7 ms·

Dreamhost asking users to change passwords after database breach

124 points by hopeless 15y ago

mbrzuzy 15y ago
I am absolutely not shocked at all. I got off their service years ago when they had all their FTP accounts breached.
hopeless 15y ago
From the comments, it seems the passwords were hashed but they're (rightly) still concerned. Unfortunately, there still seems to be some confusion about when/if the password reset has taken place, and whether users should change them now, wait for Dreamhost, or both (and then update them again after the reset!)
- andfarm 15y ago
  We're currently in the middle of resetting passwords, machine by machine. If your old password has stopped working, that means we've gotten to the machine that you're on, and you're safe to reset it through the panel. Panel passwords are safe, BTW. The only passwords that we believe may have been compromised are UNIX user passwords (e.g, FTP/SFTP/SSH users).
  - Kambria 15y ago
    Unix passwords are Never safe and never will be. I don't get you guys...
djenryte 15y ago
This is pretty bad. I've received password reset emails from dreamhost in the past and the passwords are in plain text...I just renewed two days ago too.
- pdkp 15y ago
  Hostgator does this too and don't reset, only resend passwords. It has always bugged me. There is no reason to be storing plain-text, especially for their billing system. At least Dreamhost says the Shell passwords are hashed, which makes sense. I didn't know that about the plain text dreamhost web-panel passwords though.
- ehsanu1 15y ago
  Surely they don't send you your old password, but a freshly generated one? Then they could still be hashing them after emailing you.
  - andfarm 15y ago
    Embarrassingly... no. Our login/authentication system was written in 1999, and it shows -- we store panel login passwords using symmetric encryption, and send out the decrypted password when you request it. Getting this fixed was already on our to-do list. This incident has moved it up to near the top of the list (competing with a few other security-related tasks).
    - milkmiruku 15y ago
      I have always been bothered about cpanel passwords coming through in plain text. To confirm, is this the same storage system with mail passwords also? Shell passwords - they're hashed, but are they salted? If not, can they be in future? Thanks for your time.
    - jacktoole1 15y ago
      I've been happy with Dreamhost's service, but becoming aware of this in the last few months has forced me to look into other registrars. If this is fixed, I would be much more inclided to stay. If you could forward these articles to whoever's working on security, I'd appreciate it (and they're a good read): http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracking.html http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracki... http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...
joering2 15y ago
Hostgator is no better. Talked with "technical support" couple weeks ago; decided to save the chat: Welcome to GatorChat! You are being connected to a representative in our Technical Support department right now. (01:33:17 PM) Joe: hi there. (01:33:26 PM) Nathan: Welcome to Hostgator LiveChat. My name is Nathan. How may I assist you today? [...] (01:38:30 PM) Joe: never got password (01:39:20 PM) Nathan: Its the same as your billing password. (01:39:46 PM) Joe: YEAH (01:39:48 PM) Joe: I JUST GOT IT. WHICH MEANS YOU GUYS KEEP PASSWORDS IN PLAIN TEXT (01:41:01 PM) Nathan: Correct. (01:41:26 PM) Joe: it would be good to have more security in place :) (01:42:44 PM) Nathan: What is not secure about what we do? (01:42:58 PM) Joe: the password. kept in plain text (01:43:46 PM) Nathan: Its a very secure password, dont give it to people and you will be secured. (01:44:16 PM) Joe: no. you dont understand. i'm saying: keeping password not encrypted or hashed on registryrocket.com part is not secure (01:45:21 PM) Nathan: No one should know your billing password Joe. We see no reason to create a new password for that. (01:45:39 PM) Nathan: I apologize. (01:46:08 PM) Joe: no problem, but you still dont get it. if hackers hack into registryrocket, they have a database of domains and passwords for each domain. in plain text! (01:46:31 PM) Nathan: Okay, you can change the password if you want. (01:46:58 PM) Joe: but what if I change it today, and hackers hack into registryrocket 2 hours later? (01:47:20 PM) Nathan: Then we will change the password. I dont understand how hackers would randomly guess your password Joe. (01:47:59 PM) Joe: they dont need to randomly guess my password. my password is stored in registryrocket database in PLAIN TEXT (01:48:45 PM) Nathan: Please show me where you can see it. (01:49:10 PM) Joe: I cant!! I did not hack into registryrocket (01:49:36 PM) Nathan: Okay, no hackers are getting into our database Joe. I do not understand how they would get your password. (01:49:44 PM) Joe: but if someone WILL hack into registryrocket AND copy the entire database of users/passwords, then those passwords