Blueberry3.14 Posted April 1, 2009 Share Posted April 1, 2009 Forgive if this is old news, but http://www.webhostingtalk.com/showthread.php?t=729727 WebHostingTalk was hacked about a week ago (I just learned of it, and no this is NOT an April Fool's prank). The forum restored users and data from a backup taken in October 2008, but a lot of data was still lost. Word on the street is that it was an inside job, but that's purely speculative. Off-site backups were dumped before the databases were emptied, etc. The worst part is that the user database -- with usernames, email addresses and encrypted passwords -- was stolen and distributed on the Internet. So go change your password if you had a user account there, especially if it was a weak one. Link to comment Share on other sites More sharing options...
bear Posted April 1, 2009 Share Posted April 1, 2009 but that's purely speculative. Extremely speculative. Link to comment Share on other sites More sharing options...
Redsign Posted April 1, 2009 Share Posted April 1, 2009 It needed a prune anyway- so many threads like Can I host websites from my desktop pc? and everyone there recommends a VPS for anything Ben Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted April 1, 2009 Author Share Posted April 1, 2009 Extremely speculative. I don't agree, but to each his/her own Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted April 1, 2009 Author Share Posted April 1, 2009 It needed a prune anyway- so many threads like Can I host websites from my desktop pc? and everyone there recommends a VPS for anything Ben Gawd, yes. Link to comment Share on other sites More sharing options...
bear Posted April 2, 2009 Share Posted April 2, 2009 I don't agree, but to each his/her own Based on what? Link to comment Share on other sites More sharing options...
Blueberry3.14 Posted April 6, 2009 Author Share Posted April 6, 2009 Based on what? Based on numerous opinions I've read, including that of Reed Caldwell, the CEO of ServInt (in a non-public forum, or I'd link the thread). The methods used, etc. Just my opinion. You're free to form your own. Whatever. *shrugs* Link to comment Share on other sites More sharing options...
bear Posted April 6, 2009 Share Posted April 6, 2009 Based on numerous opinions I've read, including that of Reed Caldwell, the CEO of ServInt (in a non-public forum, or I'd link the thread). The methods used, etc. I say again, extremely speculative, as Reed would know nothing more than was released to the public. He, you, and everyone else is guessing without all the facts, I'm fairly certain. It remains to be seen if they know who was behind it, so if and when that becomes public, we'll all find out. Link to comment Share on other sites More sharing options...
Chrisw Posted April 7, 2009 Share Posted April 7, 2009 Hmm, Ok I guess the rapidshare links that everyone was downloading of the tables and Lxlabs helpdesk was "hacked" since they were able to get his password as it was the same as his WHT password is all speculative? Either way, what we know is what we know. What you don't is speculative Link to comment Share on other sites More sharing options...
bear Posted April 7, 2009 Share Posted April 7, 2009 Hmm, Ok I guess the rapidshare links that everyone was downloading of the tables and Lxlabs helpdesk was "hacked" since they were able to get his password as it was the same as his WHT password is all speculative? What is this referring to? Either way, what we know is what we know. What you don't is speculative Who was this directed at? Link to comment Share on other sites More sharing options...
HostOrca Posted April 7, 2009 Share Posted April 7, 2009 Based on numerous opinions I've read, including that of Reed Caldwell, the CEO of ServInt (in a non-public forum, or I'd link the thread). The methods used, etc. Just my opinion. You're free to form your own. Whatever. *shrugs* And that's all it is, an opinion. It's not proof, just sheer speculation. If you think you've got proof, then contact inet and inform them. It also appears that you have a problem if someone elses opinion differs from yourself, I think it's time to prove it, or move on. Link to comment Share on other sites More sharing options...
