WHMCS Data Compromised By Good Old Social Engineering

← Back to Stories (view on slashdot.org)

WHMCS Data Compromised By Good Old Social Engineering

Posted by Unknown on Tuesday May 22, 2012 @01:18AM from the the-classics-never-get-old dept.

howhardcanitbetocrea writes "WHMCS has had 500,000 records leaked, credit cards included, by hackers calling themselves UGNazis. Apparently UGNazis succeeded in obtaining login details from the billing software's host by using social engineering. UGNazis accuse WHMCS of knowingly offering services to fraudsters. After almost 24 hours UGNazis still seem to have control of WHMCS twitter account @whmcs and is regularly updating their exploits. These tweets are also feeding into WHMCS software."

87 comments

Min score:

Reason:

Sort:

In case you wonder who or what WHMCS is... by clickety6 · 2012-05-22 01:21 · Score: 5, Informative

""WHMCS is an all-in-one client management, billing & support solution for online businesses. " For some reason, their website is currently down..

--
----------------------------------- My Other Sig Is Hilarious -----------------------------------
1. Re:In case you wonder who or what WHMCS is... by Anonymous Coward · 2012-05-22 01:26 · Score: 1
  
  For some reason, their website is currently down..
  You didn't refresh enough... I got it to come up.
2. Re:In case you wonder who or what WHMCS is... by Mathinker · 2012-05-22 01:33 · Score: 4, Funny
  
  > ""WHMCS was an all-in-one client management, billing & support solution for online businesses.
  FTFY
3. Re:In case you wonder who or what WHMCS is... by Anonymous Coward · 2012-05-22 05:17 · Score: 1
  
  This is exactly the first question I had. Dammit slashdot, why wouldn't this be in the summary? Isn't it kindof important WHO this victim is?
  I need to find a better tech news source. This is infuriating.
4. Re:In case you wonder who or what WHMCS is... by mcgrew · 2012-05-22 05:30 · Score: 1
  
  Thank you. How hard would it have been for the submitter to include that in the summary? What would a nerd know about client management and billing, except for writing software for it?
  What does WHMCS stand for, anyway?
  
  --
  Free Martian Whores!
5. Re:In case you wonder who or what WHMCS is... by Anonymous Coward · 2012-05-22 05:49 · Score: 0
  
  To the best of my knowledge: WHM Complete Solution
  It was designed to provide fully automated solution for WHM/cPanel based hosting servers but has since been expanded to include support for other platforms and control panels. The name stuck though.
  Of course the above is to the best of my knowledge. I could be wrong.
6. Re:In case you wonder who or what WHMCS is... by Kalriath · 2012-05-22 11:09 · Score: 1
  
  Web hosts didn't stop using WHMCS when it was discovered that you could submit a ticket which WHMCS would execute as PHP, allowing entire databases to be stolen (no social engineering involved) - this sure isn't going to stop them.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
7. Re:In case you wonder who or what WHMCS is... by Anonymous Coward · 2012-05-22 11:32 · Score: 0
  
  and Hostgator.com (the stupid fucks who got duped) WAS a "world-leading provider of web hosting service" (quote from hostgator.com)
  captcha: fooled
Passwords Are Safe, But ... by WrongSizeGlass · 2012-05-22 01:24 · Score: 2

the passwords are “stored in hash format” so they’re safe, but the credit card information may be at risk, along with the contents of all the recently submitted tickets.
How do companies repeatedly let this happen? Encrypt that shit!
1. Re:Passwords Are Safe, But ... by another+random+user · 2012-05-22 01:28 · Score: 1
  
  How do companies repeatedly let this happen? Encrypt that shit!
  "WHMCS is an all-in-one client management, billing & support solution for online businesses" - and would anyone now trust this to store their billing data in as they obviously can't keep their own billing data safe.
  
