WHMCS Hacked

MrAndroid · May 2012

@gsrdgrdghd said: Whats PCI?

Basically, a set of rules WHMCS must comply with for big companies and governments to use it.

MrDOS · May 2012

@Daniel said: Basically, a set of rules WHMCS must comply with for big companies and governments to use it.

No. A set of rules anyone in the US must comply with to handle direct credit cards payments (as in, payments not through a payment service such as PayPal). Fines for noncompliance can be in order of hundreds of thousands of dollars per day of noncompliant operation.

AsadHaider · May 2012

@ElliotJ said: Hexonet.de - £29, although you have to pre-pay your account in USD (Confusing)

Sweet, that is cheap. Just signed up to the site, do you mean CAD? Signed up to the Canadian one.

gsrdgrdghd · May 2012

@MrDOS said: Fines for noncompliance can be in order of hundreds of thousands of dollars per day of noncompliant operation.

Well since WHMCS is an UK and not an US company that shouldn't be any problem. However it was just plain stupid of them to store all CC details in "plaintext"

Francisco · May 2012

So wait, isn't WHMCS the guys that would rage on you if you wanted to store your CC's within your own DB because it violated xyz laws or you needed heavy PCI compliance?

Francisco

rds100 · May 2012

AFAIK it (PCI compliance) is not an US thing. It is Visa/Mastercard requirement. They are the ones who fine you.

Spencer · May 2012

@MrDOS said: No. A set of rules anyone in the US must comply with to handle direct credit cards payments (as in, payments not through a payment service such as PayPal).

Exactly. That is why I don't run credit cards through my WHMCS and only do them through a 3rd party like WHMCS or 2co.

MrAndroid · May 2012

@MrDOS said: No. A set of rules anyone in the US must comply with to handle direct credit cards payments (as in, payments not through a payment service such as PayPal). Fines for noncompliance can be in order of hundreds of thousands of dollars per day of noncompliant operation.

I stand corrected, I thought wrong.

subigo · May 2012

@rds100 said: AFAIK it (PCI complieance) is not an US thing. It is Visa/Mastercard requirement. They are the ones who fine you.

Correct.

MrDOS · May 2012

@rds100 said: AFAIK it (PCI complieance) is not an US thing. It is Visa/Mastercard requirement.

My bad, then. I knew it was controlled by a conglomerate of credit card companies, but I thought they kept it within US borders.

Insidiea · May 2012

@Daniel said: I wouldn't think so, as long as you don't do anything malicious or redistribute the data.

Anyone else wants to add to this/confirm?

gsrdgrdghd · May 2012

@Insidiea said: Anyone else wants to add to this/confirm?

Well this depends very much on your country's legislation. However even if its illegal to download/view it i don't think anybody who doesn't abuse the data would get in trouble for it.

MrAndroid · May 2012

@Insidiea said: Anyone else wants to add to this/confirm?

Well, I don't think it would hurt just to check what data of yours in there. Thats the reason I downloaded it.

gsrdgrdghd · May 2012

@Jack said: Dear Ken Nash (UptimeVPS),

This is a confirmation email that you have registered with WHMCS. Your new account has been setup and you can now login to our client area using the details below.

So did anyone actually try to login?

Daosmb · May 2012

@Daniel said: Well, I don't think it would hurt just to check what data of yours in there. Thats the reason I downloaded it.

I'm a client, do I need to jump in and "check" things? Or is it "just fine"? :)

Legendlink · May 2012

I have a quick question, I quickly skimmed through the 9 pages of this topic and didn't see an answer, I had a WHMCS license through LicensePal, canceled it quite awhile ago. So since I paid at LicensePal, WHMCS doesn't have my credit card details, right?

gsrdgrdghd · May 2012

@Daosmb said: I'm a client, do I need to jump in and "check" things? Or is it "just fine"? :)

If you tell me what to look for i can check it for you

AsadHaider · May 2012

@Legendlink said: So since I paid at LicensePal, WHMCS doesn't have my credit card details, right?

Correct. You're credit card is safe.

Alex_LiquidHost · May 2012

@AsadHaider said: Correct. You're credit card is save.

... untill they get social engineered through their hosting provider....

MrAndroid · May 2012

@AsadHaider said: Correct. You're credit card is save.

I think your meaning safe, if LicensePal was giving out CC info to WHMCS that would be worrying.

DimeCadmium · May 2012

@BlueVM said: Unfortunately you can't use stolen information in an investigation.

Who says it's stolen? It may well be "public" found somewhere, which they CAN use in an investigation.

Spencer · May 2012

When will WHMCS get control of their twitter again ;(

Jeffrey · May 2012

So, who's willing to hack ugnazi? :P

Spencer · May 2012

@Jeffrey said: So, who's willing to hack ugnazi? :P

That would be stooping to their level :p

Aldryic · May 2012

@PytoHost said: That would be stooping to their level :p

Not like pulling the leaked database to look up financial figures and personal information on other people, right? -_-;

Spencer · May 2012

@Aldryic said: Not like pulling the leaked database to look up financial figures and personal information on other people, right? -_-;

Hahaha good point

subigo · May 2012

A new WHMCS exploit scanner is being passed around IRC now. It checks for exploits on every single IP listed as active in the database. It's not that bad now (unless you never update WHMCS), but this is going to make future exploits a bad thing. It's not like most people are going to change their server IP just to protect themselves.

Spencer · May 2012

@subigo said: A new WHMCS exploit scanner is being passed around IRC now. It checks for exploits on every single IP listed as active in the database. It's not that bad now (unless you never update WHMCS), but this is going to make future exploits a bad thing. It's not like most people are going to change their server IP just to protect themselves.

Phewww I just moved my WHMCS server today (unrelated to the hacking) Perfect day for this to happen!

TheHackBox · May 2012

@subigo said: A new WHMCS exploit scanner is being passed around IRC now.

What shady IRC networks are you on?

Jack · May 2012

@TheHackBox said: What shady IRC networks are you on?

. #lowendbox on irc.freenode.net

Howdy, Stranger!

Categories

WHMCS Hacked

Comments