Daniel Posted April 7, 2009 Share Posted April 7, 2009 I find it appalling that it's happened again - and this time credit card information was made available for download. I can see iNet getting in a lot of trouble over this. Link to comment Share on other sites More sharing options...
bear Posted April 7, 2009 Share Posted April 7, 2009 Thread cleaned, back on topic, pretty much. Please keep it that way. Link to comment Share on other sites More sharing options...
readywire Posted April 7, 2009 Share Posted April 7, 2009 Take WHT's misfortune as a reminder to take a security audit of all of your servers. Link to comment Share on other sites More sharing options...
rslyon Posted April 7, 2009 Share Posted April 7, 2009 This hacker was even able to delete offsite backups. This is very worring for such a company. Link to comment Share on other sites More sharing options...
UnderHost Posted April 8, 2009 Share Posted April 8, 2009 The hacker have now, submit to public entire DB from webhostingtalk. Credit Card, information and users table. Link to comment Share on other sites More sharing options...
PingEx.com Posted April 8, 2009 Share Posted April 8, 2009 it is rather concerning, especially that its a second time. Link to comment Share on other sites More sharing options...
bear Posted April 8, 2009 Share Posted April 8, 2009 Actually, if you read the announcement from inet, it's still a result from the first time, not a second time. The intruder simply hadn't released everything at first. Link to comment Share on other sites More sharing options...
wise Posted April 8, 2009 Share Posted April 8, 2009 or perhaps WHT did not admit that it *could* have been taken when it took place... 27th march was when WHT was eventually secured several days after the hack. Now many days after - its been released CC info including cvv details were taken. WHT have a responsiblity both legally and morally which they have both misled WHT users and illegally held CC information. People now are cancelling credit cards, yet if they had been cancelled 27th march, some would not be facing big CC charges made by fraud. Link to comment Share on other sites More sharing options...
Emerson Posted April 9, 2009 Share Posted April 9, 2009 Hopefully this will be a wake up call to everyone and for Matt to implement payment systems like Quantum Vault or authnet's PIM to avoid anything like this happening to any of us. As you see no matter how "secure" you have your system if they want it they WILL get it. Quantum Vault or authnet PIM would help with this. Link to comment Share on other sites More sharing options...
merlinpa1969 Posted April 9, 2009 Share Posted April 9, 2009 Looks like they got information that should have been purged from the system along time ago..... If I read correctly the cc info that was actually obtained was OLD..... I realize dosnt matter that its old it was still taken, this is true. but from reading the information that was obtained was NOT encrypted Link to comment Share on other sites More sharing options...
bear Posted April 9, 2009 Share Posted April 9, 2009 or perhaps WHT did not admit There is no conspiracy here, and no failed admissions. It simply did not appear to be an issue while they were investigating. It only came to light later. I'm not defending the issue, just the claim that they were somehow intentionally withholding information. That simply isn't true, to the best of my knowledge. some would not be facing big CC charges made by fraud. CC holders are not responsible for charges made through fraud, and as soon as it was discovered the CC companies were notified, as required. Looks like they got information that should have been purged from the system along time ago.....If I read correctly the cc info that was actually obtained was OLD..... This was my understanding as well. Link to comment Share on other sites More sharing options...
Lawrence Posted April 10, 2009 Share Posted April 10, 2009 Looks like they got information that should have been purged from the system along time ago..... If I read correctly the cc info that was actually obtained was OLD..... I realize dosnt matter that its old it was still taken, this is true. but from reading the information that was obtained was NOT encrypted No, there was alot of still-very-valid credit card information in the database as well Link to comment Share on other sites More sharing options...
merlinpa1969 Posted April 10, 2009 Share Posted April 10, 2009 what I read was that the card info that was grabbed was old and should have been purged.. the new system is at least encrypted Link to comment Share on other sites More sharing options...
Lawrence Posted April 11, 2009 Share Posted April 11, 2009 what I read was that the card info that was grabbed was old and should have been purged.. the new system is at least encrypted I have been advised that there were about 300 current and active cards as well. Link to comment Share on other sites More sharing options...
Recommended Posts