  --
  -1 troll is not supposed to be used simply because you don't agree
2. Re:Passwords Are Safe, But ... by P-niiice · 2012-05-22 01:30 · Score: 3, Insightful
  
  It was social engineering. Encryption cannot help with human gullibility.
3. Re:Passwords Are Safe, But ... by WrongSizeGlass · 2012-05-22 01:35 · Score: 3
  
  It was social engineering. Encryption cannot help with human gullibility.
  But encryption can protect sensitive data if security is ever breached.
4. Re:Passwords Are Safe, But ... by bmo · 2012-05-22 01:44 · Score: 5, Informative
  
  >But encryption can protect sensitive data if security is ever breached.
  Encryption only works until you give the key away for a candy bar in a social engineering scheme.
  Then all bets are off.
  --
  BMO
5. Re:Passwords Are Safe, But ... by ifrag · 2012-05-22 01:44 · Score: 2
  
  But encryption can protect sensitive data if security is ever breached.
  Unless the security "breached" also includes the information for performing decryption. In which case it didn't protect anything.
  
  --
  Fear is the mind killer.
6. Re:Passwords Are Safe, But ... by Maximum+Prophet · 2012-05-22 01:48 · Score: 2
  
  It was social engineering. Encryption cannot help with human gullibility.
  Yes, it can. If you data is unencrypted anyone can give it out. You use encryption along with policy so that only those that need to know can get the information. For really sensitive information, you make sure that multiple people have to each add their password before the information is allowed to be accessed.
  
  You can also use encryption to insure that machine 'A' can talk to machine 'B' using large certs, but no human has direct access.
  
  --
  All ideas^H^H^H^H^Hprocesses in this post are Patent Pending. (as well as the process of patenting all postings)
7. Re:Passwords Are Safe, But ... by bmo · 2012-05-22 01:54 · Score: 4, Interesting
  
  Replying to myself so others may read a story I am referring to in case they missed it back in 2004.
  http://news.bbc.co.uk/2/hi/technology/3639679.stm
  And it still applies today.
  --
  BMO
8. Re:Passwords Are Safe, But ... by TheLink · 2012-05-22 01:57 · Score: 0
  
  And how many of the people were telling the truth? Did the researchers check that?
  --
  
  Too many replies beneath your current threshold
9. Re:Passwords Are Safe, But ... by devilsdean · 2012-05-22 02:00 · Score: 1
  
  A hashed password being safe is a bold statement from a company that is suppose to be protecting credit card information. Even worse though, is the plain text credit card numbers that "may" be at risk.
10. Re:Passwords Are Safe, But ... by maevius · 2012-05-22 02:00 · Score: 1
  
  Let's say you encrypt them with the highest standard encryption algorithms. Where are you planning to keep the encryption key?
11. Re:Passwords Are Safe, But ... by Anonymous Coward · 2012-05-22 02:01 · Score: 0
  
  It was social engineering. Encryption cannot help with human gullibility.
  Yes, it can. If you data is unencrypted anyone can give it out.
  No, the GP is correct. Encryption, when part of an actual system, means that some human being has the key to decrypt.
  
  You use encryption along with policy so that only those that need to know can get the information.
  And this policy is going to wind up being "don't be gullible."
12. Re:Passwords Are Safe, But ... by blueg3 · 2012-05-22 02:56 · Score: 1
  
  Encryption is not magic.
  If you need to use the stored data, you need to be able to decrypt it. If an automated system needs to use the stored data, that means it needs to have programmatic access to the encryption key. Which means that an attacker can almost certainly get the encryption key. If they don't need to use the stored data, they probably shouldn't be storing it in the first place.
  Encryption is only useful if you can exert better control over the encryption key than the encrypted data.
13. Re:Passwords Are Safe, But ... by garyebickford · 2012-05-22 02:58 · Score: 1
  
  I went to a security conference back in 2000, where the keynote speaker (A Navy guy) discussed their tests of social engineering. They found that the average cost for getting a sysadmin to open up the data center and access to the systems was only $7000 - at Fortune 500 companies, not just the little companies. Of course security awareness and practice has been improved greatly since then (I hope).
  