wont be encrypted or hashed, they will be in plain text (01:52:20 PM) Nathan: Joe, no our passwords are encrypted with MD5. (01:52:29 PM) Joe: impossible!! (01:52:34 PM) Nathan: No one is going to hack into registryrocket. (01:52:35 PM) Nathan: Okay. (01:53:01 PM) Joe: ?? how can you encrypt password with MD5 and within 10 seconds from clicking "remind password", I got my password in my mailbox?? (01:53:54 PM) Nathan: Joe, our passwords are secured in a database. Please do not worry about us getting hacked. We have it under control. (01:54:16 PM) Joe: you misleading me. (01:54:40 PM) Joe: passwords CANNOT be properly encrypted in the database AND the same time you sending me password 5 seconds after I clicked "remind password" (01:56:07 PM) Joe: even for very powerful computer it would take much more than 5 seconds to "decrypt" (or should rather say: crack) MD5-encrypted password (02:00:35 PM) Joe: any news, Nathan? (02:01:28 PM) Nathan: Our passwords are not MD5 encrypted, but they are encrypted and its done by Enom. (02:03:06 PM) Joe: (01:52:20 PM) Nathan: Joe, no our passwords are encrypted with MD5. (02:03:15 PM) Joe: whats "Enom" ? (02:03:20 PM) Nathan: I apologize I made a mistake. Enom is who we sell our domains through. (02:03:45 PM) Joe: ok, what do they use to encrypt passwords?? (02:03:55 PM) Nathan: I would not know. (02:04:11 PM) Joe: I tell you: NOTHING (02:04:54 PM) Joe: thats why most websites you CANNOT retrieve your old password, you can only reset it. (02:07:22 PM) Nathan: What can I help you with Joe? Do you need the password to login? (02:07:48 PM) Joe: I was just wondering how secure my vulnerable data is. (02:09:22 PM) Nathan: We have a secure database, we have not been hacked in the past and I don't think we will be hacked anytime soon. (02:09:41 PM) Joe: ok thanks. Current Rating: 12345
RossDM 15y ago
I'm a Dreamhost customer and haven't received any emails regarding this yet.
- dredmorbius 15y ago
  Dittos. I found out on HN. Checked to see if it had gone to some stray account / folder, but I never received any notification that I can find. Anyone?
  - s1rech 15y ago
    nothing. I've discovered I had the same pwd for the panel and for the ssh access, although I almost never use the ssh one. Time to check every password, it seems ...
    - dredmorbius 15y ago
      We, well, I, have been using sshkeys for access. We actually had one of our accounts request sshkey access as well, which was freaking wonderful. Most are so technically backward that this can't be rolled out globally, though I'd love for it to be.
    - dredmorbius 15y ago
      It would also be very, very, very cool if Dreamhost (since they have a list of old passwords) would, say, make that list all invalid for future use. We're doing some tough client love right now on security practices, and having a nice hard wall to push off of, namely, Dreamhost being assholes, in a good way, would be a very Good Thing[tm].
- andfarm 15y ago
  We're not quite done investigating the issue and resetting passwords; once that's done, though, we will have a mass email going out.
  - dredmorbius 15y ago
nabilt 15y ago
I have limited web development experience so maybe someone can fill me in. Why is securing a web server so difficult? I understand they are complicated systems with many technologies, but large companies with lots of smart engineers can't seem to solve this problem. Can most of these hacks be attributed to user error?
- krobertson 15y ago
  This is based on my own biased opinion... It can happen for a number of reasons and isn't necessarily with securing a webserver. Sometimes security issues get that "well, it isn't an issue right now" view and get put in a backlog and never resolved. Other cases it is a lack of good code reviews or security reviews. Or inexperienced developers (at least inexperienced with that kind of security). From a Dreamhost employee (http://news.ycombinator.com/item?id=3491643 http://news.ycombinator.com/item?id=3491643), that code was from 1999. Could have been any one of the above. The truly sad part is the number of examples of this kind of thing blowing up yet companies are still making the same mistake. At what point does someone think of checking their own apps password practices to ensure they aren't next?
  - dredmorbius 15y ago
    One practice that's starting to help, a bit, and it pains me to say it, is security audits. There are a few standards emerging for SAAS services, especially at the B2B level. And as startups (or non-startups) start intersecting with large, regulated, publicly-held businesses, these requirements propagate, and with audits, receive multiple reviews. The process is far from perfect, and many of the standards are laughably lax (and yet ... they still aren't met). Because they're standards, the requests are fairly uniform. A number of issues regarding Dreamhost have been on my own back burner for months, and I'm finally getting that Round Tuit this afternoon. Pushing for good, solid standards would be a net benefit. That's the silver lining here.
