HostDzire Hit by Ransomware Attack

DjIcE

@HostDZire whatever happened, happened, its in the past, can you atleast give us a time fremae that when the servers will be online again, or tabout the raplacemnet we might recive> any time frame? how long, its a money problem now, as we earn from our servers, without them 0$, so when will we recive a replacement? becase whenever when we miss a invoice without a warning you always disable the server, now we need answers.

rpqu

@DjIcE said:
its money problem now, as we earn from our servers, without them 0$, so when will we recive a replacement?

Spin an hourly server

SadaoMaou

@tranit said:
Feeling bad now I don't think I can continue to trust after this..

I agree tbh

AlteredParadox

Lololol. The amount of people who don’t bother to read the tos, sign up for a cheap thing that explicitly has no backups, then pull the “I can’t trust you anymore I’m losing MILLIONS” card, but yet learn nothing from the experience and move to another cheap provider only to rinse and repeat… is just a never ending source of entertainment when it comes to LET

SadaoMaou

@AlteredParadox said:
Lololol. The amount of people who don’t bother to read the tos, sign up for a cheap thing that explicitly has no backups, then pull the “I can’t trust you anymore I’m losing MILLIONS” card, but yet learn nothing from the experience and move to another cheap provider only to rinse and repeat… is just a never ending source of entertainment when it comes to LET

Lmao nobody is losing millions here dude but the provider did not even bothered to communicate unless we look in their panel or this Thread.

zed

i don't think it's unreasonable for people to ask about an eta, but it's also perfectly reasonable for @HostDZire to not be able to give one yet, shit just happened give them a minute.

sliix

I have already lost millions /s.

diwakerd

I narrowly escaped this disaster Just four days ago I migrated one of my client's apps to an OVH dedicated server because the vps server was running out of disk space

rad964

@AlteredParadox said:
Lololol. The amount of people who don’t bother to read the tos, sign up for a cheap thing that explicitly has no backups, then pull the “I can’t trust you anymore I’m losing MILLIONS” card, but yet learn nothing from the experience and move to another cheap provider only to rinse and repeat… is just a never ending source of entertainment when it comes to LET

I'm just sad that I decided to not setup database backup. I have project files in S3, and I have project code and reproducible deployment. I just don't have database that have links to files anymore.
A month worth of data is gone for a pet project.
Life lesson I guess.

rpqu

@rad964 said:

@AlteredParadox said:
Lololol. The amount of people who don’t bother to read the tos, sign up for a cheap thing that explicitly has no backups, then pull the “I can’t trust you anymore I’m losing MILLIONS” card, but yet learn nothing from the experience and move to another cheap provider only to rinse and repeat… is just a never ending source of entertainment when it comes to LET

I'm just sad that I decided to not setup database backup. I have project files in S3, and I have project code and reproducible deployment. I just don't have database that have links to files anymore.
A month worth of data is gone for a pet project.
Life lesson I guess.

AI could help

alincupunct

@AlteredParadox said:
Lololol. The amount of people who don’t bother to read the tos, sign up for a cheap thing that explicitly has no backups, then pull the “I can’t trust you anymore I’m losing MILLIONS” card, but yet learn nothing from the experience and move to another cheap provider only to rinse and repeat… is just a never ending source of entertainment when it comes to LET

You might legit have empty space where your brain should be if you host anything with a provider that gets ransomware'd.

vpsTQ

Can I get a refund? I no longer have any trust.

OpaqueRegistrant

@HostDZire said:

@Arirang said:
Might as well configure the disks in RAID in AMS if it has been affected while you’re rebuilding the hypervisor.

RAID has nothing to do with this incident. Around 80% of our affected nodes, including all VMware nodes in India, were already running on RAID. RAID protects against physical disk failures, it does not protect against ransomware or data encryption.

The only effective protection in a situation like this would have been independent backups. If we had full VM backups, even on a weekly schedule, we could have restored those backups and significantly reduced the impact of this incident.

I think they are saying that since you can't add RAID to an existing storage system with data already on it, now that you have deleted all of your customer data it is a good opportunity to start using RAID.

OpaqueRegistrant

@samsaie said:

>

Was the data merely encrypted, or has it already been taken by hackers? I need to assess whether my backup data is also no longer secure.

Most modern ransomware both encrypts and steals data. We should assume that everything stored on an affected VPS has been stolen, and Wil be released onto the dark web when HostDZire doesn't pay the ransom. Everyone should remember to change their SSH and Wireguard keys. If your server had anything to do with cryptocurrency then red alert on that - move it to a new wallet immediately. And so on.

default

@SadaoMaou said:

@tranit said:
Feeling bad now I don't think I can continue to trust after this..