  --
  It's easier to be a result of the past, but more fun to be a cause of the future! http://www.spacefinancegroup.com/
14. Re:Passwords Are Safe, But ... by GlennC · 2012-05-22 02:58 · Score: 2
  
  Written on a Post-It note stuck under the keyboard.
  DUH!!!
  
  --
  Go on, citizen, stamp the vote card. R or D, your choice.
15. Re:Passwords Are Safe, But ... by bmo · 2012-05-22 03:12 · Score: 2
  
  For $7000 in Y2K dollars, you can forge documents and a search warrant and walk right in to a datacenter, pretending you're the feds and walk out with the machines themselves. While this is a crime, you are committing a crime in the first place anyway by deciding to go after the data, so I don't see this as a barrier for those who don't give a shit.
  --
  BMO
16. Re:Passwords Are Safe, But ... by hey! · 2012-05-22 03:19 · Score: 3, Insightful
  
  It was also lousy but unfortunately common business practices.
  Suppose you're a company that handles billing and payments for clients. One of your clients asks you for the credit card information for all of *his* clients. This scenario shows why you should be very reluctant to give that data to him. And for all you know, *he's* going to use it to commit identity fraud, or sell it on the black market.
  Not disclosing this information inconveniences the customer slightly, but it also protects him.
  When you receive sensitive private information from someone, you should not use it or transfer it to any third parties except as necessary to fulfill the purpose for which you received it, *even if* you are just a middleman between the buyer, the vendor, and the vendor's bank. Get the money transferred into the customer's account and the order to the customer's order fulfillment people and your job is done.
  These problems come from not *thinking*. End user sends you data, you automatically store it without thinking, whether you need it or not. Customer asks you for that data, and you automatically give it to him without thinking. A service agreement should be concluded between you and your customer establishing what the customer is going to do with that data, and when and how the data will be provided. You shouldn't just give him data that is not necessarily *his* by right just because he asks for it.
  The underlying problem is that companies operate as if the privacy and security of their end-users is none of their concern.
  
  --
  Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
17. Re:Passwords Are Safe, But ... by Anonymous Coward · 2012-05-22 03:19 · Score: 0
  
  "Would you give out your password for a Klondike bar?"
  "ñ0+r3@11y"
  "That's trusting of you, and here's your Klondike bar."
18. Re:Passwords Are Safe, But ... by Anonymous Coward · 2012-05-22 03:56 · Score: 0
  
  And this policy is going to wind up being "don't be gullible."
  The main purpose of the "policy" is to impose consequences if someone lets the data out. By establishing rules and consequences for breaking those rules you make it slightly harder to convince any given employee that it's worth their while to hand over the data.
19. Re:Passwords Are Safe, But ... by cdrguru · 2012-05-22 04:06 · Score: 1
  
  I think the idea is to encrypt the data and not have the key stored anywhere.
  This is roughly like not having a file cabinet, just a shredder. Very secure records storage with zero possibility of any sort of disclosure. It is more difficult to access, however.
  It is perhaps the only way to be truely safe.
20. Re:Passwords Are Safe, But ... by maevius · 2012-05-22 04:29 · Score: 1
  
  In passwords you can one way encrypt them (meaning, no key is kept) because you know that a person will remember and enter the password everytime.
  The reason companies keep credit card data is so they can charge recurring fees automatically or the well known one click buy, so a computer must be able decrypt and use accordingly. If you don't keep the key, you defeat the purpose of the whole scheme. The only way to protect the data (without being truly secure) is to use a hardware security module along with high physical security (something along PCI-DSS standards)
  To sum it up: There is NO true security. If you can't protect cardholder data, don't keep it
  btw, somewhere in their website I read that the cards were encrypted but it suggested that the key was trivial to find.
21. Re:Passwords Are Safe, But ... by sjames · 2012-05-22 05:14 · Score: 1
  