    - krobertson 15y ago
      Mentioning standards and security audits makes me cringe in their current state. Certainly agree with you that they'll help, but many are draconian. Things like physical access lists when you use cloud services... or policies on tape backups. :)
lukeholder 15y ago
i got this (screenshot) in my control panel but no email: http://is.gd/yFhhrv http://is.gd/yFhhrv
malandrew 15y ago
Do only shell and ftp passwords need to be reset or does the main account web panel password need to be reset as well? Ask because, we don't use shell/ftp passwords and I'm not sure if we are affected or not.
- andfarm 15y ago
  Just shell/FTP passwords. As noted above, panel passwords are fine.
ahi 15y ago
This was a nightmare. I was trying to get some urgent changes committed for a client that needed it this afternoon. Just about to commit around 14:00 est and Comcast takes a dive. Comcast support says they'll have it fixed by 5. Not great, I wanted to be done with work early on a Friday, but client is on the west coast so it will still be okay. Comcast comes up and ... shit, can't log in to the server. Try a few dozen variations of my password, then scour the web for an hour looking for hints if I'm locked out or something. Finally decide to check Dreamhoststatus.com. Fuckwits. Only sysadmin has access to panel to reset my password. He's sick and only checking IM sporadically. Finally get logged in and commit at 23:45pm est. Comcast+Dreamhost fucked me and my client real good today. Not much I can do about Comcast, but our migration off of dreamhost is getting pushed up to the top of the list.
- dredmorbius 15y ago
  Sounds like it's time for some process review. Backup systems admin. Key passwords available in a shared (but encrypted) repo. Multiple data links -- tethering through your cell phone or heading to the local cafe or library in a pinch.
  - davebanham 15y ago
    http://passpack.com/ http://passpack.com/ Best password sharing/collaboration tool we've found.
muraiki 15y ago
I just got the email from Dreamhost at about 3:30AM EST. I checked out their status blog and found something interesting: over the past month a good number of people have had malicious .htaccess files and scripts inserted into their Wordpress installs. That would include me. About a month ago one of my Dreamhost sites was hacked. An .htaccess file was modified to insert some PHP scripts that provided a backdoor to the site and that also embedded ads. I see now that I'm not the only one who has had this problem. When I reported this at the time I submitted as much information as possible but only got a canned, autogenerated response. Dreamhost ran an automatic scan on my site and IIRC it did pick up the offending file, but by the time that had been done I had already found it. The particular backdoor was c99shell.I. As I've read more comments, people have had .htaccess files modified who weren't using Wordpress, so it's not a Wordpress problem. This leads me to ask: Is this compromise related to the hacks that I and other users have experienced? If so, how long has the password database been compromised? Thankfully I use GMail for email, so at least that level of personal information wasn't stored on their servers. But this makes me wonder just how long someone has had free reign to access many Dreamhost accounts. Needless to say, I will be switching hosts and will never recommend Dreamhost again. I guess you get what you pay for, and if I had been able to speak with an actual human being about my site being hacked maybe they could have connected the dots. Furthermore, they've had this weak password system since 1999? Edit: Here's a link to the status blog post: http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-passwords-due-to-security-issue http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-... Edit2: I just remembered that I got a strange call from a friend a few months ago who said that when he tried to access my site his corporate firewall had blocked it because of the presence of pornography. This is a church's web site we're talking about, so of course there was no porn on it. This is the same site that was later more overtly hacked in December. Apparently the initial hack only inserted text when a crawler hit the site, so it was an SEO hack. In December, the text became visible to regular users of the site. This post has more detail: http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-passwords-due-to-security-issue/#comment-265213 http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-...
- muraiki 15y ago
  After a few emails with DH support, I discovered that there was a file created by another user in two of my accounts. Somehow the permissions for two directories had been set to 777, and a compromised user put a trojan in them. I think that I jumped into conspiracy theory territory above, and misrepresented Dreamhost's security and response as a result of that. The combination of my emotions and my inexperience with dealing with hacking on web hosts led to an incorrect judgment.

