3 ms·

I'm sorry to sound so down on your argument, but I just don't see the evidence that this is anything specific to Bluehost. You say that up to .03% of their cus

by e1ven 16y ago

I'm sorry to sound so down on your argument, but I just don't see the evidence that this is anything specific to Bluehost. You say that up to .03% of their customers may be affected, at the upper bound. You very well might be right, but .03% really isn't a big enough number that I'd feel comfortable delcaring that Bluehost "Got Hacked", and it looks pitifully small to write a followup declaring that they're "Lying about it" Those are very strong words, and so so far, you don't have much to back it up. You might very well be right, and there very well by a problem endemic to Bluehost customers, but so far, I'm just not seeing it. Further, saying that you contacted them via Linked-in is particularly weak. Seriously? That's akin to Gizmodo's telephone call to Apple HQ. A token effort at best. I hate to say it, since you've been a member of HN for over a year, and I want to give you the benefit of the doubt, but it really does sound like you're grandstanding here. I've run hosting companies before- .03 percent of customers being infected with something, while really unfortunate, doesn't necessarily indicate anything by itself. When you're dealing with that many customers, it's entirely possible that .03% just had really bad passwords that worms could guess, or that they all used a bad formmail script, or any number of other things. I don't use Bluehost, and I've never heard of them before today. I have no affiliation with them, or with you, and I do sincerely hope that things clear up for the affected users... But You're really blowing this up out of proportion. Right now, Bluehost's side looks a lot more reasonable than yours.

sucuri2 16y ago
No, it wasn't a FTP-based attack because we analyzed the FTP logs and on all the cases, there was no connections during the time of the attack. In our first assessment, we checked around 1.5k sites and found 140 infected. We also found their CEO blog hacked and some other big sites hosted in there with the same malware. As we published the post and started to hear from people, the number of affected sites grew to the hundreds (close to 1k). Google says they have 240k sites, which means that we identified =~0.4% of their sites with malware. Those are only the ones WE identified, which is probably much less than the actual number. Also, we contacted them about this issue before posting (via their forms) and also reached out to the CEO. However, since sites were already infected, we posted explaining the issue and how to fix it. We didn't posted about any vulnerability that could help the attackers, only information to help the affected users.

by e1ven 16y ago

sucuri2 16y ago

No, it wasn't a FTP-based attack because we analyzed the FTP logs and on all the cases, there was no connections during the time of the attack. In our first assessment, we checked around 1.5k sites and found 140 infected. We also found their CEO blog hacked and some other big sites hosted in there with the same malware. As we published the post and started to hear from people, the number of affected sites grew to the hundreds (close to 1k). Google says they have 240k sites, which means that we identified =~0.4% of their sites with malware. Those are only the ones WE identified, which is probably much less than the actual number. Also, we contacted them about this issue before posting (via their forms) and also reached out to the CEO. However, since sites were already infected, we posted explaining the issue and how to fix it. We didn't posted about any vulnerability that could help the attackers, only information to help the affected users.