Server hacked for more than 24 hours

worldview · #1 (**permalink**) 14-05-11, 01:10 AM

I have been very disappointed with your service the past 2 days, as my site has been almost permanently defaced by hackers due to your server having security issues and constantly being defaced/hacked again whenever your support-team has reverted to the correct files.

This is really getting critical and the problem is not yet solved even though it has been promissed several times by your chat-support team.

**sysadmin** · #2 (**permalink**) 16-05-11, 02:12 PM

Quote:

Originally Posted by worldview

I have been very disappointed with your service the past 2 days, as my site has been almost permanently defaced by hackers due to your server having security issues and constantly being defaced/hacked again whenever your support-team has reverted to the correct files.

This is really getting critical and the problem is not yet solved even though it has been promissed several times by your chat-support team.

Hi Henrik,

Apologies for the delay in replying. The above mentioned problem has been rectified & your site is back to normal now. It was a bug in the DNP control panel which caused this problem. Once again, we're very sorry for the inconvenience you've faced.

worldview · #3 (**permalink**) 24-05-11, 10:03 AM

My site is now hacked again, even though I several times was told by support that the problem had been fixed permanently.

I was even instructed to set read-only permissions on my FTP-Account, which I did.

I really don't understand how you can have such unsecure servers.

What is the reason this time?

**sysadmin** · #4 (**permalink**) 24-05-11, 04:12 PM

Quote:

Originally Posted by worldview

My site is now hacked again, even though I several times was told by support that the problem had been fixed permanently.

I was even instructed to set read-only permissions on my FTP-Account, which I did.

I really don't understand how you can have such unsecure servers.

What is the reason this time?

Hi, can you provide me which site is hacked now? As we've resolved all the security related issues, none of the sites which are running on the DNP clusters should be affected now. Let me know the domain name & I'll get it sorted out right away if it has to do with the permissions.

worldview · #5 (**permalink**) 24-05-11, 11:29 PM

Yes - the site is hacked again even though your support have temporarily solved the problem previously today. Your system says I'm not allowed to post the URL in this Forum, but I have written to your support several times today, so you should know.

Time is now 00:25 AM and the site has this time been down since 09:13 PM without your monitoring of the server noticing any error.

I will now contact your support to have it solved again, but currently all pages of the site are defaced again with the message - ..::Indian Hackers on their Way::.. - just like happened previously today.

danaos · #6 (**permalink**) 25-05-11, 06:54 AM

My site got hit by the same Indian Hackers defacement yesterday morning - spent hours last night cleaning it up, changed the FTP and DNP logins and passwords and left the website turned off overnight, woke up this morning to find it it all defaced again (checked via FTP). Given that there are files written into folders that the FTP account can't even access (such as the IIS6 logs files folder, verified from DNP file manager) it's clear that the FTP account details have not been compromised.

Have had confirmation from "Alfred" in support via chat at 7:45 (UK time) this morning that it's a server-wide hack and not account specific and that they are "working on it". Looks like they either haven't kept IIS patched up, or DNP, or both.

craigedmonds · #7 (**permalink**) 25-05-11, 08:08 AM

which server is this?

I have a few sites on a windows reseller account and they are not accesible.

worldview · #8 (**permalink**) 25-05-11, 08:34 AM

Not sure what the server is called, but the IP is 109.203.96.6.

Thanks for your feedback, danaos.

I can imagine that you are just as frustrated with the Webhosting UK service as me.

My site is still down - since 09:13 last night and I never received e-mail feedback from Webhosting UK support as promissed several times. In fact nothing was solved during the night, and the hacking/deface of the site continued until 06:41, so it is hard to see that they were "working on it" during the night.

From 06:41 till 09:30 AM the site returned a 404 error.

Now the hacking problem is back again. In other words, this reoccuring hacking problem is still not solved.

My satisfaction with Webhosting UK is currently very low,

craigedmonds · #9 (**permalink**) 25-05-11, 09:21 AM

Yes thats the server a few of my sites are on also.

I have a few sites on there to test the quality of the service but seems like its not great.

Yeah, I am not very happy at the moment with WHUK either.

craigedmonds · #10 (**permalink**) 25-05-11, 09:26 AM

here is what my client is looking at.

http://screencast.com/t/jMb1rOpR6k

WELL DONE WHUK for allowing this.

worldview · #11 (**permalink**) 25-05-11, 09:44 AM

Quote:

Originally Posted by craigedmonds

here is what my client is looking at.

2011-05-25_1124 - CraigEdmonds's library

WELL DONE WHUK for allowing this.

Yes, this illustrated screencast is exactly the same Indian Hack that is currently shown on all pages of my site. It is extremely unprofessional that this is possible - and not least that the technicians are not able to solve the issue patching the server. This issue is apparently affecting all sites of the server, with no regards to the security level of the individual site as documented by danaos previously today.

Last time I reported the issue the explanation from Webhosting UK was a bug in the DNP control panel.

I was just told that it will be another 2 hours before my site is back to normal. This is just not good enough. I hope everybody can agree!

danaos · #12 (**permalink**) 25-05-11, 10:34 AM

Quote:

Originally Posted by worldview

Not sure what the server is called, but the IP is 109.203.96.6.

Yep, that's the IP, it's webserver1.ukdnp.com

Quote:

Originally Posted by worldview

Thanks for your feedback, danaos.

I can imagine that you are just as frustrated with the Webhosting UK service as me.

Very frustrated. Took 2 hours clearing it out last night after being told it was my fault, only to find this morning it was defaced again. My business website has now been out of action for more than 24 hours. I've run servers and sites myself (both for 16 years where I work, and have a VPS of my own with BWF), this WHUK account is actually one I'm working on for a client and is the first time I've had to deal with a defacement. I foolishly thought that a big host like WHUK would be on top of security issues and keep things patched to the hilt, but obviously I was misguided.

Quote:

Originally Posted by worldview

My site is still down - since 09:13 last night and I never received e-mail feedback from Webhosting UK support as promissed several times. In fact nothing was solved during the night, and the hacking/deface of the site continued until 06:41, so it is hard to see that they were "working on it" during the night.

From 06:41 till 09:30 AM the site returned a 404 error.

Now the hacking problem is back again. In other words, this reoccuring hacking problem is still not solved.

My satisfaction with Webhosting UK is currently very low,

Same here. I've left the site I'm working on turned off in DNP, although I too see a 404 is being returned which suggests that there's more to this than just a simple defacement.

worldview · #13 (**permalink**) 25-05-11, 11:08 AM

Thanks, danaos,

Actually I had a similar negative experience with Webhosting UK support, when I initially reported the problem less than two weeks ago.

I also received different replies and explanations depending on who I spoke to. One also suggested that the fault was mine. I followed his suggestions to change passwords, and remove write-access from the FTP-user, which I found very odd. As we can conclude it has nothing to do with the site itself - but the general server security.

I also chose Webhosting UK as my UK-based hosting company, as I thought it was a big, secure and professional company, but this has certainly not been my experience with Webhosting UK. I really hope they will give a thorough explanation soon.

Two hours ago a chat-supporter told me that my site would be back online within two hours - that was not true either. My site is still defaced/hacked - now for 15 hours.

**James** · #14 (**permalink**) 25-05-11, 11:39 AM

Please let me know the domains which are affected I will get it sorted.

worldview · #15 (**permalink**) 25-05-11, 11:55 AM

James, I have sent you an e-mail regarding the site, which currently says Service Unavailable or Directory Listing Denied.