My Thoughts About Hacking... [Part 1]

Jul 8, 2008

Is security really that critical? If so, why are some of the largest software companies providing such a bad example for the rest of the industry? Why would someone want to target my website? Why is security often overlooked?

These are all common questions that arise on a daily basis within the online industry.

The rest of this article will provide some detailed answers, along with practical examples and true scenarios.

I've spoken with numerous hackers over the past short while. I can't count the number of times I've heard the line "Ignorant site owners deserve to be hacked". In my opinion, that's like claiming that cars without alarms deserve to be stolen, or homes without alarm systems deserve to be burglarized. It's not just wrong - it's illegal.

Security risks and vulnerabilities affect the entire online industry. When a single website is hacked, there are usually multiple other victims. This is most commonly seen with widely distributed software. A potential attacker has the ability to install the software on a test environment, locate the vulnerabilities, then attack random victims even before anyone else is aware of the potential exploits. Once a vulnerability is located, the attacker simply needs to search for other environments using the same software, and within minutes there are hundreds, often thousands of potential victims.

Typically, in the race to market, software providers are encouraged to release their products as soon as the applications are usable. Critical development procedures are often overlooked or intentionally bypassed. One such miss is an application vulnerability assessment. Although the product may be usable, the effects of a vulnerable application could be severe.

Sadly, nobody is "off limits" when it comes to hacking. Most hackers feel safe committing online crime, since the online industry has evolved much faster than the security industry. Many applications are not created with the intent to recognize hacking attempts. Some hackers view their actions as a competition - Who can attack the most valuable website? Who can exploit the most user databases? In many cases, these attacks are bragged about within the hacker's immediate network. The competitive nature of these hacking groups has become so severe, there have been reports of attacks between competing organizations.

You might ask, "If I use industry standards, won't my environment be secure?". The short answer: no, but it helps. Hackers are not restricted by industry standards. Most security companies only implement new standards once at least one victim is reported. This often gives hackers plenty of time to locate other vulnerable environments, and before long, the number of victims can increase rapidly. Hackers are some of the most innovative individuals within the online industry. The most logical way to combat them is to use similar methodology for security purposes.

View 2 Replies


ADVERTISEMENT

LiquidWeb Thoughts?

May 6, 2009

I was wondering what people thought of Liquid Web, my friend has his site (twivo.com) with Liquid Web and says they are absolutely amazing. But I want to know what other people think of them.

View 14 Replies View Related

Thoughts On Amazon AWS

May 8, 2008

Are the amazon's EC2/S3 solutions a viable alternative to dedicated hosting? The thought of capacity/bandwidth/computing power on demand sounds great in theory. Could it host a basic LAMP setup?

If you've done any research in this area i'd love to hear your thoughts. Are they apples and oranges?

View 4 Replies View Related

1and1.co.uk - Your Thoughts And Experiences?

Aug 29, 2006

Hope this is the right place for this question. I'm interested in hosting with 1and1.co.uk as they are good value and allow multiple domains to be hosted (incidentally, will nosy people be able to figure that the different domains are hosted on the same package?).

Just wanted to hear your thoughts and experiences? It seems cheaper to host on their American site compared to the British site. Am I allowed to do that?

View 8 Replies View Related

Zayo Bandwidth Thoughts?

May 2, 2009

Anyone use Zayo bandwidth?

How do you rate them?

If you had to choose between Cogent and Zayo, who would you go with?

We are planning to get transit from another carrier and someone recommended Zayo, so just want to hear your thoughts.

View 14 Replies View Related

Wiredtree First Thoughts Review

Feb 3, 2009

I was having problems with shared hosting so I'm having a crack with a VPS from wiredtree. I have been with them 3days so thought I'd post up an early review on my first thoughts then update 3months on, 6months and 12months.

I'm new to the VPS world and have never had any experience with server management/functions other than with-in cpanel so you could say I'm a total noob, so this is coming from a newbie perspective. Ok so here goes for the pros/cons so far.

Pros:

- The set-up was fast once sorted (see the first con).

- The payment system and ordering process was easy to follow.

