Current time: 04-24-2014, 03:11 PM Hello There, Guest! (LoginRegister)

Post Reply 
Hacked FTP passwords?
06-06-2007, 05:57 AM
Post: #1
Hacked FTP passwords?
Can anyone verify this?

http://www.caydel.com/dreamhost-leaks-35...passwords/

I haven't received any e-mail, but changed my password to be safe...

http://DigitalDisplacement.com
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 06:05 AM
Post: #2
Hacked FTP passwords?
Quote:Can anyone verify this?
Yes. All customers who may have been affected received an email about it last night. I posted about this issue a couple of weeks ago, when the problem first emerged: All my sites hacked - check yours too!

--------
si-blog | Keystone Websites
Save $97 on yearly plans with promo code SCJESSEY97
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 06:19 AM
Post: #3
Hacked FTP passwords?
Ahh, I saw that post and read through it but wasn't sure if it was related since I didn't see anyone else verify.

Shouldn't this be up at Dreamhoststatus.com?

http://DigitalDisplacement.com
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 06:25 AM
Post: #4
Hacked FTP passwords?
Quote:Shouldn't this be up at Dreamhoststatus.com?
DreamHost know exactly which FTP accounts were compromised, so they were able to notify these individuals directly. There is no need for them to blog about it on the status blog - the blogosphere will take care of that anyway :O

--------
si-blog | Keystone Websites
Save $97 on yearly plans with promo code SCJESSEY97
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 06:28 AM
Post: #5
Hacked FTP passwords?
Quote:Shouldn't this be up at Dreamhoststatus.com?
I don't see any advantage or purpose for posting it there - they already directly notified by email all those even potentially affected.

Per the DH letter: "less than 0.15% of the total accounts that we host" were affected - hardly a "system wide" issue at this point. That number is far less than even a single server's users.

Plus, given the clueless and generally dim-witted nature of the typical Status Blog Commenter, can you imagine the "panic" they could work themselves into (OMFG! All my sitez are Hax0red! OMG! I'm losing MONEY! OMG!) Wink

--rlparker
Find all posts by this user
Quote this message in a reply
06-06-2007, 06:36 AM
Post: #6
Hacked FTP passwords?
The blogosphere certainly will Smile And rightfully so, IMHO. When a security hole is found in IE or Firefox that affects a trifling number of users it's still huge news and fixes are very public. It seems Dreamhost trying to keep this quiet goes against their unofficial policy of being very open, a policy that I generally appreciate.

No I don't think they're doing it subversively hoping nobody will find out (obviously they will) but some sort of official statement would go a long way.

http://DigitalDisplacement.com
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 06:42 AM
Post: #7
Hacked FTP passwords?
Quote:It seems Dreamhost trying to keep this quiet goes against their unofficial policy of being very open, a policy that I generally appreciate.
I don't think DH is "trying to keep this quiet" as much as they are just not publicizing the incident. There have been *several* threads on these forums (which have not been censored in any way) as well as considerable discussion on IRC. Additionally, they *had* to realize that once they sent the letter, it would be "big news". Wink

Quote:some sort of official statement would go a long way.
I agree with you there! Wink I suspect as the blogs and forums traffic cranks up they will respond more formally, as that generally seems to be their pattern.

--rlparker
Find all posts by this user
Quote this message in a reply
06-06-2007, 06:59 AM
Post: #8
Hacked FTP passwords?
Regardless, I'm glad you were able to get your issue resolved!

http://DigitalDisplacement.com
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2007, 09:00 AM
Post: #9
Hacked FTP passwords?
<sound of brakes leaving trail of rubber on cement>

Two things here... "There have been *several* threads on these forums" and the claim "DreamHost know exactly which FTP accounts were compromised".

I happen to have read scjessey's post a couple of weeks ago and remember my concern level being upped when he added that much of his web work was custom(i.e., not a lot of known software exploit vectors). So I tried to pay attention to that thread for further info, but any signal was quickly drowned out by the noise of irrelevant topics.

Now, rlparker, you tell us there have been "several" threads on these forums around this topic? I don't doubt you here, but could you be so kind as to point them out? You see, I thought there was something amiss here and started randomly checking my unimportant sites for file modifications every couple of days and checking the forums a bit more frequently on the lookout for additional threads of info on this topic. And now you tell me there were several. I missed them and want to know how I can better filter for such info the next time I'm on the lookout for a particular topic. Notice, I didn't miss this thread because it's title instantly made sense to me and I was already guessing the connection to scjessey's earlier problem.

Speaking of which, scjessey, you're confident that "DreamHost know exactly which FTP accounts were compromised"? Well after reading the letter they're sending out via the URL cited above, I just don't have that confidence. Why are you so confident? It looks to me like DH took some time to get a clue and still don't know/haven't said *how* the accounts were compromised. I suppose folks would suggest that I just change my passwords if I'm concerned about it... but I'm lazy.

If your confidence is rooted in hard information and I have nothing to worry about(having not received such a letter), please throw me a bone of reassurance and I'll rest easy. I don't want any sneaky hackers getting even one extra hit from my admittedly untrafficked sites.

Thanks.

--
jt
Find all posts by this user
Quote this message in a reply
06-06-2007, 09:16 AM
Post: #10
Hacked FTP passwords?
This should ABSOLUTELY be up at DreamhostStatus.com. Dreamhost simply cannot rely on the emails they have sent to customers. For starters, we know email is not 100% reliable and that spam filters can catch valid email. Second, we're dealing with possibly compromised accounts here! Of the 3,500 usernames and passwords stolen, how many do you think were also valid for the users primary email account?

While there may be no evidence that email accounts have been hijacked, Dreamhost has repeatedly said that DreamhostStatus.com is where to find official infomration about dreamhost issues.
Find all posts by this user
Quote this message in a reply
Post Reply 


Forum Jump: