This is a lengthy story about my recent experience with ManobanWeb (http://manobanweb.com) (MBW). I believe everyone should read this as a warning about this company. Now I’m not saying that this is a bad company as they’ve been great up until now, but this is something I hope nobody ever goes through so I am going to document it here. Enjoy.
(This is going to be exactly as the ticket is with them, with the exception that I removed any personally identifying information, and anything that could be used harmfully, ie – the phishing scripts that I showed them. I’ll give a quick summary at the end).
Guys, I need help, bad and fast.
I went to login to my FTP and cpanel today to upload some files, and couldn’t get in. My password had been reset to a random character password again….also, my last login was from 41.191.108.130, which is most certainly not my IP address, in fact it traces to Nigeria somewhere.
Can you help me figure out what happened? And if any files were changed before 5/19/2009 @ 1355 (9:55am EDT). I’m kinda worried this time…something happened and I’m not sure what.
I will now look into this and block that IP range from our network.
Thanks. There seems to be some router interface hosted at that IP and from what I can see on there, either they are some type of hosting company or have a major pipe to the internet for something…looks like 30M/s in bandwidth pretty consistently.
I am currently in-touch with the African Network Information Center which is where the IP is being used. If I could ask you to please change all your passwords to avoid them getting into your account again.
SEE the actual php file for more info. I’m going to move the files to the root of the account, out of the public_html folder so they can’t be used anymore.
Guys – I have uploaded the file back to my site, modified. Please leave this one on my site until we can figure out more. I have removed all of the code and script from the file.
I AM NOT THE ONE THIS ORIGINATED FROM!! I AM A VICTIM TOO!!
If you are here, I am TRULY very sorry for the email you were sent. This was blatant hacking of my site and files. If you have reached this page, I have stopped you from giving away your identity to a hacker. If it sounds too good to be true, it is. REMEMBER!! ALWAYS check the URL of your links!! You NEVER know what you are clicking on. If the IRS has money to give you, they will NOT email you to say you have money. EVER.
If you were unfortunate enough to have made it to this page BEFORE I got this page up, PLEASE contact ALL of your banking institutions, and credit bureaus and let them know that you gave away all of your information. It would also be wise to contact the FBI and let them know the same. I have already contacted the email provider of the address this info was sent to, as well as my hosting company to find the originating person.
I’m sorry to anyone who’s clicked this, and if you’ve made it here, please forward the email you got with this link to your email provider as a phishing scam.
We are still looking into this and decding on what action to take.
Thanks for the help! Just let me know what you guys figure out. I’d love to help shut down the person that did this.
I am still awaing a reply from the IP provider who the hacker used. I am doubtful that we will catch him as most hackers will mask their IP’s.
We have set-up a new firewall on the server which went online earlier today, which should help keep some of them from hacking into accounts.
This is REALLY getting ridiculous…password changes in progress again.
It looks like in the process of moving the files out of the public_html folder, they were blown away by my FTP client, or they were deleted on your end at the same time.
And I refreshed, and there is ANOTHER login from a different IP: 97.91.188.232. My ISP is also charter which is where this is from, but this is NOT my IP, in fact it’s not even in the right state.
I just reset my password for cpanel and my subsequently my FTP to a 31 character password….I can login to my FTP with the first 8 characters only. WHY?
If you check the forum you will see we are in the middle of securing another server which will be made public within the next 48 hours. This server has been completly locked down and we have set up a number of checks to run daily. If you would like I can ask one of the techs currently working on the new node to transfer your account within the next two hours.
I have been checking node2 and have noticed some issues that need fixing. I have now started moving 50% off accounts on node2 over to our newer node.
This is will stop the High CPU usage and should help relieve your account problems. As the list is rather large and most accounts are 2 – 3 GB it will take some time.
I will update this ticket as soon as your account has been transfered.
Your account has been copied to the new node. It should be safe to change your nameserver details now.
Thanks for the help. Sorry about the remark, I was just getting frustrated by this. Its just a bit irritating to deal with issues like that, especially when it blacklists my site on places such as http://mywot.com.
I want to thank all of you for being so transparent on the issue and not just covering it up with generic BS like a lot of places would.
I’m going to have to change my A records for my website now too aren’t I, considering the IP changed? Do you have this rsynced also, or are any changes that were made on the old server after the move not transferring over?
Most DNS settings and account settings are carried over. I’ll have Jake take a look as soon as he comes in.
All details in the DNS zones are updated on our server. I have noticed some rather odd entries that I am requesting permission to delete.