- The support is very fast helpful and understanding (this is for their online support not phoned them yet).

- The start-up e-mail is useful and gives clear direct instructions.

- The prices are fair and in-line with the market.

- Their 'Grove' control panel is clean and clear and gives you access to vital functions and information, such as DNS, server stats, billing and support.
Cons:

- When I set-up my account they didn't ring to confirm I had to chase them to get it sorted but once it was confirmed my server was up in under 1 hour.

- On their bottom package they give 348mb ram which before you put anything else on the server over 60% of this is used by other functions/softwares. Of course these things can be turned on/off when needed but I feel this should be mentioned at sign-up so people can understand and plan what they are going to need.

- Their knowledgebase has so far failed me as the issues I have had (mostly due to being a noob) are not listed on it and there are no other way other than submitting a ticket to find out about the small easy to solve problems, but their support is fast so no biggy.

Overall its not been a bad start It has had some floors but I'm happy and things are running smoothly.

Like I said these are only first thoughts on the service and I will update at later dates to give a clear picture on their service.

View 14 Replies View Related

Website That Can Be Seen In A Part Of World But Not The Other

May 28, 2009

I have a website that can be seen in a part of the world but not on the other. How can I troubleshoot this issue. Is there a web utility that can help me figure out what is the problem?

View 1 Replies View Related

UltraHosting.com Your Thoughts And Reviews

Mar 10, 2008

What are your thoughts of Ultrahosting.com, I didn't find may reviews here on WHT.

I talked with the sales rep. and he said they host people such as: Mazda, Chrysler and Xerox.

Here's some info he gave on their server:

Quote:
Paresh: to provide some way of background...Ultrahosting is part of our parent company Momentum
Paresh: Momentum handles Managed Service Operations for Enterprise level customers
Paresh: Ultrahosting sits in the same data center as these clients

View 3 Replies View Related

Dotable Now Part Of UK2Group

Oct 1, 2008

One of the most reliable & dependable webhosts around: Aussie Bob's Dotable is now a part of the UK2Group.

Read announcement:
[url]

The new plans unfortunately resemble that of a typical overselling host.

View 14 Replies View Related

Thoughts On OctaGate Switch

Sep 29, 2007

Anyone ever heard of OctaGate Switch ? Any comments, reviews, feedback?

Any good alternatives to this product?

View 0 Replies View Related

Part-time Sysadmin

Jun 4, 2007

I am having trouble finding a good sysadmin for my needs. Has anyone else been in a similar situation? Does anyone have any advice on how to find somebody like this?

SITUATION:
I am having trouble finding a reliable RH sysadmin. I have a handful of clustered HA setups for customers (6+ servers & load-balancers) and a number of single-server dedicated hosting customers. I do a lot of the work myself. The additional sysadmin usually only has a small amount of actual worked hours per month, dependent on new installs. But, they need to be reliable, available, and familiar with the complexities of the setups.

From what I have seen, some sort of server management company wouldn't be able to be familiar with the setups well enough to not regularly make errors or modify setups correctly due to the amount of clients they have.

View 14 Replies View Related

Moving From Rackspace? Thoughts On New Providers...?

Apr 14, 2008

We run our site from a dedicated server at Rackspace and have done for 6 years now. Whilst i'm very happy with the level of service provided we're starting to consider small cost savings by moving to other providers.

We did select LiquidWeb and have attempts a couple of moves to the new server but so far without success (most recent being yesterday with 12 hours of frustration!). A lot of the problems seem to be down to cPanel/WHM being a lot more "locked down" than were were used to with Webmin (that runs on Rackspace servers) and being somewhat unfamiliar with cPanel/WHM.

We have asked advice from LiquidWeb support and whilst they seem to be reasonable in responding, i've yet to feel the "heroic" aspect although this might just be due to being spoilt at Rackspace for many years. Support responses tend to be quite "rushed" and do the minimum asked for rather than going that extra "mile" which was seemingly indicated during the sales cycle.

My question is this - do people have thoughts on potential other fully managed providers? Should we even be looking for a new provider?


