Włamanie do WHMCS

[Gość]

Edytowano Marzec 26, 2018 przez Gość (zobacz historię edycji)

[madrala 0]

Dobrze, że dałeś znać, zastanawiałem się nad whmcs bądź hostbill, chyba pójdzie decyzja na hostbill.

 

Pozdrawiam,

M.

Edytowano Maj 21, 2012 przez madrala (zobacz historię edycji)

[PapaSmerf 497]

Na WHT.com czytałem, że to jednak nie wina silnika, chociaż... kto wie?

[root.ie 0]

 

Following an initial investigation I can report that what occurred today was the result of a social engineering attack.

 

The person was able to impersonate myself with our web hosting company, and provide correct answers to their verification questions. And thereby gain access to our client account with the host, and ultimately change the email and then request a mailing of the access details.

 

This means that there was no actual hacking of our server. They were ultimately given the access details.

 

This is obviously a terrible situation, and very unfortunate, but rest assured that this was no issue or vulnerability with the WHMCS software itself.

 

We are immediately reviewing all of our hosting arrangements, and will be migrating to a new setup at the earliest opportunity.

 

I would like to take this opportunity to thank all of you who have sent in messages of support, and offers of help. It has clearly been a very stressful time, and I thank everyone both personally and on behalf of WHMCS for their loyalty and support.

 

The matter is now in the hands of the FBI.

 

Posted by Matt on Monday, May 21st, 2012

 

Dane już są w sieci! ;x

Edytowano Maj 22, 2012 przez root.ie (zobacz historię edycji)

[Gość]

Edytowano Marzec 26, 2018 przez Gość (zobacz historię edycji)

[Gość Bartosz Gadzimski]

Więc Panowie zmieniać hasła na whmcs.com i pewnie lepiej dane bilingowe (karty).

[sshd 127]

Dziś dostałem email:

 

Unfortunately today we were the victim of a malicious social engineering attack which has resulted in our server being accessed, and our database being compromised.

 

To clarify, this was no hack of the WHMCS software itself, nor a hack of our server. It was through social engineering that the login details were obtained.

 

As a result of this, we recommend that everybody change any passwords that they have ever used for our client area, or provided via support ticket to us, immediately.

Regrettably as this was our billing system database, if you pay us by credit card (excluding PayPal) then your card details may also be at risk.

 

This is just a very brief email to alert you of the situation, as we are currently working very hard to ensure everything is back online & functioning correctly, and I will be writing to you again shortly.

 

We would like to offer our sincere apologies for any inconvenience caused. We appreciate your support, now more than ever in this challenging time.

 

----

WHMCS Limited

www.whmcs.com

[dom 30]

W innym temacie już ten e-mail był.

[R@fi 64]

No to ładnie i gdzie tu teraz uciekać?

EDIT: strasznie muli im strona

Edytowano Maj 22, 2012 przez freecast.pl (zobacz historię edycji)

[Miłosz 2311]

No to ładnie i gdzie tu teraz uciekać?

Pod łóżkiem się schowaj najlepiej

[root.ie 0]

EDIT: strasznie muli im strona

 

Muli ponieważ ich DDOS-ują. Polecam zaglądać na blog: http://blog.whmcs.com/

 

Co do wycieku, najbradziej niepokoić może wyciek numerów kart kredytowych oraz maili systemowych w których zawarty jest login oraz hasło. (mail powitalny oraz odzyskiwanie hasła - jednak po analizie bazy, stwierdzić można iż maile z ostatnich ~2 lat nie zostały opublikowanem, najświeższe są z okolic 2010)

[hostpower.pl 0]

LicensePal wysłało informację że dane używane do zakupu licencji u nich są bezpieczne

.

If you have purchased your license directly through us, then you should not have to worry about your billing information.

 

pzdr

[Gość ASKar]

Nie ma to jak stworzyć klientom iluzję że dane są bezpieczne

[Piotrkowsky 0]

Witam,

posiadam serwer www w firmie, która korzysta z tego oprogramowania. Czy moje dane też mogłby zostać udostępnione?