PLEASE delete that record. I didn’t check to make sure they didn’t add any DNS. that’s from the latest phishing scam that was added.
As my DNS isn’t hosted with you, I have to repoint my A records to the new IP for node1 correct?
Are the files rsynced from the old server (ahoban) to the new one (node1) or are any changes made to the old server that I”m currently on going to be lost on the new one? (I don’t think there are many except for maybe in the /public_html/files/portableapps/ folder).
The files were transfered last night which was just before I updated the ticket. any files uploaded after that time may be lost.
I have recently been in your account under the IP <IP Removed>, I have cleared all visable illegal files including a number of paypal sites and also a few email scripts that are not allowed on the server. The Email scripts were a form clearly used for sending spam.
Thanks. I’m not worried about anything else then. I kept looking for files that may have been not allowed, but the only folder I saw yesterday was the paypal folder and it disappeared when I was trying to move it out of the public domain for you guys. Thanks for the help Jake.
What did you guys ever come up with about the 8 character limit on the FTP password?
Michael I will look into this issue over the coming days for you.
This needs to stop. You guys have to figure out what is going on and stop it.
/public_html/images/on is the folder these files are in…THEY HAVE BEEN THERE SINCE 5/18/09….which means they weren’t taken off when the account was cleaned up before by Jake either.
> I have just recieved this Email from our service provider. I have removed the folder in question, however if this issue comes up again I’m afraid we will have to suspend the account until we can investigate the issue further.
> asking to enter personal and account information. The purloined information is then sent to an email account and, based on our investigation of similar schemes, used to steal accounts and commit other fraudulent acts including international credit card and wire fraud.
> This matter is urgent – we believe that consumers have been falsely directed to this page and may be fooled into divulging personal information to a criminal, if the page is not immediately disabled. We ask that you immediately disable the site at <URL REMOVED>, as well as any associated email addresses, so that this fraudulent scheme can be stopped. We further request that you provide us with all contact information that you have for this user so that we may provide this information to the proper law enforcement authorities.
> I, the undersigned, CERTIFY UNDER PENALTY OF PERJURY that I am the agent authorized to act on behalf of the owner of certain intellectual property rights, said owner being named PayPal, Inc. I have a good faith belief that the website located at URL <URL REMOVED> has its copyright in each page of its website and associated source code. Please act expeditiously to remove or disable access to the material or items claimed to be infringing.
> We sincerely appreciate your immediate attention to this important matter. We would also appreciate if you would take steps to confirm the accuracy of any contact information that your user may have provided to you in establishing the account. Should you have any accurate information that could assist PayPal and law enforcement in tracking this individual, we would greatly appreciate your assistance, as we know that you do not condone the use of your services for such criminal purposes.
> Finally, please be advised that we have referred this issue to the Federal Bureau of Investigation for their investigation. The F.B.I. has requested that we convey to you in this message their request that you preserve for 90 days all records relating to this web site, including all associated accounts, computer logs, files, IP addresses, telephone numbers, subscriber and user records, communications, and all programs and files on storage media in regard to all Internet connection information, pursuant to 18 U.S.C. section 2703(f). While we do not act as an agent of the FBI in conveying this request, we do intend to fully cooperate with their investigation, and encourage you to do so as well.
HOW can you have this much disconnect in your systems? THIS ticket should’ve flagged anything like this that came into to you. If this affect gizmokid2005.com and betatalk2.org is on the same hosting account, it should be common sense that this could be affected too….come on guys!
It is in our policy that we forward and investigate any abuse email we receive, so this staff member has taken the correct steps.
We are aware of the current situation so i will remove the abuse flag from your account.
Thanks Dan. What happened to the rest of this ticket?
In regards to the files in which you found. I know J.A. did a general check and removed most visable content. We have never seen them hide their files in the images folder before so I’m guessing thats why it was missed.
Can you please just confirm the last date you believe files were uploaded on, so I can check the logs and compare them to the old server?
I have also checked 2 of my personal accounts with passwords longer than 8 letters and it will not let me in without the full thing.
I will open a ticket with Cpanel first thing in the morning, it’s 24:00 now and I was in the middle of sleeping before Dan called.
The majority of the files that I had moved were uploaded on the 18th, there were a few more that I’d noticed today that were uploaded sometime yesterday or early today.
Sorry to have you awoken, but this is getting really excessive now. Please let me know as soon as you have more info about the FTP passwords too. At this point, that looks to be the weak point, as there wasn’t a new login from cPanel.
I’m afraid this matter is now out of our hands. The FBI have requested your details and they will now begin investigating this matter.
