4 ms·

Ramnode down after SolusVM vulnerability exposed

33 points by jemka 13y ago

jemka 13y ago
Ramnode's SolusVM was hacked earlier and attempting to log in gave you a list of every single subsciber's email address, name, and root password (plain text) to their VPS as well as IP address. Source: http://www.reddit.com/r/webdev/comments/1gga3n/ramnode_hacked_names_emails_and_passwords/ http://www.reddit.com/r/webdev/comments/1gga3n/ramnode_hacke... http://localhost.re/p/solusvm-11303-vulnerabilities http://localhost.re/p/solusvm-11303-vulnerabilities http://www.webhostingtalk.com/showthread.php?t=1276286 http://www.webhostingtalk.com/showthread.php?t=1276286 If you use SolusVM: http://blog.soluslabs.com/2013/06/16/important-security-alert-all-solusvm-versions/ http://blog.soluslabs.com/2013/06/16/important-security-aler... "We are working to get things back online. We were hit with a SolusVM exploit late last night." (https://twitter.com/RamNode https://twitter.com/RamNode) Happy Father's Day!
- bndr 13y ago
  Confirmation from Ramnode twitter "We are working to get things back online. We were hit with a SolusVM exploit late last night."
- Deeehem 13y ago
  Is this known to only affect authorised users in Solus?
zedpm 13y ago
Sigh. I'm glad I didn't give them any billing information (monthly invoice paid each time via Paypal). It's not clear to me how/why root passwords are compromised by this exploit; anyone care to elaborate?
- ams6110 13y ago
  Stupidity, or appalling ignorance on the part of the SolusVM developers.
- Wyrmkill 13y ago
  It's talking about the auto-generated root password that gets emailed to you upon creation of your VM initially. Most everyone would, hopefully, have changed his/her root password manually, upon receiving it in email via cleartext.
  - jscheel 13y ago
    I'm getting conflicting reports about the passwords. Were these plaintext passwords ONLY the autogenerated ones, or are there other passwords that have been compromised as well. Also, has anyone been able to get a list of everything that was displayed on the page?
aroch 13y ago
Apparently there are allegation going around that it was done by a competitor, servercrate. http://lowendtalk.com/discussion/comment/284016/#Comment_284016 http://lowendtalk.com/discussion/comment/284016/#Comment_284...
- kbar13 13y ago
  there's apparently a running joke for the less ethical types on lowendtalk to go around pwning people's sites and pretending to be robertclarke. He even got swat'ed the other day. Having read robertclarke's previous posts and knowing his ignorance of even basic Linux system administration, pretty sure he's just on the unfortunate end of an immature joke.
  - aroch 13y ago
    Heh, I was unaware of that. How odd...Thanks!
Wyrmkill 13y ago
Unofficial RamNode PostMortem: https://gist.github.com/ElliotSpeck/66943b70c8b98e5b2afb https://gist.github.com/ElliotSpeck/66943b70c8b98e5b2afb
zrail 13y ago
Nodes appear to be back up.
ledzgio 13y ago
Any news? my VM is down and I see here that all the nodes are still down: http://status.ramnode.com/ http://status.ramnode.com/
nenolod 13y ago
Honestly the usage of SolusVM, WHMCS etc (i.e. things written in PHP which have no business being written in at least, the way a PHP typically is written) has been the main security problem of the entire industry. We need more things like OpenStack out there -- competently designed and implemented toolstacks that actually work correctly and have a remotely acceptable security model.
nieve 13y ago
It's a nightmare for them and I'm sure they'll lose customers over it, but I'm staying when two days ago I was planning on canceling my vps due to underuse. It was ridiculously fast for a vm (>700MB/s with vpsbench, all tests), but the $5/mo Digital Ocean instances were fast enough with PostgreSQL/Sphinx that none of my (free) users were complaining. I like Digital Ocean, I'm keeping some stuff over there, but I appreciate Ramnode's transparency & dedication during this. It doesn't hurt that they're probably going to be constructively paranoid now that they've gotten burned. This is one of those things my partner saw all the time running a restaurant - screwups are unavoidable, but handling them well can actually get you a loyal customer.