124 points by hopeless 15y ago

I am absolutely not shocked at all. I got off their service years ago when they had all their FTP accounts breached.

From the comments, it seems the passwords were hashed but they're (rightly) still concerned. Unfortunately, there still seems to be some confusion about when/if the password reset has taken place, and whether users should change them now, wait for Dreamhost, or both (and then update them again after the reset!)

andfarm 15y ago
We're currently in the middle of resetting passwords, machine by machine. If your old password has stopped working, that means we've gotten to the machine that you're on, and you're safe to reset it through the panel. Panel passwords are safe, BTW. The only passwords that we believe may have been compromised are UNIX user passwords (e.g, FTP/SFTP/SSH users).
- Kambria 15y ago
  Unix passwords are Never safe and never will be. I don't get you guys...

djenryte 15y ago

This is pretty bad. I've received password reset emails from dreamhost in the past and the passwords are in plain text...I just renewed two days ago too.

pdkp 15y ago
Hostgator does this too and don't reset, only resend passwords. It has always bugged me. There is no reason to be storing plain-text, especially for their billing system. At least Dreamhost says the Shell passwords are hashed, which makes sense. I didn't know that about the plain text dreamhost web-panel passwords though.
ehsanu1 15y ago
Surely they don't send you your old password, but a freshly generated one? Then they could still be hashing them after emailing you.
- andfarm 15y ago
  Embarrassingly... no. Our login/authentication system was written in 1999, and it shows -- we store panel login passwords using symmetric encryption, and send out the decrypted password when you request it. Getting this fixed was already on our to-do list. This incident has moved it up to near the top of the list (competing with a few other security-related tasks).
  - milkmiruku 15y ago
    I have always been bothered about cpanel passwords coming through in plain text. To confirm, is this the same storage system with mail passwords also? Shell passwords - they're hashed, but are they salted? If not, can they be in future? Thanks for your time.
  - jacktoole1 15y ago
    I've been happy with Dreamhost's service, but becoming aware of this in the last few months has forced me to look into other registrars. If this is fixed, I would be much more inclided to stay. If you could forward these articles to whoever's working on security, I'd appreciate it (and they're a good read): http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracking.html http://www.codinghorror.com/blog/2007/09/rainbow-hash-cracki... http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

joering2 15y ago

Hostgator is no better. Talked with "technical support" couple weeks ago; decided to save the chat: Welcome to GatorChat! You are being connected to a representative in our Technical Support department right now. (01:33:17 PM) Joe: hi there. (01:33:26 PM) Nathan: Welcome to Hostgator LiveChat. My name is Nathan. How may I assist you today? [...] (01:38:30 PM) Joe: never got password (01:39:20 PM) Nathan: Its the same as your billing password. (01:39:46 PM) Joe: YEAH (01:39:48 PM) Joe: I JUST GOT IT. WHICH MEANS YOU GUYS KEEP PASSWORDS IN PLAIN TEXT (01:41:01 PM) Nathan: Correct. (01:41:26 PM) Joe: it would be good to have more security in place :) (01:42:44 PM) Nathan: What is not secure about what we do? (01:42:58 PM) Joe: the password. kept in plain text (01:43:46 PM) Nathan: Its a very secure password, dont give it to people and you will be secured. (01:44:16 PM) Joe: no. you dont understand. i'm saying: keeping password not encrypted or hashed on registryrocket.com part is not secure (01:45:21 PM) Nathan: No one should know your billing password Joe. We see no reason to create a new password for that. (01:45:39 PM) Nathan: I apologize. (01:46:08 PM) Joe: no problem, but you still dont get it. if hackers hack into registryrocket, they have a database of domains and passwords for each domain. in plain text! (01:46:31 PM) Nathan: Okay, you can change the password if you want. (01:46:58 PM) Joe: but what if I change it today, and hackers hack into registryrocket 2 hours later? (01:47:20 PM) Nathan: Then we will change the password. I dont understand how hackers would randomly guess your password Joe. (01:47:59 PM) Joe: they dont need to randomly guess my password. my password is stored in registryrocket database in PLAIN TEXT (01:48:45 PM) Nathan: Please show me where you can see it. (01:49:10 PM) Joe: I cant!! I did not hack into registryrocket (01:49:36 PM) Nathan: Okay, no hackers are getting into our database Joe. I do not understand how they would get your password. (01:49:44 PM) Joe: but if someone WILL hack into registryrocket AND copy the entire database of users/passwords, then those passwords wont be encrypted or hashed, they will be in plain text (01:52:20 PM) Nathan: Joe, no our passwords are encrypted with MD5. (01:52:29 PM) Joe: impossible!! (01:52:34 PM) Nathan: No one is going to hack into registryrocket. (01:52:35 PM) Nathan: Okay. (01:53:01 PM) Joe: ?? how can you encrypt password with MD5 and within 10 seconds from clicking "remind password", I got my password in my mailbox?? (01:53:54 PM) Nathan: Joe, our passwords are secured in a database. Please do not worry about us getting hacked. We have it under control. (01:54:16 PM) Joe: you misleading me. (01:54:40 PM) Joe: passwords CANNOT be properly encrypted in the database AND the same time you sending me password 5 seconds after I clicked "remind password" (01:56:07 PM) Joe: even for very powerful computer it would take much more than 5 seconds to "decrypt" (or should rather say: crack) MD5-encrypted password (02:00:35 PM) Joe: any news, Nathan? (02:01:28 PM) Nathan: Our passwords are not MD5 encrypted, but they are encrypted and its done by Enom. (02:03:06 PM) Joe: (01:52:20 PM) Nathan: Joe, no our passwords are encrypted with MD5. (02:03:15 PM) Joe: whats "Enom" ? (02:03:20 PM) Nathan: I apologize I made a mistake. Enom is who we sell our domains through. (02:03:45 PM) Joe: ok, what do they use to encrypt passwords?? (02:03:55 PM) Nathan: I would not know. (02:04:11 PM) Joe: I tell you: NOTHING (02:04:54 PM) Joe: thats why most websites you CANNOT retrieve your old password, you can only reset it. (02:07:22 PM) Nathan: What can I help you with Joe? Do you need the password to login? (02:07:48 PM) Joe: I was just wondering how secure my vulnerable data is. (02:09:22 PM) Nathan: We have a secure database, we have not been hacked in the past and I don't think we will be hacked anytime soon. (02:09:41 PM) Joe: ok thanks. Current Rating: 12345