  Way back in the wild west days of the internet, I built a system that accepted CC numbers at signup for monthly billing. The numbers were encrypted with gpg before being stored in the database. The web server only had the public key.
  Each month, the encrypted CC numbers were dumped to floppies and sneakernet-ed to a CC processing machine with no net connection.
  I'm pretty sure nobody ever got a copy of the database, but I'm absolutely sure that if someone did, the accounts will have been closed long before they can get the numbers decrypted. Why can't they manage that now?
22. Re:Passwords Are Safe, But ... by achbed · 2012-05-22 05:31 · Score: 1
  
  Remember folks - ROT13 is NOT encryption (no matter what your auditors say)...
23. Re:Passwords Are Safe, But ... by sjames · 2012-05-22 05:40 · Score: 1
  
  If it's done right, it requires subverting one of a very few people who have root access to the CC processing machine. I say subverting because the needed request would be obviously not part of business as usual and the people who could get the key would understand the implications.
24. Re:Passwords Are Safe, But ... by Anonymous Coward · 2012-05-22 07:42 · Score: 0
  
  Not when the hackers took the whole server,
  they got the locks and the keys
  so they got the whole damn kingdom
  Im going to hack proof my computers now,
  ( Puling pug )
25. Re:Passwords Are Safe, But ... by asdf7890 · 2012-05-22 08:14 · Score: 1
  
  Impersonating the feds is a higher offense than just nicking stuff, including data, unless the stuff/data is of "national security" importance.
26. Re:Passwords Are Safe, But ... by Anonymous Coward · 2012-05-22 11:41 · Score: 0
  
  and exept if cc_encryption_hash is in clear text in the root directory and available on pastebin
27. Re:Passwords Are Safe, But ... by plover · 2012-05-22 12:04 · Score: 1
  
  I'd like to know what makes them think the hashes of the passwords are safe. I think the thieves should paste one into Google and see what pops up (Google being well known as the world's most widely available rainbow table for common hash digest values.) What are the chances these security boffins salted their hashes?
  
  --
  John
28. Re:Passwords Are Safe, But ... by bmo · 2012-05-23 02:47 · Score: 1
  
  Or if your debug script puts all usernames and passwords in cleartext in world-readable /tmp/ for your paid customers for chat.youporn.com.
  For years.
  --
  BMO
I guess by slashmydots · 2012-05-22 01:25 · Score: 2

Hmmm 24 hours of criminals posting tweets detrimental to your business on their own account which is displayed in their own software. I guess everyone over at WHMCS must be on vacation...OR ARE COMPLETE MORONS! Maybe they forgot their security question though, lol.
1. Re:I guess by egamma · 2012-05-22 01:29 · Score: 1
  
  Hmmm 24 hours of criminals posting tweets detrimental to your business on their own account which is displayed in their own software. I guess everyone over at WHMCS must be on vacation...OR ARE COMPLETE MORONS! Maybe they forgot their security question though, lol.
  Or the ugnazis changed the security question/answer...
  
  --
  Battlemaster--Game with friends in medival realms
2. Re:I guess by CanHasDIY · 2012-05-22 01:45 · Score: 1
  
  Hmmm 24 hours of criminals posting tweets detrimental to your business on their own account which is displayed in their own software. I guess everyone over at WHMCS must be on vacation...OR ARE COMPLETE MORONS! Maybe they forgot their security question though, lol.
  Or the ugnazis changed the security question/answer...
  And here I thought that was obvious...
  
  --
  An enigma, wrapped in a riddle, shrouded in bacon and cheese
salty... salty... by vlm · 2012-05-22 01:33 · Score: 2

the passwords are “stored in hash format” so they’re safe
Assuming their programmers know what a salt is (maybe they do, maybe they don't, he's not saying), and/or their users are not using passwords typically seen in a dictionary attack (yeah right)

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
1. Re:salty... salty... by Tanktalus · 2012-05-22 01:46 · Score: 2
  
  And you're assuming that the passwords are valuable enough to spend sufficient CPU cycles to attempt to crack. If they can find some important users, maybe their passwords are valuable enough to try. I would guess that most users are likely not valuable enough to attempt.
2. Re:salty... salty... by Anonymous Coward · 2012-05-22 01:58 · Score: 0
  
