BlueSquare Data has agreed to accept an offer from Namesco Ltd, to acquire its hosting division (consisting of VAServ, Server Arcade and PoundHost brands) with immediate effect. Namesco is part of Dada SpA, a leading international group in the domain name and hosting markets significantly focussed on developing and growing its presence in the UK market.
I found a message on a website. It looks like a transcript of the hackers message:
"Z3r0 day in hypervm?? plz u give us too much credit. If you really really wanna know how you got wtfpwned bitch it was ur own stupidity and excessive passwd reuse. Rus's passwds are Code:
e2x2%sin0ei unf1shf4rt 3^%3df 1/2=%mod5 f0ster
f0ster being the latest one, quite secure eh bitches? We were in ur networks sniffing ur passwds for the past two months quite funny this openvz crap is we could just get into any VPS we like at any time thanks to ur mad passwds. But we got bored so we decided to initiate operation rmfication and hypervm was a great t00l to do that since it spared us the time of sshing into all ur 200 boxen just to issue rm -rf. Coded a little .pl to do just that, take a look at this eleet output it's mad dawg Code:
[root@vz-vaserv .ssh]# perl h.pl -user admin -pass ****off -host cp.vaserv.com -cmd 'rm -rf /* 2> /dev/null > /dev/null &' [+] Attempting to login using admin / ****off [+] Logged in, showtime! Output for 67.222.156.106 Output for xen3ws.vaserv.com Output for vz22uk.vaserv.com Output for xen4ws.vaserv.com Output for vzspecial5.vaserv.com Output for xen16.vaserv.com Output for vz77uk.vaserv.com Output for 91.186.26.128 Output for xen25.vaserv.com Output for vz76uk.vaserv.com Output for vz18tx.vaserv.com Output for vz75uk.vaserv.com Output for vz45uk.vaserv.com Output for vzpent16.vaserv.com Output for xen1tx.vaserv.com Output for vz13tx.vaserv.com Output for vz74uk.vaserv.com Output for vzspecial8.vaserv.com Output for xen24.vaserv.com Output for vz73uk.vaserv.com Output for rdns1.vaserv.com Output for vz2tx.vaserv.com Output for vz17tx.vaserv.com Output for xen23.vaserv.com Output for vz72uk.vaserv.com Output for xen22.vaserv.com Output for vzruffbuff.vaserv.com Output for vzmario.vaserv.com Output for xen21.vaserv.com Output for vz71uk.vaserv.com Output for vzspecial7.vaserv.com Output for vz70uk.vaserv.com Output for xen20.vaserv.com Output for vz69uk.vaserv.com Output for vzspecial6.vaserv.com Output for vz7uk.vaserv.com Output for vzspecial4.vaserv.com Output for vzspecial3.vaserv.com Output for xen19.vaserv.com Output for vzspecial2.vaserv.com Output for vzspecial1.vaserv.com Output for vzpent3.vaserv.com output truncated due to massive boxen outputz [root@vz-vaserv .ssh]# rm -rf /* > /dev/null 2> /dev/null & [1] 12399 [root@vz-vaserv .ssh]#
Did the same fo ****vps.com after resetting the passwd to hyper ve emz, it was ever so much fun you should try it sometime Rus it's GREAT! BTW to all the customers we deleted ur loving provider is overselling their crappy 8gb nodez to hell and back, thought you'd like to know, you can also thank ur loving buddy Rus for losing ur data hihi. BTW Rus we still have ur billing system wtfpwned and baqdoored we got shitload of CCz from ur retarded customers thanks a lot buddy. Telling you this cuz we got bored of this ****, it's just too easy and monotonous so patch ur crap, if your too dumb to secure a simple web server my rate is $100/hour or one night with ur sister hauhaiahiaha. Also wheres ur team Rus? the only ****ers i saw in ur billing sys are Kody, Vlada and u you guys work like ****ing hindus i bet but ur cheap like jews lolz hire some pros like me to help you out manage all those retards VPSs lolololl Code:
1 1 rghf c32f3310baffcb431875a67196e99ebd Rus F zswlxxoomx@nowmymail.com 0 , Edit Delete 3 1 vlada c32f3310baffcb431875a67196e99ebd Vlada Neskovic zswlxxoomx@nowmymail.com 0 , Edit Delete 4 1 Kody fde67637d867c52d739931528dd92ef0 Kody Riker zswlxxoomx@nowmymail.com Georgia - server22 space 1slot 1gb 0 ,
See we care about ur privacy and edited ur emailz unlike you who do not care about the privacy of ur retarded customers lol Code:
Showing rows 0 - 29 (1,361 total, Query took 0.0133 sec) SELECT * FROM `tblclients` LIMIT 0 , 30
Fun stuff think we gonna sell all those emails to some spammers to make some quick bucks lol, and yes their main site was a VPS lolol which is why we got quick access thanks to ur passwd reuse, your awesome Rus.
