DreamHost nightmare attack sparks passwords reset
Hackers inappropriately touched customer database
US-based hosting firm DreamHost is advising customers to change their passwords following a database breach.
The firm warned on late on Friday that hackers had compromised customer FTP/shell access passwords. DreamHost began the process of resetting customer passwords over the weekend, a process that hit a few hiccups along the way (if entries on its status update page are any guide). Web panel passwords, email passwords and billing data were not affected by the breach, the company said. These passwords have also been reset as a precaution.
Compromised passwords could potentially be used to change the content of hosted sites or to (more likely) insert malicious code. The motives of the hackers – much less their identity – remains unclear.
In a blog post, DreamHost chief exec Simon Anderson said the company had been hit by a "previously unknown" attack. He attempted to allay fears by saying nothing bad had happened to customers as a result of the breach, possibly because DreamHost reacted quickly once a breach was detected.
"The bad news is that we detected access to one of our databases and took rapid action to protect customer accounts and passwords," it said. "The good news is that it does not appear that any significant malicious activity has occurred on any customer accounts as a result of the illegal access.
"Early yesterday, one of DreamHost’s database servers was illegally accessed using an exploit that was not previously known or prevented by our layered security systems in place. Our intrusion detection systems alerted our Security team to the potential hack, and we rapidly identified the means of illegal access and blocked it," he added. ®
"DreamHost’s database servers was illegally accessed using an exploit that was not previously known or prevented by our layered security systems" Translation: "Our third rate web app that was written by an intern 3 years ago got pwned by an SQL injection"
Sounds like you've had a lot of bad luck. I've been a customer for 10 years and never had a major problem and any problems I have had were resolved amicably and quickly. Maybe I've just been lucky...
More than that...
As a DH customer of six years, this latest incident takes the proverbial.
Sites have been on and offline for around a week.
Around the same time this particular issue hit, all my own sites on a private server and shared server went back to DNS ONLY from FULLY HOSTED and had to be hand-crafted from scratch.