Active incident at Dreamhost forcing password reset
greenchair · 158 points · 62 comments · 22 jam yang lalu · Open original
Comments
5 preview comments · loading full thread
Log in to use comments
Log in to h4cker, then connect Hacker News to publish comments.
DUduskwuff17 jam yang lalu
Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated.
[1]: https://www.monstaftp.com/
JOjoshstrange1 jam yang lalu
I got the email about this and realized I’ve been using them for just shy of 20 years. It was one of the original places I hosted things and where I hosted projects for other people. I haven’t actively used it years but migrating the last few things off has never been a priority. This might be the push I need to re-evaluate everything hosted there and shut down or migrate it all.
PApaulbjensen16 jam yang lalu
Dreamhost - gosh that brings back memories…
LElexwhite9 jam yang lalu
This has been a real annoyance for me lately since I run a lot of my music production business out of my website lexwhite.net hosted on Dreamhost and Dreamhost VPS. I love and trust Dreamhost a lot, though, as they have been an exceptionally solid company that I have worked with for, dang, nearly 20 years now I think! All of this new AI stuff has been exposing vulnerabilites at a rate that is hard to keep up with for anyone. We just have to really harden our cybersecurity as much as possible now.
XMxmddmx9 jam yang lalu
Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying...
"As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set."
But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted?
The same email suggests you change all email passwords you control.
Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email.
My complaints:
- sucks that it took them 48 hours to identify the breach - perhaps understandable
- but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible.
- confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety).
I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.
Comments
5 preview comments · loading full threadLog in to h4cker, then connect Hacker News to publish comments.
Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated. [1]: https://www.monstaftp.com/
I got the email about this and realized I’ve been using them for just shy of 20 years. It was one of the original places I hosted things and where I hosted projects for other people. I haven’t actively used it years but migrating the last few things off has never been a priority. This might be the push I need to re-evaluate everything hosted there and shut down or migrate it all.
Dreamhost - gosh that brings back memories…
This has been a real annoyance for me lately since I run a lot of my music production business out of my website lexwhite.net hosted on Dreamhost and Dreamhost VPS. I love and trust Dreamhost a lot, though, as they have been an exceptionally solid company that I have worked with for, dang, nearly 20 years now I think! All of this new AI stuff has been exposing vulnerabilites at a rate that is hard to keep up with for anyone. We just have to really harden our cybersecurity as much as possible now.
Super displeased with DreamHost's handling of this. I have multiple master accounts. One of them got the email around 12pm today (over 48 hours after the incident started) saying... "As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set." But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted? The same email suggests you change all email passwords you control. Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email. My complaints: - sucks that it took them 48 hours to identify the breach - perhaps understandable - but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible. - confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety). I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.