HostGator says hackers compromised its servers using a previously unknown security hole in cPanel, the control panel software that is widely used by hosting providers. "I can tell you with all accuracy that this is definitely due to a cPanel exploit that provides root access and all cPanel servers are affected," said HostGator system administrator Tim Greer. "This issue affects all versions of cPanel, from what I can tell, from years ago to the current releases, including Stable, Release, Current and Edge."
cPanel has just released a fix. "Running /scripts/upcp will fix the vulnerability in all builds," cPanel said in a message on its user forums. "Please note that this is a local exploit which requires access to a cPanel account. ... If you believe you have been exploited through this vulnerability, you are welcome to submit a support request for assistance."
Hackers gained access to HostGator's servers late Thursday and began redirecting customer sites to outside web pages that exploit an unpatched VML security hole in Internet Explorer to infect web surfers with trojans. The existence of the new "0-day" exploit of cPanel leaves a large number of hosting companies vulnerable to similar attacks until they install the patch. The riusk is mitigated somewhat by the fact that it is a local exploit, meaning any attack on a host must be launched from an existing account with cPanel access.
Hackers have hijacked a large number of sites at web hosting firm HostGator and are seeking to plant trojans on computers of unwitting visitors to customer sites. HostGator customers report that attackers are redirecting their sites to outside web pages that use the unpatched VML exploit in Internet Explorer to install trojans on computers of users. Site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages.
UPDATE: HostGator says its servers were attacked through a previously unknown security hole in cPanel. See our update for the latest details.
HostGator general manager Jason Muni told Security Fix that attackers had "reconfigured an unknown number of Web sites hosted on the company's servers to redirect visitors to a third-party Web site that tried to load the IE exploit." Muni said the company reconfigured all of its 200 servers to address the problem. But as of 5:30 pm EST Friday, some HostGator customers were continuing to report that their sites were compromised and redirecting visitors, indicating the problems were ongoing.
Who should bear the cost of phishing losses: the bank or the customer? That question is at the heart of a recent dispute between the Bank of Ireland and a group of customers that fell victim to a phishing scam that drained 160,000 Euros ($202,000) from their accounts. The bank initially refused to cover the losses, but has since changed its mind and credited the accounts of nine victims, who had threatened to sue to recover their funds.
The Bank of Ireland incident is one of the first public cases of a bank seeking to force phishing victims to accept financial responsibility for their losses, but it likely won't be the last. Phishing scams continue to profilerate, as Netcraft has blocked more than 100,000 URLs already in 2006, up from 41,000 in all of 2005. Financial institutions continue to cover most customer losses from unauthorized withdrawals. But after several years of intensive customer education efforts, the details of phishing cases are coming under closer scrutiny, and the effectiveness of anti-phishing efforts taken by both the customer and the bank are likely to become an issue in a larger number of cases.
The issue of responsibility has been most prominent in the UK. In late 2004, the UK trade association for banks, known as APACs, began warning that financial institutions may stop covering losses from customers who have ignored safety warnings. That stance is reflected in the group's statement on customer protection.
Managed hosting provider DataPipe announced Tuesday that it has secured a $12 million private placement investment, and will use the funding to buy additional data center space. The funding continues a period of strong investor interest in the hosting sector. The first half of 2006 saw a flurry of acquisitions involving major hosts and domain registrars, and investment bankers say the industry is also attracting private funding from investors wanting to participate in the industry's growth.
The New Jersey company said its recent growth has prompted a global expansion. The first deal is close to home. "We have purchased a 36,000 square foot facility in central New Jersey," said Robb Allen, founder and CEO of DataPipe. "We are in the process of upgrading the infrastructure to meet the standards required of a Tier 4 facility (the highest rating under an industry standard from The Uptime Institute)." Allen said DataPipe expects to begin installing clients in the new data center in the first quarter of 2007 and expected to announce further data center acquisitions in the near future.
Security researchers have demonstrated a way to forge digital signatures that can fool the OpenSSL software used in many secure web servers and virtual private networks (VPN). The OpenSSL Project has issued patches to address the weakness, and is urging users to upgrade or install the patches.
The signature forgery technique was first demonstrated by Daniel Bleichenbacher, a cryptographer at Bell Labs, at the CRYPTO 2006 conference last month. While the forgery only works on specific keys (known as PKCS #1 v1.), these keys are used by some certificate authorities in SSL server certificates.
Ranking by Failed Requests and Connection time,
August 1st - 31st 2006
The world's largest web host is also is the best performer this month, as 1&1 Internet ties with Rackspace and New York Internet as the most reliable relable hosting company site for August 2006. The home pages for all three providers were perfect for the month, with no downtime and no failed requests.
This month's leaderboard provides an interesting contrast, demonstrating that hosting customers can find good network connectivity at either end of the hosting spectrum. 1&1 is one of the cheapest providers, offering shared hosting accounts starting at $2.99 per month, while New York Internet and Rackspace are managed hosting specialists that provide custom pricing.
Rackspace has been the most reliable host four times this year, while NYI has topped the list or tied for first on three occasions. 1&1, which hosts more than 3 million active sites, previously led the rankings in May 2005.
Seven of the 10 most reliable hosters run their sites on Linux, while two use FreeBSD, and one Windows Server 2003.