  And you're assuming that the passwords are valuable enough to spend sufficient CPU cycles to attempt to crack. If they can find some important users, maybe their passwords are valuable enough to try. I would guess that most users are likely not valuable enough to attempt.
  If they're not salted and stretched, rainbow tables will give them the entire database in short order.
3. Re:salty... salty... by Anonymous Coward · 2012-05-22 01:58 · Score: 0
  
  CPU cycles are practically free, thanks to ubiquitous windoze machines and the botnets they operate. Of course it still makes sense to hit the juiciest targets first.
4. Re:salty... salty... by Anonymous Coward · 2012-05-22 02:10 · Score: 2, Informative
  
  the passwords are “stored in hash format” so they’re safe
  Assuming their programmers know what a salt is (maybe they do, maybe they don't, he's not saying), and/or their users are not using passwords typically seen in a dictionary attack (yeah right)
  A salt isn't some magic pixie dust that makes hashes more secure: you also have to use them correctly. If the code is something like
  $salt = 'n1c3tryh4x0r$';
  $hash = SHA1($salt . $password);
  Then it's not very useful. If on the other hand it's something like
  $salt = base64(arc4random() . arc4random());
  $hash = $salt . '$' . HMAC_sha1($salt, $password);
  Then one would have much less to worry about.
5. Re:salty... salty... by vlm · 2012-05-22 03:17 · Score: 1
  
  Well, yeah, but first you have to know what a salt is and why you'd want to use it.
  I thought the language of the quote was interesting, “stored in hash format” not “stored in hashed salted format”. Neither makes any sense when passing thru a journalist filter so we can assume the quote did not pass thru a PR filter or a journalist filter and that's, unfortunately, the actual technical state. Its probably by their own admission just a simple hash of the bare string that will momentarily be rainbowtabled.
  Luckily they don't have email addresses, and users never use the same email addrs/password combo at multiple web sites, so everyone will be OK (LOL)
  
  --
  "Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
6. Re:salty... salty... by Kalriath · 2012-05-22 11:24 · Score: 1
  
  Passwords are MD5 hashed. That is all. No salting, no SHA1, just plain old MD5.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Actually, the data is already out there it seems by Anonymous Coward · 2012-05-22 01:39 · Score: 0

Both the salt and cc decrypt key were stored in the configuration which was downloaded along with the DB.
From what I've heard, it's trivial to recover the file and all the data
WHMCS is Hosted by Hostgator by Anonymous Coward · 2012-05-22 01:46 · Score: 4, Informative

As a former employee, posting this as anonymous for obvious reasons; however, the below information is freely available if you know where to look.
WHMCS is hosted by Hostgator on a dedicated server. This can be found by:
% dig NS whmcs.com +short | head -1 | xargs dig +short | xargs whois
# http://whois.arin.net/rest/nets;q=50.116.115.104?showDetails=true&showARIN=false&ext=netref2
HGBLOCK = Hostgator IP block, the Arin address is Hostgator's main office, and websitewelcome.com is Hostgator's generic domain they use for reseller server's hostnames/nameservers.
It's easy by Stargoat · 2012-05-22 01:47 · Score: 2

Amateurs target systems, professionals target people. The weakest part of any IT system is the users. We know all this. For example, Mondays have the most downtime, as they are associated with changes made over the week. A user that installs a gotoassist to 'help' the IT department. Etc etc.

--
Hoist Number One and Number Six.
Official announcement by Solozerk · 2012-05-22 01:48 · Score: 5, Informative

The official post on this from WHMCS is interesting: http://blog.whmcs.com/?t=47660
They're saying that the intruders managed to obtain credentials from their web hosting company, which allowed them to access the (I assume) dedicated servers rented by WHMCS.