33 points by jemka 13y ago

jemka 13y ago

Ramnode's SolusVM was hacked earlier and attempting to log in gave you a list of every single subsciber's email address, name, and root password (plain text) to their VPS as well as IP address. Source: http://www.reddit.com/r/webdev/comments/1gga3n/ramnode_hacked_names_emails_and_passwords/ http://www.reddit.com/r/webdev/comments/1gga3n/ramnode_hacke... http://localhost.re/p/solusvm-11303-vulnerabilities http://localhost.re/p/solusvm-11303-vulnerabilities http://www.webhostingtalk.com/showthread.php?t=1276286 http://www.webhostingtalk.com/showthread.php?t=1276286 If you use SolusVM: http://blog.soluslabs.com/2013/06/16/important-security-alert-all-solusvm-versions/ http://blog.soluslabs.com/2013/06/16/important-security-aler... "We are working to get things back online. We were hit with a SolusVM exploit late last night." (https://twitter.com/RamNode https://twitter.com/RamNode) Happy Father's Day!

bndr 13y ago
Confirmation from Ramnode twitter "We are working to get things back online. We were hit with a SolusVM exploit late last night."
Deeehem 13y ago
Is this known to only affect authorised users in Solus?

zedpm 13y ago

Sigh. I'm glad I didn't give them any billing information (monthly invoice paid each time via Paypal). It's not clear to me how/why root passwords are compromised by this exploit; anyone care to elaborate?

ams6110 13y ago
Stupidity, or appalling ignorance on the part of the SolusVM developers.
Wyrmkill 13y ago
It's talking about the auto-generated root password that gets emailed to you upon creation of your VM initially. Most everyone would, hopefully, have changed his/her root password manually, upon receiving it in email via cleartext.
- jscheel 13y ago
  I'm getting conflicting reports about the passwords. Were these plaintext passwords ONLY the autogenerated ones, or are there other passwords that have been compromised as well. Also, has anyone been able to get a list of everything that was displayed on the page?

aroch 13y ago

Apparently there are allegation going around that it was done by a competitor, servercrate. http://lowendtalk.com/discussion/comment/284016/#Comment_284016 http://lowendtalk.com/discussion/comment/284016/#Comment_284...

kbar13 13y ago
there's apparently a running joke for the less ethical types on lowendtalk to go around pwning people's sites and pretending to be robertclarke. He even got swat'ed the other day. Having read robertclarke's previous posts and knowing his ignorance of even basic Linux system administration, pretty sure he's just on the unfortunate end of an immature joke.
- aroch 13y ago
  Heh, I was unaware of that. How odd...Thanks!

Wyrmkill 13y ago

Unofficial RamNode PostMortem: https://gist.github.com/ElliotSpeck/66943b70c8b98e5b2afb https://gist.github.com/ElliotSpeck/66943b70c8b98e5b2afb

zrail 13y ago

Nodes appear to be back up.

ledzgio 13y ago

Any news? my VM is down and I see here that all the nodes are still down: http://status.ramnode.com/ http://status.ramnode.com/

nenolod 13y ago

Honestly the usage of SolusVM, WHMCS etc (i.e. things written in PHP which have no business being written in at least, the way a PHP typically is written) has been the main security problem of the entire industry. We need more things like OpenStack out there -- competently designed and implemented toolstacks that actually work correctly and have a remotely acceptable security model.

nieve 13y ago

It's a nightmare for them and I'm sure they'll lose customers over it, but I'm staying when two days ago I was planning on canceling my vps due to underuse. It was ridiculously fast for a vm (>700MB/s with vpsbench, all tests), but the $5/mo Digital Ocean instances were fast enough with PostgreSQL/Sphinx that none of my (free) users were complaining. I like Digital Ocean, I'm keeping some stuff over there, but I appreciate Ramnode's transparency & dedication during this. It doesn't hurt that they're probably going to be constructively paranoid now that they've gotten burned. This is one of those things my partner saw all the time running a restaurant - screwups are unavoidable, but handling them well can actually get you a loyal customer.