I agree tbh

I hope you guys do realise you're speaking of trust in an age of artificial intelligence. Nothing can be trusted in our age. What large groups of people were testing in years, now is tested in days with speed.

Backup your data, so if you lose it to AI you can at least blame yourselves! Don't blame the providers for not being always up to date with daily security news. You're not paying here for that kind of corporate service and security; you are on the low-end side of things.

DjIcE

Come one we just need a time frame, wehen will be replacement ready,its almost 24 hours, just give us the replacement,

Servyn

I don't think data loss is a big deal, but a data leak would be a fatal problem.

Servyn

Hopefully, it's just an encrypted hard drive issue, and not a data breach.

JohnFilch123

@Servyn said:
I don't think data loss is a big deal, but a data leak would be a fatal problem.

What did you store on that server?

default

@JohnFilch123 said:

@Servyn said:
I don't think data loss is a big deal, but a data leak would be a fatal problem.

What did you store on that server?

Linux ISOs. If someone compromises those, it will be really bad for any other user who downloaded those files.

host_c

@amarc said:
Interesting business decision: VMware but no backups. Doesn't VMware have full set of products designed around main product for centralized storage, DR, backups.. and only proper way of using VMware is to use full set of products ?

If you want my advice (which you should not): ZFS that shit. Even Proxmox is possible solution. ZFS with 7-days offsite snapshots would at least save VM data. Do it "pull", not "push" way also. That way when someone get's in your server they do not even know about backup server existence.

vMware has...........mostly veeam, last time we got a quote from them was ~2 years back with a 1000 USD for each server ( 2 sockets ), so at cheap services I doubt anyone would offer a free backup, hence why a large part of the industry is on Proxmox or other similar.

Regarding ZFS and snapshots, I will say pass, snapshots are not backup, they never were nor one should use them for that, it might look good on paper, but it is really not.

@xHosts said:

@amarc said:
Interesting business decision: VMware but no backups. Doesn't VMware have full set of products designed around main product for centralized storage, DR, backups.. and only proper way of using VMware is to use full set of products ?

If you want my advice (which you should not): ZFS that shit. Even Proxmox is possible solution. ZFS with 7-days offsite snapshots would at least save VM data. Do it "pull", not "push" way also. That way when someone get's in your server they do not even know about backup server existence.

Most of it comes down to cost, not application features.

A customer cannot buy a low value plan but expect all premium features to be included.

If you require certain guarantees, you need to pay for that at the end of the day.

Precisely, well said +1

@HostDZire

I am sorry to hear that this happened to a fella Operator. I can imagine how difficult the situation must be. If there’s anything we can do to help, please don’t hesitate to ping me.

fredo1664

@host_c said:

vMware has...........mostly veeam, last time we got a quote from them was ~2 years back with a 1000 USD for each server ( 2 sockets ), so at cheap services I doubt anyone would offer a free backup, hence why a large part of the industry is on Proxmox or other similar.

Out of curiosity I checked how expensive vmware can be and it looks very expensive indeed. Is it even profitable for a LET-friendly budget host to use vmware to sell VPS unless it's the free edition?

default

@fredo1664 said:

@host_c said:

vMware has...........mostly veeam, last time we got a quote from them was ~2 years back with a 1000 USD for each server ( 2 sockets ), so at cheap services I doubt anyone would offer a free backup, hence why a large part of the industry is on Proxmox or other similar.

Out of curiosity I checked how expensive vmware can be and it looks very expensive indeed. Is it even profitable for a LET-friendly budget host to use vmware to sell VPS unless it's the free edition?

If @HostDZire rebuilds it all, they might as well rethink it and switch to KVM or something else. Once upon a time LET was using even OpenVZ.

drivex

I‘m asking myself, if the VMware ESXi panels have been reachable over the internet? I really hope not…

JohnFilch123

@default said:

@JohnFilch123 said:

@Servyn said:
I don't think data loss is a big deal, but a data leak would be a fatal problem.

What did you store on that server?

Linux ISOs. If someone compromises those, it will be really bad for any other user who downloaded those files.

Ya not good. Well, if you download ISOs, you are responsible for checking them.

manish

@itachikonoha said: Mine is down.

Sucks.

@FairShare said: more than an year of blogging down in the drain ...fuk ..

Ah! very sad. Did you do tech blogging?

Andreix

Why do I have a feeling someone just ran a "getlic.sh" for cpanel license and got himself a host privilege escalation thingy?!

Just a feeling... we, old men, have weird feelings depending on the weather sometimes.