Warning for all people who have websites

[Gidan]

If you either own or admin a server, or you have an account with a webhost this is for you.

If the server your website is on, or you admin is running cPanel. Get off that box. I can’t give any details, just trust me when I tell you, do not do anything on any server that is running cPanel.

That is all.

[Tikker]

erm, no need infoz

i'm assuming cPanel has been compromised

[Gidan]

Oh and add this

http://news.netcraft.com/archives/2006/ ... ploit.html

USE FIREFOX atleast until MS patches IE for this.

[Gidan]

ger

[Diekan]

If you either own or admin a server, or you have an account with a webhost this is for you.

If the server your website is on, or you admin is running cPanel. Get off that box. I can’t give any details, just trust me when I tell you, do not do anything on any server that is running cPanel.

That is all.

Dude... it's the Internet... not the CIA.

[Gidan]

I could get fired if I give details, would prefer not to.

[Tikker]

In other words, Gidan was supposed to patch something, forgot, and they got jabowned!


ps, i'm kidding

[Gidan]

Now that cPanel has made a public statement of sorts.


One of our hosts had a large chunk of their boxes rooted all at once. We are not talking 10 or 20, we are talking 3 0's on the number of servers for this customer that were rooted. It was done through a backdoor in cPanel that effected any and all versions of cPanel. This vulnerability was so bad that there was no way to secure your server against it. The only thing you needed to root the server was ftp and http access to the server, meaning any person paying $5 a month for a website could have rooted the server at will.

cPanel says they have fixed it, and they do seem to have closed it for now (I spent a good 30 mins trying to crack it and it does appear to be a good fix). On Monday, cPanel should be releasing a full statement, they just want to wait until they are reasonably sure all servers running cPanel have run their auto update before doing so.

I have seen and played with the script that was used, all I can say is cPanel and many of the hosts out there are VERY lucky that it was written by an idiot who wasn't concerned with being found out. Had they taken 10 seconds to clean up a bit in the script, no one would have had any clue.

What made this whole thing worse was the true result of this attack. The guy went into the servers he rooted and changed mod_layout in such a way that every single site on every single server had iframs that loaded sites that had viruses that exploited a security hole in IE. Thousands of users found that they had been infected immediatly after having gone to these websites. Those who used firefox were not effected.