Putting aside the fact that they're storing CC data on a third party server, what the blog post does not explain is how exactly this would amount to a total compromise of those accounts, as the server passwords should not even be known by the hosting company, and in any case this data should have been encrypted. It would also be interesting to know how they went from that to accessing the company's twitter account - my guess would be that the same password was used on twitter as on their servers.

So basically: no encryption, relying on an insecure third party to store critical data, and possibly the same password being used for a major hosting server and their twitter account. I, for one, would not rely on this company to handle billing & support for my customers.
1. Re:Official announcement by creedfeed · 2012-05-22 02:14 · Score: 1
  
  The owner of the company suggested that the hackers gained access to his email account which was used to social engineer the hosting company to gain access to the servers. The hosting company had knowledge of the server passwords because Hostgator offers fully managed dedicated servers. Hostgator handles all of the managing and security of the servers, thus they have and need the server passwords.
  
  --
  -Steve http://www.creedfeed.com
2. Re:Official announcement by longk · 2012-05-22 02:46 · Score: 1
  
  Actually the CC info is stored in encrypted form in the WHMCS database. This is quite common and protects against database leaks through injection, etc. Unfortunately, because the hackers had complete root access, they were also able to obtain the decryption key as well.
3. Re:Official announcement by Anonymous Coward · 2012-05-22 03:15 · Score: 0
  
  Come on. This is standard practice with banks, after all.
4. Re:Official announcement by Solozerk · 2012-05-22 03:26 · Score: 1
  
  The CC info should IMHO have been encrypted with a combination of the user's password and such a key - that way, even WHMCS doesn't have access to it, except at the very moment a transaction needs to occur (when the user types in his password).
  
  Of course, if recurring automatic payments or similar are needed, then WHMCS does indeed need to keep the CC details readable (and even then I'm not 100% sure of that, as I believe a lot of banks payment APIs offer some sort of token mechanism defining a CC details for a specific purpose - IE, not usable for other payments). But in that case, it should have been handled on a separate server or even better: through the use of one of the many cheap, dedicated, PCI-compliant services that do exactly that.
5. Re:Official announcement by Anonymous Coward · 2012-05-22 03:31 · Score: 1
  
  The hosting company had knowledge of the server passwords because Hostgator offers fully managed dedicated servers. Hostgator handles all of the managing and security of the servers, thus they have and need the server passwords.
  In most cases, that isn't true. A typical provision for a dedicated server involves installing a public key that we use to access via root. The root password is usually only needed if we're accessing via IPMI/iDRAC and need to login from the remote console, or if the user has removed the public key from /root/.ssh/authorized_keys, or if public key authentication for root has been disabled, either by request due to security reasons, or because the client felt it necessary.
  Sincerely, former Hostgator employee
6. Re:Official announcement by Anonymous Coward · 2012-05-22 04:42 · Score: 0
  
  Putting aside the fact that they're storing CC data on a third party server, what the blog post does not explain is how exactly this would amount to a total compromise of those accounts, as the server passwords should not even be known by the hosting company
  In this case, they were on a single managed server, so the provider (Hostgator) did in fact have the root password.
7. Re:Official announcement by Anonymous Coward · 2012-05-22 07:51 · Score: 0
  
  And recurring billing would work how?
UGNazis eh? by Viol8 · 2012-05-22 01:56 · Score: 1

Read: A bunch of stupid glory hunting kids who have no concept of what real nazis were like or they wouldn't use such a poor taste name.
1. Re:UGNazis eh? by xero314 · 2012-05-22 04:16 · Score: 1
  
  I know just look at some of the claims of the 25 point program:
  
  The right to determine matters concerning administration and law belongs only to the citizen.
  We demand that the state be charged first with providing the opportunity for a livelihood and way of life for the citizens.
  All citizens must have equal rights and obligations.
  Abolition of unearned (work and labour) incomes. Breaking of debt (interest)-slavery.
  In consideration of the monstrous sacrifice in property and blood that each war demands of the people, personal enrichment through a war must be designated as a crime against the people.
  The State is to care for the elevating national health by protecting the mother and child, by outlawing child-labor, by the encouragement of physical fitness
  We demand legal opposition to known lies and their promulgation through the press.
  We demand freedom of religion for all religious denominations within the state
  
