Comments

• JasonM Member

  September 2022

  i'm getting following chrome error when visiting vsys.host

  This site can’t be reached
• sandoz Veteran

  September 2022

  @JasonM said:
  i'm getting following chrome error when visiting vsys.host

  This site can’t be reached

  Working here. I tested right now. Maybe DNS issues?
• gzz Member

  September 2022

  Also got this email.
• HostSlick 🚩 Host Rep Tag Suspended

  September 2022 edited September 2022

  Not much Info.

  Is there any current WHMCS vuln?
• inland Member

  September 2022

  

  Thanked by 1BingoBongo
• sandoz Veteran

  September 2022

  @HostSlick said:
  Not much Info.

  Is there any current WHMCS vuln?

  I see many WHMCS being hacked in past months... and cPanel.

  @inland said:
  

  Anyone have any other screenshot of the "hacking" logos?
• ralf Member

  September 2022 edited September 2022

  Putting aside everything else, the message implies that all the authentication is done in the forward proxy and no authentication is done by the back-end. That seems a somewhat strange design choice.

  Either that or they'd hacked it and were logging authentication tokens long enough to get an one with high-level access that they could use going forward.
• Chex2 Member

  September 2022

  @ralf said:
  Putting aside everything else, the message implies that all the authentication is done in the forward proxy and no authentication is done by the back-end. That seems a somewhat strange design choice.

  Either that or they'd hacked it and were logging authentication tokens long enough to get an one with high-level access that they could use going forward.

  It seems they got access to the VM running the reverse proxy (I don't know why he called it a forward proxy, it's a reverse proxy) and pilfered his admin session as I guess he's doing layer 7 proxying and therefore it was possible to see decrypted traffic.

  In the future he should look at only doing layer 4 proxying so that way it's just TLS traffic coming in and out. It's also a little disconcerting that his box got hacked because the provider was hacked so he should look into disk encryption and things like 2FA for SSH etc.
• vsys_host Member, Patron Provider

  September 2022

  @sandoz said:
  Hi,

  Today I received this email from vsys.host which is hosting many tv and movies websites in their network, is database compromised?

  The email I received today from VSYS.Host:
  

  I know some people who are running their websites in their machines. Well..

  Hello, @sandoz

  None of our customers personally informed us about the database was compromisation.

  And it is not the fact that hackers have found a gap before us The message was a precautionary measure - we couldn't avoid informing our customers about it.