't use CPanel

 

[MattW]

Glad I don't use CPanel

I have CPanel on my VPS, but I've never needed support with it

 

[Adam Howard]

Did you put all those files you had upload to the new server on the LiveCD?

YES... I have an old computer that I use just for connecting my site. I do not surf anywhere else with it or use it for anything else. It's basically stripped down with only on board video (VGA), an old network card, no sound card, no hard drive, and only a DVD drive with 4gb of ram.

I boot up, I connect to my site, and then I shut down. Nothing else.

We also have no ads on our site.

 

[p4guru]

YES... I have an old computer that I use just for connecting my site. I do not surf anywhere else with it or use it for anything else. It's basically stripped down with only on board video (VGA), an old network card, no sound card, no hard drive, and only a DVD drive with 4gb of ram.

I boot up, I connect to my site, and then I shut down. Nothing else.

We also have no ads on our site.

what about your web host's staff consoles if they have access to your server, compromise could be from web host's staffs' pcs ?

 

[AWS]

YES... I have an old computer that I use just for connecting my site. I do not surf anywhere else with it or use it for anything else. It's basically stripped down with only on board video (VGA), an old network card, no sound card, no hard drive, and only a DVD drive with 4gb of ram.

I boot up, I connect to my site, and then I shut down. Nothing else.

We also have no ads on our site.

You're better, to be safe, do some scanning of that box. Without a doubt the problem was on the user end and not the server end.

One of the admins on one of my sites had his home computer hit by a similar exploit a couple months ago. Used his account to drop malware on the server that would redirect users to a site and infect them. When I told him that it was his account that was hacked at first he didn't believe it. Then he scanned his box and sure enough he had a rootkit and keylogger on it. His scanner was up to date as was MalwareBytes and neither caught it. An online scan found it.

 

[SneakyDave]

Same thing happened to a small orange a year or 2 ago.

 

[Adam Howard]

You're better, to be safe, do some scanning of that box. Without a doubt the problem was on the user end and not the server end.

Scan what? No physical hard drive.

Live CD of Linux .... ie... Temporary in ram memory, shutdown and its all gone. Boot again, fresh start. That is how a Live CD works. It's like a fresh install every time you reboot.

 

[Adam Howard]

what about your web host's staff consoles if they have access to your server, compromise could be from web host's staffs' pcs ?

Hmm....

As this is a VPS which allows me to pick from pre-made images .....

.... You maybe onto something......

 

[pvasko]

thanks for information...