Hetzner been Hacked !!

Plaasjapie

Well-Known Member
Joined
Mar 17, 2005
Messages
230
I just received the email from Hetzner. Can somebody else confirm this?

Precautionary Alert: Network Intrusion

Dear Hetzner Customer,

We are writing to you as our primary concern is for our customers and for the continued security of your website(s) and data. It is therefore our duty to inform you of a network intrusion with possible implications for your web hosting package(s):



We have recently discovered evidence of a network intrusion to our managed web servers and hosting management systems.



The intruder may have harvested some of your hosting related passwords.



Following an investigation and assessment of the breach, we have taken steps to prevent further unauthorised access to our servers.



As a further precautionary measure we'd like to request that you act swiftly and change the following passwords:


-
Your konsoleH Control Panel login password


-
All email passwords


-
All FTP passwords


-
All MySQL database passwords (Note, you will need to update your web application database connection strings. This is not applicable to Home packages.)


These passwords can all be changed within your konsoleH Control Panel. Details on how to change your passwords can be found on our Help Centre using the links above.

We understand the inconvenience and concern that this may cause and for this we sincerely apologise. Be assured that we take our responsibilities for safeguarding your data very seriously and are taking the appropriate steps to enhance our security protocols to protect our systems and your data.
 

ksweb

Active Member
Joined
Sep 9, 2005
Messages
97
Just got the email now.
Does any one have more information on how, when this happened?
 

ColinR

Expert Member
Joined
Aug 24, 2006
Messages
3,753
I've changed all my passwords - took a fair amount of time. (Esp when SQL has 3 per DB!) But it's probably a good thing to do every now and again anyway!
 

baileysinplett

Active Member
Joined
Jan 28, 2007
Messages
32
Last week we received an email from MTN Business saying that our website had been marked as delivering malitious material and that it would be blocked if not corrected. Also found that Google had blocked all our hetzner sites on the Chrome and Firefox browsers. Found that all our index.html pages and all js files had addonrock.ru javascript tagged on the bottom. Read that it obtains ftp passwords through keyloggers on infected machines and gains access in this manner

Have 3 websites on Hetzner and was very concerned as all 3 were infected. Wondered how access to passwords were obtained as we had not personally gained access to the sites in months. Spent a day virus and trojan checking all machines in our network. Also only one machine has a full list of passwords to all 3 sites. Also strange was that websites at different hosts were not infected, but the passwords existed on the same machine. Read that the trojan had made use of a security issue within linux and so came to the conclusion that access must have come from Hetzner's side and not a vunerablity on our side. Confirmation arrived today

Check all you index.html and .js files. Look for javascript code referencing addonrock.ru (there are some other names as well - google addonrock)
 
Last edited:

shogun

Expert Member
Joined
Sep 9, 2005
Messages
2,246
Stupid question perhaps... but this is Hetzner SA, and not Germany right?
 

ksweb

Active Member
Joined
Sep 9, 2005
Messages
97
I've changed all my passwords - took a fair amount of time. (Esp when SQL has 3 per DB!) But it's probably a good thing to do every now and again anyway!

It going to take a lot of time trying to update everything :-(
 

keru

Well-Known Member
Joined
Aug 6, 2003
Messages
489
This is such a bummer. It is a nightmare to change all the passwords.
 

keru

Well-Known Member
Joined
Aug 6, 2003
Messages
489
you're right. passwords should never be changed and very easy to remember as well. what's the point of using it in any case.

Not fun when you are hosting +/- 100 domains with around 1000's of email accounts.
 

Jacques

Well-Known Member
Joined
May 12, 2004
Messages
313
Where can I send my Invoice for all the Unpaid work? Changing hundreds of passwords at once is not fun! :(

The news on here seems a bit slow on one of the biggest security compromises in web hosting? Probably changing passwords.... ;)
 

jbs01

Member
Joined
Dec 23, 2009
Messages
13
Has anyone else ever heard of such a thing happening with any other hosting company?
Hetzner is supposed to be world class.
FML.
 

keru

Well-Known Member
Joined
Aug 6, 2003
Messages
489
Would like to know if any accounts have been compromised as yet ?
 

keru

Well-Known Member
Joined
Aug 6, 2003
Messages
489
Does it matter? Best to change the passwords before you wakeup to a nightmare.

I have changed the passwords. Just wanted to know if any accounts have been hacked. I think there should be some serious discussions around this.
We had a few joomla sites hacked early this year. After doing a bit of research we narrowed it down to one theme that ended up with Joomla sites being hacked around the world.
 
Top