RossDM 15y ago

I'm a Dreamhost customer and haven't received any emails regarding this yet.

dredmorbius 15y ago
Dittos. I found out on HN. Checked to see if it had gone to some stray account / folder, but I never received any notification that I can find. Anyone?
- s1rech 15y ago
  nothing. I've discovered I had the same pwd for the panel and for the ssh access, although I almost never use the ssh one. Time to check every password, it seems ...
  - dredmorbius 15y ago
    We, well, I, have been using sshkeys for access. We actually had one of our accounts request sshkey access as well, which was freaking wonderful. Most are so technically backward that this can't be rolled out globally, though I'd love for it to be.
  - dredmorbius 15y ago
    It would also be very, very, very cool if Dreamhost (since they have a list of old passwords) would, say, make that list all invalid for future use. We're doing some tough client love right now on security practices, and having a nice hard wall to push off of, namely, Dreamhost being assholes, in a good way, would be a very Good Thing[tm].
andfarm 15y ago
We're not quite done investigating the issue and resetting passwords; once that's done, though, we will have a mass email going out.
- dredmorbius 15y ago

nabilt 15y ago

I have limited web development experience so maybe someone can fill me in. Why is securing a web server so difficult? I understand they are complicated systems with many technologies, but large companies with lots of smart engineers can't seem to solve this problem. Can most of these hacks be attributed to user error?

krobertson 15y ago
This is based on my own biased opinion... It can happen for a number of reasons and isn't necessarily with securing a webserver. Sometimes security issues get that "well, it isn't an issue right now" view and get put in a backlog and never resolved. Other cases it is a lack of good code reviews or security reviews. Or inexperienced developers (at least inexperienced with that kind of security). From a Dreamhost employee (http://news.ycombinator.com/item?id=3491643 http://news.ycombinator.com/item?id=3491643), that code was from 1999. Could have been any one of the above. The truly sad part is the number of examples of this kind of thing blowing up yet companies are still making the same mistake. At what point does someone think of checking their own apps password practices to ensure they aren't next?
- dredmorbius 15y ago
  One practice that's starting to help, a bit, and it pains me to say it, is security audits. There are a few standards emerging for SAAS services, especially at the B2B level. And as startups (or non-startups) start intersecting with large, regulated, publicly-held businesses, these requirements propagate, and with audits, receive multiple reviews. The process is far from perfect, and many of the standards are laughably lax (and yet ... they still aren't met). Because they're standards, the requests are fairly uniform. A number of issues regarding Dreamhost have been on my own back burner for months, and I'm finally getting that Round Tuit this afternoon. Pushing for good, solid standards would be a net benefit. That's the silver lining here.
  - krobertson 15y ago
    Mentioning standards and security audits makes me cringe in their current state. Certainly agree with you that they'll help, but many are draconian. Things like physical access lists when you use cloud services... or policies on tape backups. :)