  Now there are some sick fucks right there. I mean seriously you put those rules in place and people stop profiting from the exploitation of their fellow man, and that my friend would certainly be a shame.
2. Re:UGNazis eh? by Viol8 · 2012-05-22 21:57 · Score: 1
  
  Looks like a cut and paste from a standard issue left wing student debate.
  Nothing to see here....
3. Re:UGNazis eh? by xero314 · 2012-05-23 03:54 · Score: 1
  
  It's actually a selective cut and paste from 25 point program of the German National Socialist Party. It's good that we bring light to the atrocities of WWII but to condemn an entire group of people without understanding the benefits they brought to their country is a little near sighted.
Re:raising awareness by Anonymous Coward · 2012-05-22 01:58 · Score: 0, Funny

So I gather you're doing some Japanese Jiu Jitsu, not those Brazilian upshots...
Forum Discussion From Industry Peeps by Anonymous Coward · 2012-05-22 02:02 · Score: 2, Interesting

For discussions on this from people within the hosting industry, see http://www.webhostingtalk.com/showthread.php?t=1156920 ... interesting read.
There was no hacking!! by rudy_wayne · 2012-05-22 02:14 · Score: 4, Informative

The person was able to impersonate myself with our web hosting company, and provide correct answers to their verification questions. And thereby gain access to our client account with the host, and ultimately change the email and then request a mailing of the access details.
This means that there was no actual hacking of our server. They were ultimately given the access details.
Yes, they didn't break in, YOU FUCKING LET THEM IN, because that really makes a difference.
1. Re:There was no hacking!! by Anonymous Coward · 2012-05-22 02:33 · Score: 0
  
  Damn it yes! That's exactly what people forget. The founder blogs saying that's their servers were not hacked and that it was just a social engineering trick. Like this is supposed to make his customers feel better? It's like saying.. hey our servers didn't need to get hacked because we're so stupid we let them in !! :) :) :)
2. Re:There was no hacking!! by longk · 2012-05-22 02:41 · Score: 1
  
  It does make a BIG difference. Tons of businesses use the same software that WHMCS uses on their server. These businesses need to know whether the used software is unsafe or not. If the compromise was purely social engineering and no software hack a lot of people will sleep better.
3. Re:There was no hacking!! by Anonymous Coward · 2012-05-22 02:51 · Score: 1
  
  Yes, they didn't break in, YOU FUCKING LET THEM IN, because that really makes a difference.
  No, the third-party hosting company let them in, which is very different. I presume this will make for an entertaining lawsuit.
  Aren't you glad your data is safe in the cloud, administered by professionals?
4. Re:There was no hacking!! by Anonymous Coward · 2012-05-22 03:20 · Score: 0
  
  By your account, their hosting provider were the ones who let them in. I don't know the whole truth of the matter, but sometimes things like this happen. I'm more interested to see what happens with HostGators clients now that they have given hackers access to one of their major accounts.
  This is why I do not like security questions/answers.
Credit Cards Were Encrypted by canadiannomad · 2012-05-22 02:29 · Score: 1

Ok everyone is assuming the creditcards weren't encrypted...
Direct from their site:
http://forum.whmcs.com/showthread.php?t=47650
"3. Credit card information although encrypted in the database may be at risk"
So I assume that the risk is more that they got access to the dedicated server (root login maybe) and got ahold of the private key (passphrase?)