We have been asked to suspend your account for the time being.
Thank you for your co-operation throughout this matter.
We wish you every success with the FBI investigation.
This is COMPLETELY unacceptable. I need a call from one of you ASAP. YOU should be the ones to help with the investigation, ESPECIALLY since this did NOT originate from me. You are passing this off, and have been as if it’s a non-critical issue…Your own technicians BLATANTLY said there were security issues with your servers…so somehow it’s MY fault?? This is NOT acceptable in ANY way.
Our new server which you have been moved to has been hardened to industry standards and has enterprise class firewalls installed. SSH access is locked to ManobanWeb IP’s only. I understand where you are in this situation, however as stated in our TOS. This was requested and we must comply with these orders.
You, as ManobanWeb’s customer, are solely responsible for the content stored on and served by your ManobanWeb account.
But how am I responsible for a BLATANT security failure on your end?
Not too mention that over half this ticket was /conveniently/ deleted….
We we’re in the process of moving our website when that ticket was submitted. Hence why some parts may have been lost. All are however in our email logs for our records.
We have done our best to try resolve this issue without taking action against your account, however at this time we can not afford to have abuse emails coming in every other day from both banks and also our provider.
On another note: we are only having this problem with your account, so it’s the security of your account which has been compromised, nothing to do with our server. I have also checked the logs and matched an IP upto your IP address.
I am hereby requesting a copy of this ENTIRE ticket for my records also.
Please fulfill my request for the full copy of this ticket asap.
Thanks for the ticket. I don’t either…but that’s where the weak point is now…as the last login has been from my IP.
Is there any reason why my traffic is now blocked?
I’m afraid I don’t quite understand what you mean.
on your server, the connection times out.
Our servers are loaded in our standard config and your IP address has not been blocked.
I don’t know what to say…maybe it was done without your knowledge.
I don’t know what other proof you want that it’s on your network, but my traceroute blatantly shows it dies on your network.
And there you have it, that’s the ticket as it stands so far.
Since I have written this, MBW has managed to get my access to their network back up and running so I can access everything again. They have also unblocked my account and have unsuspended it. I have heard nothing from the FBI nor any other agency. I am currently still diligently looking for a new host.
Last week on Tuesday, May 19, 2009 I tried to upload files to my website via FTP for a project I was working on, and couldn’t log in. I kept getting a password error. I logged into my account at MBW and noticed that my password had been reset to my cPanel hosting manager which in turn manages my FTP password. After I reset my password I was able to login to my FTP, but I noticed that there were some new files in my hosting. Seeing this I logged into my cPanel hosting manager and noticed that the last login was NOT from my IP address, and infact came from an IP address in Nigeria. I IMMEDIATELY reported this incident to MBW in ticket #449209. I told MBW where the files where, actually gave them the content of the files in the ticket so that they had the information, I also moved the files so that they could not longer be accessed via the web. MBW said that they installed a new firewall, and contacted the African Network Information Center regarding this incident. I thought all was fine until a few days later.
On Friday, May 22, 2009 I noticed that there was ANOTHER issue at hand. I logged into my cPanel and noticed the last login was NOT my IP again. I immediately contacted MBW and they said that they are looking into it again. They also said that they are setting up a more secure server and moving my account to it. I had removed the files that I found uploaded again, also letting MBW know what they were and where, AGAIN. They transferred my server over later that day, and said they removed some more files they had found that I missed as well as some DNS entries. At this point I changed my password from an 11 alphanumeric character password to a 31 alphanumeric password to ensure that it wasn’t compromised. I did notice that my FTP login only required EIGHT of the 31 characters to login. Just the first eight would allow a login, and anything after that would not matter in the slightest. I let them know that and they seemed to have ignore it. Except for the FTP password issue, I figured at this point they found the issue, and took care of it. Fast forward to Monday, May 25, 2009. I log into my cPanel and I don’t see anything out of the ordinary but I checked my “Recent Visitors” stats again and noticed that there was something new on my site. My account’s FTP access was accessed/hacked and more files were uploaded. I noticed in the same directory those files were in there were files added previously on the 19th that nobody had noticed. I move ALL of those files out of the public access area again and let MBW know what was going on. I also reiterated the fact that my FTP was able to login with only the first eight characters of my password and they said that was not normal and they were going to open up a ticket with cPanel to have that looked into. That was the evening of Monday, May 25th. Today, May 26, I received a notification from them that my hosting was suspended and they weren’t going to do anything else because the FBI requested my details regarding this incident.
This entry was posted in Uncategorized on June 2, 2009 by Michael.