Yea yea "his IP is:64.79.210.78" here i saved u the trouble lolol Code:
Is it true or not? If it is true then the whole story is in a new perspective now. Did the hackers only sniffed Rus's password? And did the hackers got root access to the whole Vaserv's empire with this one username/password pair? Hmmm.... What do you think?
"Q:I ordered a server in the US, so why has it been provisioned in the UK?
A:Due to the hardware we were using in the US, we have taken advantage of the new servers afforded to us by BlueSquare which are of a much superior quality and redundancy level. We were also able to setup the servers quicker in the UK than the US due to the ‘staff on the ground’ at the datacentre in the UK."
My VPS was in an US datacentre Dallas, Texas. Hmmm....I dont know, what should I do now. My visitors come from US mainly, perhaps I should look for another VPS provider.
As I am sure you are aware due to a combination of issues a large number of VPS nodes were compromised by a third party, which has resulted in some customers suffering a data loss.
Vaserv’s UK operations have been based at the BlueSquare Data Centre for a number of years, and we have a very strong working relationship with Rus Foster and his team. Once Rus made us aware of the major issues that his company was facing, we quickly mobilised a number of our experienced Linux engineers to help with the restore and rebuild of the VPS platform. Our engineers, along with vaserv staff have been working on these issues for well over 24 hours now, and we are starting to catch our tail.
We have been in dialog with Rus regarding the ongoing support of Vaserv, and it is with pleasure that I can announce BlueSquare Data Group (www.bluesquaredatagroup.com) will be taking over the operations of Vaserv in the future.
For the meantime we will continue to support vaserv and Rus wherever we can, and some customers are already being moving onto our own BlueSquare infrastructure.
Our short term aim is to get as many customers back up as soon as possible, as well as providing customers who have suffered a data loss a new VPS on the BlueSquare platform.
Our long term aim will be to move all the current VAServ customers onto the new BlueSquare Linux VPS platform, which has been in development for a number of months, and boasts industry leading security and reliability, along with the speed and uptime you would expect from VAserv.
We look forward to working with Rus and his team, and are excited about the opportunities this brings for you as a customer, providing exactly what you have been used to, but on a even better hardware and software platform. We have no intentions to change customer pricing.
Please continue to liaise with Rus and his team during these difficult times (as we don’t have any access to the day-to-day tech support of VAserv). We will continue to assist with infrastructure in the meantime, and will be in further contact once the majority of the recent issues have been resolved.
"The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."
I requested a new vps from FSCKVPS a few hours ago. Because I am the one of lots of unlucky guys who has 100% data loss on their vps. It seems I am not pessimist, but realist. Now I am sitting back and waiting for the new vps, but my hand is on my colt. :)
FSCKVPS (they are part of Vaserv) post the following message on their status page:
"Dear Customer,
We have worked tirelessly through the night and over the last 48 hours to recover as many VPS as possible. However, we have now reached the end of all of our servers, and as such, if your server is not currently up, or not partly up (i.e. it is up but not working due to a configuration issue) then it is unfortunate that you will have lost your data due to this third party attack.
We are offering all customers who have lost data a brand new VPS on our new platform. If you are in the position of requiring a new VPS due to your old one not coming back up, please submit a support ticket with the subject ‘New VPS Required’, and including the specification you ordered in the message. We will then start to provision these straight away. We will aim to have all new servers up within 6 hours at the latest, of course providing no new issues occur. If you have your own backups you can then restore these onto the new VPS.
We will also be providing two months free hosting as compensation to customers that have lost data and require a new VPS.
We apologise for any inconvenience caused, and your patience and understanding in these very difficult times. Regards, VAServ Team."
A large internet service provider said data for as many as 100,000 websites was destroyed by attackers who targeted a zero-day vulnerability in a widely-used virtualization application.
Technicians at UK-based Vaserv.com were still scrambling to recover data on Monday evening UK time, more than 24 hours after unknown hackers were able to gain root access to the company's system, Rus Foster, the company's director told The Register. He said the attackers were able to penetrate his servers by exploiting a critical vulnerability in HyperVM, a virtualization application made by a company called LXLabs.
"We were hit by a zero-day exploit" in version 2.0.7992 of the application, he said. "I've heard from other people they've been hit by the same thing."
Foster said he's been unable to reach anyone at LXLabs to discuss the suspected vulnerability.
Two days ago my virtual server provider, fsckvps.com had been hacked.
You can read a very long forum thread about this attack and the chaos here So all of my websites/webprojetcs went offline, and they are still offline today.
I hope FSCKVPS's staff is working hard and fast and they will restore my vps asap.
But it is only a hope. I am so pessimist, I think my datas will not be restored.
And I will have to reconfig my vps and rebuild my websites/webprojects.
Not a nice future vision.
Because I don't know when will be my vps/websites online again now I redirect temporarily all of my websites to this blog and I will inform you about my vps/websites issues here.
I post this first blog entry with date of 2020 (edited! - back to 2009), because I want it to the top of my blog. If you want to read the full story, start here please.