Specs looking for:

- Fully Managed
- Dual Xeon Quad Core
- 2GB RAM
- 2 x 73GB SCSI RAID
- Some form of Remote Backup
- Linux

We're currently paying about $850 for the server at Rackspace which has the following specs:

- Single AMD Opteron 246 2.0 GHz
- 2GB RAM
- 2 x 73GB SCSI RAID
- Managed Backup
- RHEL4
- Webmin

View 14 Replies View Related

SolarVPS Issues Public Thoughts

Jun 18, 2008

I regret to bring this to a public forum but having seen that solarvps has a presence here I am hoping that a resolve to this issue can be found, and any public opinions are welcomed.

Having been a customer with solarvps since 2006 without any cause for concerns it does not make me happy with some recent issues I have had with them. So I have had a vps server hosted with them since 2006. Sometime in February when attempting to login to my VPS I got an error, I left it as this happens sometimes, it happened for 4 days in a row so I thought this is a little strange logged in to my control panel, to see no VPS server was listed under the account. There was no invoice generated either. Ok this is strange but I just assumed it had been terminated, no invoice came through and that particular server was a backup server so I sought hosting elsewhere.

4 months pass I get an email from solarvps stating my account is overdue with charges applied. I contact them back straight away asking what they are billing me for I have explained the situation time and again to them, I have asked the questions why the server disappeared from my account, why I wasn’t able to access the vps remotely and why no invoices got generated at the time to which I have had no response, I have asked more than 5 times now. The only response I keep getting form them is threats if I do not pay to hand over to a collection agency and the possibility of legal action. To which I have replied each time that I will contest any such action and seek legal advice myself.

Granted I should probably have contacted them at the time but really they are at fault more than I am for not asking them what has happened, I truly believe I am not in the wrong here but nobody within solarvps is prepared is looking at the facts of what has happened here.

Well anyway I hope bringing this to a public forum will bring a resolve and maybe some answers. I am getting no response from anybody within solarvps and would be happy to take this away from the public if they are willing.

I am not unfair nor does it make sense that a customer for so long would just decide not to pay you one month and kick up a fuss over such a small amount of money but the fact that I am not in the wrong with this matter, I am not prepared to pay them no matter how much bullying tactics they wish to adopt in trying to make me.

View 14 Replies View Related

Thoughts About Fdcservers.net Colocation Or Dedi?

Apr 29, 2009

I used to have FDC a while ago, and i want to get your thoughts about fdcservers.net Colocation or dedi?

View 2 Replies View Related

Should /home Be Its Own Partition When Using R1soft, Or Can It Be Part Of /

Aug 7, 2008

Should/home be its own partition when using r1soft, or can it be part of/?

View 7 Replies View Related

A Server Part Of A DNS Cluster Is Not Synchronizing

Jun 16, 2008

I have a small dns cluster with 4 servers, the problem is that when i want to update a dns registry one of them doesnt sync, i have to try like 6 or 8 times to get that server to sync with all the others, and im concern because the one who gets trouble to sync is my secondary dns server

View 2 Replies View Related

ResellerZoom & Servint Reviews - My Thoughts

Sep 11, 2008

I had them for about 6 months and it was great until some time in the middle of May I got an email from them saying "my website is overloading/overlimits and even small dedicated sever wont handle the load" I had "Failover Reseller Plans" which allows 10,000MB space & 200GB bandwidth. The only script my website had at the time was a phpBB forum. My forum got about 2-3 posts per day with an average of 300 users per day. How could it cause overloading/overlimits ? Their "abuse team" wasn't very helpful at all! I got fed up with it and moved my site to a new webhost => servint

However, their support team was amazing. They replied to my tickets very fast. They were always online even at 3 or 4 am !! And most of the time they were very helpful and wouldhelp you with anything.

Would I go back to them again? i'm not sure ...maybe or maybe not

Servint
So I moved everything to Servint VPS after this whole incident. I really have no word to say about Servint except that they're AWESOME! I really like them & their support team. I had them for about 4 months and no complaints about them. However due to my financial prob (spend all my $ on gas & rising cost of everything) I had to downgrade to a reseller account instead

Now I'm moving to Hostgator.