lukeholder 15y ago

i got this (screenshot) in my control panel but no email: http://is.gd/yFhhrv http://is.gd/yFhhrv

malandrew 15y ago

Do only shell and ftp passwords need to be reset or does the main account web panel password need to be reset as well? Ask because, we don't use shell/ftp passwords and I'm not sure if we are affected or not.

andfarm 15y ago
Just shell/FTP passwords. As noted above, panel passwords are fine.

ahi 15y ago

This was a nightmare. I was trying to get some urgent changes committed for a client that needed it this afternoon. Just about to commit around 14:00 est and Comcast takes a dive. Comcast support says they'll have it fixed by 5. Not great, I wanted to be done with work early on a Friday, but client is on the west coast so it will still be okay. Comcast comes up and ... shit, can't log in to the server. Try a few dozen variations of my password, then scour the web for an hour looking for hints if I'm locked out or something. Finally decide to check Dreamhoststatus.com. Fuckwits. Only sysadmin has access to panel to reset my password. He's sick and only checking IM sporadically. Finally get logged in and commit at 23:45pm est. Comcast+Dreamhost fucked me and my client real good today. Not much I can do about Comcast, but our migration off of dreamhost is getting pushed up to the top of the list.

dredmorbius 15y ago
Sounds like it's time for some process review. Backup systems admin. Key passwords available in a shared (but encrypted) repo. Multiple data links -- tethering through your cell phone or heading to the local cafe or library in a pinch.
- davebanham 15y ago
  http://passpack.com/ http://passpack.com/ Best password sharing/collaboration tool we've found.

muraiki 15y ago

I just got the email from Dreamhost at about 3:30AM EST. I checked out their status blog and found something interesting: over the past month a good number of people have had malicious .htaccess files and scripts inserted into their Wordpress installs. That would include me. About a month ago one of my Dreamhost sites was hacked. An .htaccess file was modified to insert some PHP scripts that provided a backdoor to the site and that also embedded ads. I see now that I'm not the only one who has had this problem. When I reported this at the time I submitted as much information as possible but only got a canned, autogenerated response. Dreamhost ran an automatic scan on my site and IIRC it did pick up the offending file, but by the time that had been done I had already found it. The particular backdoor was c99shell.I. As I've read more comments, people have had .htaccess files modified who weren't using Wordpress, so it's not a Wordpress problem. This leads me to ask: Is this compromise related to the hacks that I and other users have experienced? If so, how long has the password database been compromised? Thankfully I use GMail for email, so at least that level of personal information wasn't stored on their servers. But this makes me wonder just how long someone has had free reign to access many Dreamhost accounts. Needless to say, I will be switching hosts and will never recommend Dreamhost again. I guess you get what you pay for, and if I had been able to speak with an actual human being about my site being hacked maybe they could have connected the dots. Furthermore, they've had this weak password system since 1999? Edit: Here's a link to the status blog post: http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-passwords-due-to-security-issue http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-... Edit2: I just remembered that I got a strange call from a friend a few months ago who said that when he tried to access my site his corporate firewall had blocked it because of the presence of pornography. This is a church's web site we're talking about, so of course there was no porn on it. This is the same site that was later more overtly hacked in December. Apparently the initial hack only inserted text when a crawler hit the site, so it was an SEO hack. In December, the text became visible to regular users of the site. This post has more detail: http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-passwords-due-to-security-issue/#comment-265213 http://www.dreamhoststatus.com/2012/01/20/changing-ftpshell-...

muraiki 15y ago
After a few emails with DH support, I discovered that there was a file created by another user in two of my accounts. Somehow the permissions for two directories had been set to 777, and a compromised user put a trojan in them. I think that I jumped into conspiracy theory territory above, and misrepresented Dreamhost's security and response as a result of that. The combination of my emotions and my inexperience with dealing with hacking on web hosts led to an incorrect judgment.