 

Pozdrawiam

Edytowano Maj 23, 2012 przez Piotrkowsky (zobacz historię edycji)

[webh.pl 229]

posiadam serwer www w firmie, która korzysta z tego oprogramowania. Czy moje dane też mogłby zostać udostępnione?

 

Nie, dane klientów poszczególnych firm hostingowych na chwile obecną są bezpieczne. Jeżeli istniałoby takowe ryzyko to firma hostingowa poinformowałaby swoich klientów.

Edytowano Maj 23, 2012 przez webh.pl (zobacz historię edycji)

[sshd 127]

Dziś dostałem email z informacją na temat pytania ( kiedy wszystko naprawią - poprawki jak i bezpieczeństwo bieżących instalacji ):

 

Hi ,

We are currently making every effort to restore full service and as far as humanly possible, we have done everything possible to ensure it won't happen again.

 

At this time we do not have any details about possible compensation, if compensation is made available in future it will be announced on our website or via email. I would ask you to kindly bear with us, frequent updates are being posted at on our forum so I would ask you please monitor those for further updates on the situation: http://blog.whmcs.com

 

We would like to offer our sincere apologies for any inconvenience caused. We appreciate your support, now more than ever in this challenging time.

 

 

Regards,

John

-------

Forums: http://forums.whmcs.com/

Documentation: http://docs.whmcs.com/

Video Tutorials: http://www.whmcs.com/get-support/video-tutorials/ ----------------------------------------------

Ticket ID: #965847

Subject: Process

Status: Answered

[dom 30]

Ciekawe czy ataki tylko na whmcs były planowane czy też na np. hostbill. Może ktoś się orientuje?

[Misiek08 285]

WHMCS dostawał informacje od wielu stron, że dane są niebezpieczne, ale większość maili olewali, a parę nawet wyśmiali. Cóż, doigrali się.

[sshd 127]

a dziś kolejne powiadomienie na email:

 

Dear Customer,

 

This is a follow up to the Urgent Security Alert email sent earlier this week. As you will be aware from that, we were the victim of a malicious attack which has resulted in our server being accessed, and our database being compromised.

 

As a security precaution, we are expiring all passwords for our client area. In order to restore access to your account, please visit the following url to reset your password:

 

https://www.whmcs.com/members/pwreset.php

 

We have restored all essential services except for our forums, and resumed normal operations as quickly as possible in order to keep licensing and support channels open. We are still actively working to restore the forums, and we expect them to return to operation soon.

 

A full security audit and hardening was undertaken immediately following the breach, and the site remains safe to use. It is important to note that the breach we experienced was the result of a social engineering attack, and not the result of a hack or a breach in the WHMCS software.

 

We continue to experience a distributed denial of service attack, which has caused disruption to our public facing site. We are in the process of moving to a more expansive infrastructure which should mitigate this type of attack in the future. With this move, we will have a much stronger setup with additional layers of security, and these upgrades to our infrastructure will ultimately mean that our servers, and your data, will be better protected than ever before.

 

Please be aware, that in order to deliver these security upgrades, we expect some very brief downtime during the migration process. We apologize in advance for any inconvenience this may cause.

 

While we are all currently focused on security, we would like to take this opportunity to ask everyone to read our Security Guide @ http://go.whmcs.com/22/security

 

While it would be ideal for all steps to be followed, we recommend that you at least rename (http://go.whmcs.com/23/securityfolder), and apply IP protection (http://go.whmcs.com/24/securityip) and/or password protection (http://go.whmcs.com/25/securityadmin) to the admin directory.

 

We are continuing to work tirelessly to resume normal service and regain your trust. On behalf of everyone at WHMCS please accept my apologies for the inconvenience and we thank you for your support.

 

----

Matt

WHMCS Limited

www.whmcs.com