I'll give you all my reviews in a few months...

View 9 Replies View Related

Is Bandwidth The Expensive Part Of Video Sites

Mar 3, 2009

Is bandwidth going to be my most expensive cost if I open up a video hosting site? Is there a inexpensive alternative? Is there an inexpensive web host with low cost bandwidth allocation?

View 9 Replies View Related

Apache: Need Thoughts On Offloading Static Content

May 18, 2009

I'm looking for a way to get a little more mileage out of Apache + PHP environment without losing Apache capabilities. In shared hosting environments, losing features such as .htaccess and a real mod_rewrite are not even on the table. I'm also not willing to accept the performance hit and connection issues that are inherent with FastCGI, so that means mod_php.

In this particular situation, there are two busy sites, which are the problem.

These are a few ideas I've been thinking about.

1. mod_proxy + nginx: mod_proxy sends static content requests to nginx. This requires two sets of vhost files to be maintained.

2. mod_cache: Caching common static content such as page graphics .css, .js, etc.

3. squid

If you've been down 2 or more of these roads, I could benefit from your experience.

View 10 Replies View Related

How To Prevent Spoofing From Postfix/local Part

Apr 29, 2009

I have similar problem that explained [url]

The detail of my problem is below:

Some people sent spoofing mails from our mail users sent to our user from Postfix/local that is listed in maillog like below:

Apr 29 16:57:02 ns1 postfix/local[3075]: EC2153565E3: to=<user-mydomain.com@ns1.mydns.com>, orig_to=<user@mydomain.com>, relay=local, delay=486, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)

Bu i do not know how to prevent this people not to use my Postfix/local delivery part. How can i prevent this attack?

When i connect to my mail server to sent or receive my mail it look like
Apr 29 17:25:28 ns1 dovecot: pop3-login: Login: user=<user@mydomain.com>, method=PLAIN, rip=***.***.***.***, lip=***.***.***.***
....
Apr 29 17:25:55 ns1 dovecot: POP3(user@mydomain.com): Disconnected: Logged out top=0/0, retr=0/0, del=0/0, size=0....

But the attackers connect directly like below:

Apr 29 17:29:59 ns1 postfix/local[2456]: 3192E357FD9: to=<user-mydomain.com@ns1.mydns.com>, orig_to=<user@mydomain.com>, relay=local, delay=261, status=sent (delivered to command: /usr/bin/procmail-wrapper -o -a $DOMAIN -d $LOGNAME)
....
Apr 29 17:29:59 ns1 postfix/qmgr[2218]: 3192E357FD9: removed

How can the spammer connect to Postfix/local part? My mail server not open relay. i test it from internet.

View 2 Replies View Related

VolumeDrive Review Part 1 - Good Start

May 6, 2009

A few people have asked me to give feedback on my experience with VolumeDrive so I decided I will be posting a 3 part review on them:

Part 1 - initial impressions
Part 2 - three month review
Part 3 - one year review (hopefully)

-------------
When I first got in contact with VD, contact was slow: about an email a day. It was very annoying to say the least. However when VD realized that I was genuinely interested in purchasing a server, and not just a window shopper, contact was more frequent and acceptable.

After looking around and comparing, I ended up ordering the following server from VD for a whopping $105 per month:

Q6600
4 GB DDR2 800 RAM
500 GB HDD
10 Mbps dedicated unmetered
5 IP addresses
Plesk 30 domain
Full managed services

Well just at face value, I don't think anyone will argue with me when I say you cannot beat the price. Where else will you find that kind of server w/ full management for $105 a month?

In the ordering process there were a few forgivable annoyances:
1) VD does not have any sort of automated, order online system for their "good" deals. I had to order via email and manually pay from PayPal. I was, however, emailed an invoice confirming my purchase after I paid.

2) It took VD 2 hours to send me my order request after I said "I am ready to purchase". Now it was late at night, so they probably only had a skeleton staff on hand, so this is understandable; however this point is sort of related to the lack of an automated system point mentioned above.