--
Hmm, the humour and sarcasm seem to have been be lost on you.
1. Re:Credit Cards Were Encrypted by Anonymous Coward · 2012-05-22 02:41 · Score: 0
  
  The salts used to encrypt data is in the config files of WHMCS. The hackers did get access to the box so they have the salts and the encrypted data.
Stole Passwords and vocabulary words too by retroworks · 2012-05-22 02:49 · Score: 1

Damn, I didn't even realize they had broken into the dictionary to steal the words "social engineering" to apply the term to computer fraud. http://en.wikipedia.org/wiki/Social_engineering_(security)

--
Gently reply
Anyone? by Cute+Fuzzy+Bunny · 2012-05-22 02:55 · Score: 3, Funny

I was just wondering what WHCMCHSHCHSC stood for, but the article never mentions it and neither did the front page of the company's web site.
So aside from having security issues, somewhere along the line someone forgot that not everyone knows what WHCSMSHC XVIII stands for.
1. Re:Anyone? by Anonymous Coward · 2012-05-22 05:29 · Score: 0
  
  We Have Marginal Credit Security
2. Re:Anyone? by Anonymous Coward · 2012-05-22 08:53 · Score: 0
  
  WHMCS = Web Host Management Control System
3. Re:Anyone? by Cute+Fuzzy+Bunny · 2012-05-22 13:33 · Score: 1
  
  See? I knew there was an answer, AND someone willing to find it.
4. Re:Anyone? by Anonymous Coward · 2012-05-23 04:45 · Score: 0
  
  Its actually web host management complete solution. :)
I never like the guy by future+assassin · 2012-05-22 03:34 · Score: 1

who owned WHMCS but don't want to be in his shoes now.
From WHMCS
Initial indications are that the database of our ticketing system may have been compromised, and thus we would recommend that if you have recently sent us a ticket containing your WHMCS or FTP login details, and have not yet changed them again following that, that you do so as soon as possible. As soon as we know more about what happened we'll provide updates.

--
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Re:Ads by Anonymous Coward · 2012-05-22 03:56 · Score: 0

So there is this box "Ads Disabled" ticked, but I still see an Ad for microsoft, a tiny rectangle taking up 25% of my screen real estate... What gives?
That's a load of horse shit. If you've scrolled this far, the "Ad for microsoft" has already scrolled up and off. It's not just 25%, it's a transient 25%.
Oh I get it..it's related to /. story yesterday by WOOFYGOOFY · 2012-05-22 04:09 · Score: 1

http://hardware.slashdot.org/story/12/05/21/1915247/mega-uploads-the-clouds-unspoken-hurdle
Except it's a sort of explainer to that story.
Yeah, that's it.
Hacker Warz! by Anonymous Coward · 2012-05-22 06:00 · Score: 1

Now it's turning into a hacker war...

http://www.cyberwarnews.info/2012/05/23/a-message-for-ugnazi-from-underground-crew-gearsec/

http://pastebin.com/KrRG81e4
WHMCS Customer Here by G33kDragon · 2012-05-22 07:02 · Score: 1

My company uses WHMCS and, after downloading all the released data, I was happy to find that accounting had used a PayPal subscription to purchase the license, as all the "card number" fields in the SQL dump were blank.

That being said... they also store all emails sent to customers. Including the Welcome Email that includes the original password used for master accounts.

So, could be worse on our end, but still major suckage overall.
Check if your info was found in the leak by Anonymous Coward · 2012-05-22 07:15 · Score: 0

I wrote a quick script for checking for your e-mail against the leaked database that was obtained from WHMCS.
You can access it here: http://whmcs.h02.org
Security Questions deemed dangerous by MarcAuslander · 2012-05-22 07:19 · Score: 1

It has been pointed out many times that the security question system is dangerous if the user does what he's told. It is in general easier to find out what someone's high school mascot was than to guess his password! My approach it to provide nonsense answers I can retrieve for all such question. No one's going to guess that my mother's maiden name was bottleofbitsofstuff for example. You can use the same answer for all questions if they let you, or use obvious variants otherwise.
Reason by Anonymous Coward · 2012-05-23 04:58 · Score: 0

UGNazis accuse WHMCS of knowingly offering services to fraudsters.
~~~~~~~~
I have an idea, how about we fuck over all of their customers, that have nothing to do with it to get back at them.
TOOLS -- - glad to hear that UGNazis got PWNED today. Greetz