Slashdot Mirror
Web Hosting Sites Bluehost, DreamHost, Hostgator, OVH and iPage Were Vulnerable To Simple Account Takeover Hacks (techcrunch.com)
A security researcher has found, reported and now disclosed a dozen bugs that made it easy to steal sensitive information or take over any customer's account from some of the largest web hosting companies on the internet. From a news report: In some cases, clicking on a simple link would have been enough for Paulos Yibelo, a well-known and respected bug hunter, to take over the accounts of anyone using five large hosting providers -- Bluehost, DreamHost, Hostgator, OVH and iPage. "All five had at least one serious vulnerability allowing a user account hijack," he told TechCrunch, with which he shared his findings before going public. The results of his vulnerability testing likely wouldn't fill customers with much confidence. The bugs, now fixed -- according to Yibelo's writeup -- represent cases of aging infrastructure, complicated and sprawling web-based back-end systems and companies each with a massive user base -- with the potential to go easily wrong. In all, the bugs could have been used to target any number of the collective two million domains under Endurance-owned Bluehost, Hostgator and iPage, DreamHost's one million domains and OVH's four million domains -- totaling some seven million domains.
An attack that requires getting the victim to click a malicious link is far, far less serious than an attack which can be carried out without the victim's participation.
^ And whois privacy makes the attack much less likely. These kinds of cross-site scripting attacks are basically one step above phishing.
Should be fixed, but nothing to worry too much about.
This space intentionally left blank
This completely goes against the ultra-secure impression I had of shared web hosting companies!
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
There was little danger of that happening, even though I am aware that there was a concerted effort to put violent Russian hackers on the street. Nice try it was never going to work that way
Used to work for Bluehost, they fired most of the competent developers and off-shored the support. They were pretty slow on updating Red Hat as well.
I always use SSH on all my hosting accounts and the number of security flaws I've found are really ridiculous.
Hell even as we speak one of my shared hosts allows executing a non-standard location ps and it shows the full script execution parameters from other clients/users including --username=x --password=x from their web browser supplied FTP client. Which means you could already login with their credentials and at least delete or modify all their stuff. And this is a main hosting provider.
You are probably being sarcastic, but this kind of thing will be an issue with "the cloud"; the cloud just being glorified web hosting.
A single vulnerability will expose hundreds or more customers to mass attacks.
However, this doesn't necessarily mean it's worse than self-hosted systems*, only that breaches may be more public because many other orgs will be in the same boat.
It's kind of comparable to nuclear power: it's less illness and death per generated kilowatt on average, but failures tend to be quite public and "in batches" compared to the alternatives, creating public relations headaches.
* Self-hosted systems can be more secure, but I don't trust the average company to do it right. I've worked for too many PHB's.
Table-ized A.I.
Just the usual content-free msmash-trash.
I have a virtual host with OVH - pretty good specs, works fine and as cheap as chips!
>/dev/null 2>&1
from the number of attempted attacks from hosting IP ranges, not really suprising.
Especially as even if you send them a log showing the attack, you don't even get a reply, They need a good suing for being useless shits