So after I paid and all, I was told they were building me a new server and it would take 3 business days to arrive. I was bummed out upon hearing this but this was understandable and justifiable - if they don't have the parts on hand, they don't have the parts, no big deal. I did appreciate the fact that they were honest with me upfront instead of trying to con me into giving me a different server (like I have been hearing stories about with other hosts).

So I waited. I was told my server would be setup on Tuesday afternoon and it was. The actual time between order and setup was about 5 and a half days: 3 days for the parts to arrive + Saturday + Sunday + time to build the server.

On Tuesday I was informed that my server has a Q8200 instead of a Q6600. To me this was not a big deal so I didn't object but if you are going to order from VD and you want one specific CPU I would be very clear with them that you won't accept any alternative. What did make me chuckle, however, is the fact that I was told "I received a free upgrade" to Q8200. It made me chuckle because I don't consider it a "free upgrade" when I was offered a choice between the Q6600 and a Q8200 for the same price during the ordering process. However, as I already said, a Q6600 or Q8200 - it does not matter to me: both are very similar in performance anyway.

So since I got my server I have been busy setting it up so VD can secure it after I am finished migrating my website (which by the way they just did - I just got an email ).

During that time I have emailed VD a fair amount of times, sometimes asking for clarification and sometimes asking for assistance with a problem, and they have responded back in a more than acceptable time frame and manner.

The only one major problem I have had so far is that initially, and by initially I mean first ~12 hours, it seems the connection to my server was not all the best. Randomly pages would take a while to load; I was curious as to why this was happening so I did some pinging and saw packets were being lost sometimes. This problem seems to have been auto-corrected itself now and I am did email VD about it; hopefully if it happens again we can get it perma-fixed.

Final verdict: people say "you get what you pay for". I say "I got more than I paid for". Hope it continues this way.

View 14 Replies View Related

Crissic - Inexperienced And Careless Web Host: Part II

Nov 3, 2008

Today I'm back to encourage you to stay away from Crissic: I know the prices are tempting, but know that you will have no one on your side when a problem comes up. I finally closed my account with them after numerous major issues with my VPS.

I've had a simultaneous account with Slicehost for the past few months, just to see if paying the extra buck is worth while. Now I know it absolutely is. I'm paying double the price for half the resources with Slicehost, but their service is amazing and reliable, their support is stellar, and peace of mind that the server will stay up and running without load issues, memory or drive failures is worth every penny. The point of this post is not Slicehost though, back to Crissic.

When I signed up for Crissic, I knew that it was a relatively new web hosting startup, but I had no idea it was a one-man show. Yes it's probably possible for a single guy to run a small web hosting company--the problem, particularly in the case of Skylar, is that when something is beyond him, it isn't getting fixed.

A recent support incident occurred where I was suddenly unable to access my VPS via SSH or the console. I contacted support, here are some of his responses to my status inquiries: ....

View 8 Replies View Related

Offering Hosting As Part Of A Web Design Contract

Dec 24, 2007

Are there any web designers/developers who offer hosting to their clients as part of their website creation package. I am toying with the idea of only creating websites for people who host with me. I currently have a colo server, but only use it for personal things. So I have no experience with the needs and demands of clients in regards to hosting. What are some of your experiences with hosting for clients? Is it worth it?

View 15 Replies View Related

Extract Part Rars Using Unrar On Centos4?

Sep 27, 2007

Is it possible to extract part rars using unrar (or other programs) on centos4?

If so, how and what command to use?

