Five Wordpress sites hacked (servage.net)

Forums › IT Pro and developers › Five Wordpress sites hacked (servage.net)

1 | 2 | 3 | 4 | 5

puttitat

11 posts

Geek
Inactive user

#469465 16-May-2011 06:06

Do anyone know a reasonably priced VS in the EU?

In Denmark the cheapest VS solution is USD $250 a month, that seems a bit steep compared to the $20... ;)

boby55

1539 posts

Uber Geek

Trusted

#469467 16-May-2011 07:11

You could go to leaseweb and get one of their express dedicated servers

Or Self plug we offer VPS's, Shared hosting & Dedicated servers depending on your requirments

/self plug

puttitat

11 posts

Geek
Inactive user

#469483 16-May-2011 08:40

I envy your speedtest :P Not because my line is slower - it ain't! (Yeah, I'm one of the first households in the world with a full blown 1/1 gig line, dedicated!), but you live closer to a FAST speedtest source... :) My issue is that the power lines in my house is.. Ehm... Buggy.. So I can come home after a weekend vacation to a house thats totally blacked out... Not optimal for hosting!

I'm just too used to unl. space and traffic, but realistically it's 5gig space and maybe 10gig transfer, tops... I have a spare Windows Server 2008 license if I can use that on a VS.

dman

953 posts

Ultimate Geek

#469670 16-May-2011 15:04

mattwnz:

Absolutely right. I think you are best to get dedicated quotas, so at least you know what you are getting. But even then there are many companies that oversell. Most websites do use very little in the way of diskspace and traffic anyway, and if you need that diskspace for email, you are best to use Gmail for your email, which provdes GB's of data on a very reliable network at no cost.

Indeed, Google Apps is the way to go for email! (not only for the storage space, but also the power of the gmail interface is awesome) Is completely free too if you're ten or less people.

And I second the comment about getting a VPS if you can afford it, which isn't too hard as you can get a local NZ VPS for $25/month

https://www.youtube.com/c/SoundSpeeding

robbyp

1199 posts

Uber Geek

#469695 16-May-2011 15:26

michaelmurfy: I hear about this sort of thing all the time with Shared Hosting Providers and all I can say is if it's a important site avoid them like the plague. I would recommend grabbing a Virtual Server which gives you control over the whole server at a affordable rate. My site has been hosted on one for years + I am also hosting a few high traffic websites without issues.

It may be more work, but it's totally worth it. The 2 Virtual Server providers I recommend are Unleash and Linode - While Unleash might be a tad more expensive since it's hosted in NZ the staff are very knowledgeable and the servers are fast. Linode is about the same, the staff are always there to help you out + the servers are fast, the only downside is they are hosted in America but I do find that the speeds are excellent netherless - Both of these providers offer free native IPv6 too ;)

If you can afford $20US per month to host your site, go Virtual! I am sure you have a friend that can help you out in exchange for you hosting their site too ;)

I wouldn't paint all shared hosting with the same brush. Sure that maybe the case with some cheap providers, but with most things, you get what you pay for. VPS requires a lot of your own time invested in making sure everything is setup and running and regularly updated etc, which costs a lot of money in terms of time. It comes down to how much you value that time. The same quality could be achieved by using a high quality shared web host. I have never had hacking problems with the shared hosts I have used, and when there has been problems, such as harddrive failure, the host has restored the site back from their backups.

ChrisR

16 posts

Geek

#469841 16-May-2011 20:08

puttitat:
ChrisR:
That's pretty convincing ... what did Servage say when you pressed them on how that password could have been cracked?

Servage Support:

Hello Troels,

We are sorry for the incident. And, no, we don\'t have back ups. But, also, please understand that Servage is not in charge if FTP accounts are hacked. The user is in charge for using long and elaborated passwords and to change the passwords from time to time to increase the security.

We ask you to clean the application from malicious code and to secure your account. Thank you.

Kind Regards
Helge, Support
Servage Hosting

Please do laugh out loud! That must be a joke.

Yeah, I got the same message - and you're right - it's a joke. I wouldn't let them get away with that - just keep asking them how a brute-force attacker could beat your complex password ... because if this wasn't a brute-force attack on our customer accounts and was something else then they haven't fixed the problem and they need to know it. Our password was quite secure too so I was amazed when they said that it was the entry point.

puttitat

11 posts

Geek
Inactive user

#469843 16-May-2011 20:15

The entry point is clearly some outdated and insecure script. Maybe osCommerce, Wordpress, who knows. I'm just 100% sure that my FTP account wasn't brute forced, I suspect it is the customer database that is compromised, as I used the same login credentials for my Servage Control Panel.

