New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Aye, can you tell me the next host you move to? That way I can avoid that host lol
same vibe
I have two VPS servers: one is working fine, and the other is unreachable.
The last time, I had a look at virtualizor.
Permission levels where non existent
Why would someone, in their right mind, use one big fat virtualzor instance.
There is database dump in the wild. The smokah has the screenshot. The damn passwords was raw!
@HostSlick better get ready for Virtfuuuuuuuuuuuuuuuuuuuuuuusion
Translation: The control panel we use had really big security holes but we're trying to downplay the breach as much as possible to save face.
What version of Virtualizor? Was this a Virtualizor exploit or someone just gaining root to the Virtualizor master panel server and dumping the DB?
Real bad day!
$7/y refugee plan when?
Lucky me just put my cofffe cup down before I pressed, lmao
I love Virtfusion as end-user. Quite convienience.
I didn't get the email
@Xrmaddness said:
This suggests that either ColoCrossing don't realise how badly they've been breached, or they know how bad it is and they're lying about the impact.
Neither is a good look... 😬
"Panel is disabled". So, they know that they are screwed. Sugar coating and blatant lie is tactic to avoid litigation from big customers.
Guess we need a shaming list who use Virtualizor 😆
@yoursunny
At CrankBis we have only been hacked 8 times and each time we bribed the hackers with one (1) feet picture (unblurred).
Your data's safety is our priority.
Let Us Crank Your Bis Today™
No other man for this position better than my man @yoursunny
add nigalee feedback to the site: "my data is safe"
That's some professional service. We value commitment for data safety and alignment with (G)DPRK regulations.
Please send the 1 (one) feet picture (unblurred) to me for verification purposes.
If that turns out to be true, I'll update your review on our summer hosting guide.
Best lifeguards,
guards.re&sisters
We might need to add this incident to this blog post as well.
What to Learn From History’s Biggest Data Breaches ?
https://www.colocrossing.com/blog/what-to-learn-from-historys-biggest-data-breaches/
They are USA corp, which has no legal body in Europe. They do not care for GDPR.
Reguarded reguards.
They have EU customers so the GDPR applies to them whether they like it or not. They also have an EU location so there's potential for immediate enforcement action if an affected European customer makes a complaint to their local data protection authority.
shocking
VirtFusion rn:
Such a list would be very hard to make, because it would mean having services with all providers around here.
So far I've got:
Until it gets targeted and cracked
To keep on point, virtualizor is India based company. This alone is insane red flag. Their software:
And their mission:
"Our Mission is, " To help users choose the best web software through ratings, reviews and user experiences given by users around the world and installing web software with great ease."
Here is nice about page with AI generated crap (?). https://www.softaculous.com/about/
Hey!
Thank You for the mention. We disable temporarily Virtualizor panel to confirm couple of things with the support. We received such information "
If the server API key and password are leaked, a person can use the SSO link to access the server. This is not a vulnerability in Virtualizor—it is a human error, not a flaw in the software. The issue is not from Virtualizor's end.".However, we're not fully trusting it. Today, I scheduled a meeting with our team to start planning&developing own solution what will fully replace WHMCS and Virtualizor in the future. We also rerolled api keys, passwords and tokens for the virtualizor API&admin access. Every administrator has 2FA enforced and there is IP ACL for both Admin&API access. We're also pruning the tasks table.
I interesting are security hole in Virtualizor caused by an internal bug or this is a result of a wrong system setup. In the first case, it should be read as an alert to all providers who use Virtualizor, as the number of affected providers is large enough.