View 0 Replies View Related

A Lot Of Hacking

May 7, 2009

today i have a lot of hacking on my server .

i searched for shell scripts on the server , and i found alot of it :

[root@host svt]# ls -l
total 48
-rw-r--r-- 1 koky koky 6700 May 7 08:14 s.php
lrwxrwxrwx 1 koky koky 48 May 7 08:07 s1 -> /home/user1/public_html/vb/includes/config.php
lrwxrwxrwx 1 koky koky 47 May 7 08:12 s2 -> /home/user2/public_html/vb/includes/config.php
lrwxrwxrwx 1 koky koky 48 May 7 08:19 s3 -> /home/user3/public_html/vb/includes/config.php
lrwxrwxrwx 1 koky koky 47 May 7 08:37 s5 -> /home/user4/public_html/vb/includes/config.php
lrwxrwxrwx 1 koky koky 49 May 7 08:49 s6 -> /home/user5/public_html/vb/includes/config.php
-rw-r--r-- 1 koky koky 13199 May 7 07:59 ss.php
-rwxr-xr-x 1 koky koky 23005 May 7 07:58 svt.svt

as u can see he uploaded the files on this account "koky" and redirected this files to user1,user2,user3,user4 and user5 accounts .

and he could read the config.php and then hacked the site easly !!

i read befor that the reason of this is Perl on the server , and the way to solve it to edit httpd.conf by adding this in it :

<Directory "/home">
Options -ExecCGI -FollowSymLinks
AllowOverride AuthConfig Indexes Limit FileInfo Options=IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
</Directory>

and then restart the http :
service httpd restart

i did all of that , and when i restarted http it said :
[root@host www]# service httpd restart
Syntax error on line 51 of /usr/local/apache/conf/httpd.conf:
Invalid command 'Options=IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch', perhaps misspelled or defined by a module not included in the server configuration

and all the sites got down !

i deleted :
<Directory "/home">
Options -ExecCGI -FollowSymLinks
AllowOverride AuthConfig Indexes Limit FileInfo Options=IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
</Directory>

from httpd.conf and then sites worked correctly .

so you all know my problem now ! and i think alot of you have the same problem , so i wish we all try to find any solution for this and knows the best way to protect pel on the server .

View 5 Replies View Related

Stop Hacking

Feb 6, 2009

a site i manage for a client is being hacked every couple of days, its not the actual site but the hosts server thats getting attacked, all sites on that server, well actually all thier servers.

They have made no attempt to sort this problem, i report it they look at the site and say "site loads fine for us" which it does.

All index files are having a base64 encode line written after the <body> tag, this adds hundreds of spam links which are hidden with display:none; they also add .html to application types in htaccess for php to run in these files too.

Problem is, i am moving the site to another host but cannot change the nameservers to the new host's untill the client returns from a holiday, so i must keep the site up on the insecure host for now.

I am removing the spam code almost daily, is there anyway i can stop this attack happening for the time being, the host does nothing.

View 14 Replies View Related

Hypervm Hacking

Jun 8, 2009

As well all know there has been a hypervm exploit which may have taken down fsckvps and other hosts have been having attacks. If possible install any program that will warn you of a connection to your server and or provide input on what it may or may not be.

I myself Just had a blank php format file uploaded to a clients vps and It tried accessing other vps servers. As far as I know the ip was rapidly changing and untraceable (this may or may not be from the exploit), If anyone else is having hypervm attacks or server attacks please post here so instead of working within our own company's we are working as a group of over 10 thousand+ wht members to solve this issue ourselves.

(mods may move this wherever)

View 14 Replies View Related

Server Hacking...

Jan 15, 2008

i have a server and these days my server is hacking by the hacker the problem is, chmod 777, there are many dir's with the chmod 777 and hacker is uploading files and creating folders under the folder which is created with chmod 777, now i just want to know how i can block the hacker, and is there any way to allow the scripts which in my server and not allow any other scripts to upload files in my server

i have linux server

View 14 Replies View Related

Is This A Hacking Attempt

Feb 22, 2007

my referals logs that I keep on a website, I have come accross the following this morning, Is this some one who is trying to gain access to the server etc.

[url]
[url]
[url]
[url]
[url]

I have the Ip addresses that they have come from and it resolves to a Russian (I Think) website.

Im just looking through all the folders on the server now and no data has been comprimised as far as I can see and im going to use the query strings in order to block access and also deny access via ip address.

View 1 Replies View Related

MYSQL Hacking

Jun 27, 2007

alot of Databases in my server was hacked

Hacker can edit tables

Are there any any ports in MYSQL4?

View 14 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved