Web host breach may have exposed passwords for 6,000 clients
Names, addresses and phone numbers also at risk
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Layered Technologies has been targeted by malicious hackers who may have stolen passwords and other personal details on as many as 6,000 of its clients, the Texas-based web host provider warned. It is advising customers to change login credentials for all host details submitted in the past two years.
The Monday evening breach was executed by attacking an off-the-shelf application integrated into the company's support desk that manages help tickets submitted by customers, according to Layered Technologies President Todd Abrams. It remains unclear if the intruders actually took the information, but the attack had the potential to expose names, addresses, phone numbers, email addresses and server login details for five to 6,000 clients.
"Based on the log entries I'd say it's very unlikely they took a copy of the database," Abrams said. "It's not like a two-second download." He said the company wanted to err on the side of caution by asking all customers to change all passwords.
Payment details are stored in a separate system, so credit card credentials were not exposed unless a customer had opened a help ticket and included them in it, according to Abrams. Similarly, scanned IDs that some customers are required to submit when renting a server were also not routinely stored in the help-desk system. he said.
The perpetrators accessed the database by attacking an application known as Cerberus. According to this page on Secunia, at least 11 vulnerabilities have been documented in various Cerberus tools, only one of which carried a "highly critical" severity rating. It was unclear what version of Cerberus Layered Technologies Layered Technologies uses.
(In Greek Mythology, Cerberus is the three-headed dog who stood guard over Hades. So why would marketers name a support desk app after a vicious canine responsible for tormenting damned souls trying to escape their frigid confines?)
The attack on Layered is part of a growing trend in cybercrime in which hackers target a single web host rather than the thousands of individual sites that that rely on it for service. In May, Brinkster.com required customers to change their login credentials after discovering many of them may have been compromised. Other hosts who have been penetrated include PlusNet and IPOWER.
Layered Technologies claims to be "one of the five largest global providers of on-demand hosting and utility computing solutions" and provides dedicated and managed server hosting services to small and medium-sized businesses. The company has "launched a series of initiatives to enhance and to protect," some of which are being implemented immediately, it said without elaborating. ®
COMMENTS
Sticks and stones.
Hey Curtis,
Opinions are so subjective, but such vitriol is rather unbecoming for anyone.
If you'd taken the time to visit our project site or forums and voice your concerns constructively, you'd also see we're very strong critics of our own inefficiencies and kludge when they're discovered. Sometimes you don't find such things until people are pushing the system in a way that wasn't anticipated, but should be supported.
Our 4.0 release is the result of a 9 month rewrite to address community concerns on usability, simplicity and efficiency in such environments. This is a 5 year old project, most everybody understands improvement is an ongoing, iterative thing based on their thoughts and feedback.
-Jeff Standen, Chief of R&D
WebGroup Media LLC (Developers of Cerberus Helpdesk)
Saw that on coming
I've been sending layered Tech reports for 4 weeks now that they had compromised systems that my Denyhost kept blocking, and I never got a response.
Now we know what else those systems were doing.
Cerberus: I had the mispleasure of being exposed to Cerberus at one contract where I was the escalation support for the Help Desk. Cerberus was the right name, but it was keeping the support staff *in* hell...
Secunia Vulnerbilities Status Summary
Okay, here's the list of all seven of the Secunia vulnerabilities listed as Cerberus Helpdesk ( http://secunia.com/search/?search=cerberus -- Cerberus FTP Server is a different company and product), and what I've found out about them:
http://secunia.com/advisories/15641/ is 2.x only. I have confirmed that the vulnerability is not in current code.
http://secunia.com/advisories/17431/ is 2.x only. The 3.x attachment_send.php requires the correct thread_id to go with the file_id, and that combination would be difficult (though not impossible) to guess, since the thread_id is only ever exposed in tickets to which the user already has access. I've added a check to make sure that only a logged in user can access attachment_send.php.
http://secunia.com/advisories/18112/ is reported against 2.x, but some of the SQL injections had not been fixed. The XSS reported is not reproducible in 3.x. The SQL injections reported that had not previously been fixed have now been fixed.
http://secunia.com/advisories/18657/ is 2.x only. I have confirmed that the vulnerability is not in current code.
http://secunia.com/advisories/21706/ is 2.x and 3.x, but it was fixed in 3.2.
http://secunia.com/advisories/22418/ is 3.x, but was fixed in October of '06.
http://secunia.com/advisories/23193/ is 2.x and 3.x. The vulnerability is listed against spellwin.php, but spellcheck.php has the same problem. This is still (theoretically) present and might work if register_globals is on and the Moon is in the proper alignment with Mars, but I couldn't get them to pop up on my dev machine...
The fixes made today will be pushed to our public CVS repository ( http://cerberusweb.com/cvsweb.pl ) shortly.
-Hildy, Cerberus Helpdesk Developer
WebGroup Media LLC
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