It seems odd that it was the main account user name that was used, and not the more obvious extra FTP accounts I've set up for access to the root of the different sites.

My user name has nothing to do with any of my site's names. Nothing at all.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

ChrisR

16 posts

Geek

#469857 16-May-2011 20:37

puttitat: It seems odd that it was the main account user name that was used, and not the more obvious extra FTP accounts I've set up for access to the root of the different sites.

My user name has nothing to do with any of my site's names. Nothing at all.

Very interesting - I think that is the same with our account too - it was probably using the same account/password combo as the Control Panel login and we have a dummy FTP account that points to a DMZ folder that would have been much easier to brute-force crack but this was left in tact.

boby55

1539 posts

Uber Geek

Trusted

#469859 16-May-2011 20:42

puttitat: I envy your speedtest :P Not because my line is slower - it ain't! (Yeah, I'm one of the first households in the world with a full blown 1/1 gig line, dedicated!), but you live closer to a FAST speedtest source... :) My issue is that the power lines in my house is.. Ehm... Buggy.. So I can come home after a weekend vacation to a house thats totally blacked out... Not optimal for hosting!

I'm just too used to unl. space and traffic, but realistically it's 5gig space and maybe 10gig transfer, tops... I have a spare Windows Server 2008 license if I can use that on a VS.

I don't really get your post but yes if you wanted a VPS (VS) We let you use your own Windows License

Edit: I'd be willing to offer a Discounts if members are interested Just pm me :).

And to the people above,

The advantages of a VPS is much greater than the disadvantages, and if for most Popular Scripts we provide a free maintenance option which we back up and ensure your software is upto date.

puttitat

11 posts

Geek
Inactive user

#469861 16-May-2011 20:43

ChrisR:
Very interesting - I think that is the same with our account too - it was probably using the same account/password combo as the Control Panel login and we have a dummy FTP account that points to a DMZ folder that would have been much easier to brute-force crack but this was left in tact.

What a coincidence... I think Servage has got a bigger problem than they'll admit.

boby55:

I don't really get your post but yes if you wanted a VPS (VS) We let you use your own Windows License

Can I see your pricing anywhere?

boby55

1539 posts

Uber Geek

Trusted

#469867 16-May-2011 20:50

puttitat:
ChrisR:
Very interesting - I think that is the same with our account too - it was probably using the same account/password combo as the Control Panel login and we have a dummy FTP account that points to a DMZ folder that would have been much easier to brute-force crack but this was left in tact.

What a coincidence... I think Servage has got a bigger problem than they'll admit.

boby55:

I don't really get your post but yes if you wanted a VPS (VS) We let you use your own Windows License

Can I see your pricing anywhere?

We haven't "Officially Released" our VPS plans yet so I have PM'd you

jbard

1377 posts

Uber Geek

#469870 16-May-2011 20:57

boby55:
puttitat:
ChrisR:
Very interesting - I think that is the same with our account too - it was probably using the same account/password combo as the Control Panel login and we have a dummy FTP account that points to a DMZ folder that would have been much easier to brute-force crack but this was left in tact.

What a coincidence... I think Servage has got a bigger problem than they'll admit.

boby55:

I don't really get your post but yes if you wanted a VPS (VS) We let you use your own Windows License

Can I see your pricing anywhere?

We haven't "Officially Released" our VPS plans yet so I have PM'd you

Could you also PM me, cheers :)

boby55

1539 posts

Uber Geek

Trusted

#469877 16-May-2011 21:05

jbard:
boby55:
puttitat:
ChrisR:
Very interesting - I think that is the same with our account too - it was probably using the same account/password combo as the Control Panel login and we have a dummy FTP account that points to a DMZ folder that would have been much easier to brute-force crack but this was left in tact.

What a coincidence... I think Servage has got a bigger problem than they'll admit.

boby55:

I don't really get your post but yes if you wanted a VPS (VS) We let you use your own Windows License

Can I see your pricing anywhere?

We haven't "Officially Released" our VPS plans yet so I have PM'd you

Could you also PM me, cheers :)

PM Sent

1 | 2 | 3 | 4 | 5