What happened to CloudCone? Was it hacked?

yoursunny · February 3

@sunkiss said:
it really ruins the mood.

Cloud Cone: bad vibes only!

host_c · February 3

@s0n1c said: My question is why would someone store critical data on a $7/year VPS with no backups, then pay $100 to recover it, when they could have paid $100 or less for a much more reputable provider, or simply kept backups in the first place???

alfatarsos · February 3

@yoursunny said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

… however, there’s a root shell in Virtualizor software that is protected merely by a password (not private keys or 2FA) and does not generate an audit trail.

And if that password is weak enough or reused anywhere else... boom.

That feature should probably be discontinued, Virtualizor is the only remaining VPS control panel where a terminal exists, afaik.

sunkiss · February 4

@sunkiss said:
Day 5: I have three DC2 VPS instances. One was barely usable after a system reinstallation, while the other two couldn't be reinstalled at all and remained offline. I tried reinstalling them multiple times, but there was no progress whatsoever. When all data is lost and even a simple OS reinstallation becomes such a painful process, it really ruins the mood.

Day 5.5: my 2 vps system reinstallation still not complete.

CloudCone system reinstallation process is one of the most terrible I've encountered among all the service providers I've used.

forest · February 4

@sunkiss said: CloudCone system reinstallation process is one of the most terrible I've encountered among all the service providers I've used.

Did you open a ticket? Most likely something is broken. I doubt this is the norm.

sunkiss · February 4

@forest said:

@sunkiss said: CloudCone system reinstallation process is one of the most terrible I've encountered among all the service providers I've used.

Did you open a ticket? Most likely something is broken. I doubt this is the norm.

I submitted support ticket asking for their help, see if they can process it manually to speed things up...but they told me to reinstall the system through the control panel, and then they quickly closed my ticket. Period.

virtualizor · February 4

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

starx · February 4

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

Nyr · February 4

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

CloudHopper · February 4

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Nyr · February 4

@CloudHopper said:

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Of course they were irresponsible. They should have rotated any credentials shared with a third party as soon as they are not required anymore, it is basic security hygiene. Independent of the also very irresponsible actions of their vendor, which nobody is disputing.

ascicode · February 4

Its their tool, they should do it better. In example, an automatic revoke of credentials after 24h. The admin could handle that, but the programmers not doing 100% security handling.

zed · February 4

I mean they both can be irresponsible.

rcy026 · February 4

@zed said:
I mean they both can be irresponsible.

Exactly what I was going to say.
If you have two parties and both do due diligence, stuff like this never happens.
If one party is irresponsible, stuff might happen eventually.
If both parties are irresponsible, shit will happen!

The providers should have rotated the credentials and Virtualizor should not have saved them. Two idiots, and inevitably shit happened.

CloudHopper · February 4

@Nyr said:

@CloudHopper said:

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Of course they were irresponsible. They should have rotated any credentials shared with a third party as soon as they are not required anymore, it is basic security hygiene. Independent of the also very irresponsible actions of their vendor, which nobody is disputing.

That's fair comment, but I don't believe Virtualizor identified a breach and proved that it led to follow-on hacks within the ~36 hours it took for them to shift from "nothing to see here" to emailing that statement anyway.

Given the complexity of the alleged hack they suffered, and the number of customers known to be affected, it doesn't seem plausible that they'd have a definitive answer that quickly...but it sure is a convenient way to shutdown the discussion! 🤷‍♀️

ralf · February 4

@CloudHopper said:

@Nyr said:

@CloudHopper said:

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Of course they were irresponsible. They should have rotated any credentials shared with a third party as soon as they are not required anymore, it is basic security hygiene. Independent of the also very irresponsible actions of their vendor, which nobody is disputing.

That's fair comment, but I don't believe Virtualizor identified a breach and proved that it led to follow-on hacks within the ~36 hours it took for them to shift from "nothing to see here" to emailing that statement anyway.

Given the complexity of the alleged hack they suffered, and the number of customers known to be affected, it doesn't seem plausible that they'd have a definitive answer that quickly...but it sure is a convenient way to shutdown the discussion! 🤷‍♀️

Yeah, think back to the Ouiheberg incident. They hadn't received any logs or access to the affected systems, but somehow declared it was definitively nothing to do with them within only a couple of hours.

xvps · February 4

@ralf said:

@CloudHopper said:

@Nyr said:

@CloudHopper said:

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Of course they were irresponsible. They should have rotated any credentials shared with a third party as soon as they are not required anymore, it is basic security hygiene. Independent of the also very irresponsible actions of their vendor, which nobody is disputing.

That's fair comment, but I don't believe Virtualizor identified a breach and proved that it led to follow-on hacks within the ~36 hours it took for them to shift from "nothing to see here" to emailing that statement anyway.

Given the complexity of the alleged hack they suffered, and the number of customers known to be affected, it doesn't seem plausible that they'd have a definitive answer that quickly...but it sure is a convenient way to shutdown the discussion! 🤷‍♀️

Yeah, think back to the Ouiheberg incident. They hadn't received any logs or access to the affected systems, but somehow declared it was definitively nothing to do with them within only a couple of hours.

Well, some of the providers that have been hacked have stopped using chat software like tawk.to, Zoho, etc. on their websites. Totally random, right.

And one of the times Virtualizor was hacked, it was due to a tawk.to security issue.

Why is nobody talking about that and instead just blaming the Virtualizor software?

And isn’t it natural for them to deny being hacked until there is evidence of a breach/vulnerability, when only one or a very limited number of their clients are affected?

Virtualizor has found a reason and has been open about it, but some people simply deny it blindly because it doesn’t fit their narrative. The same people seem to trust the hackers’ short chat messages more.

And why is the “security expert” who keeps insisting there is an unknown security issue in the Virtualizor software using a hacker group’s (campaign) name / method as a username?

rpqu · February 4

I hope we learn something from this. Sharing credentials, PIIs pose great danger, but it also highlight how PIIs should be handled too.
It would be great if it could be decoupled, so leaked credentials doesn't leak PIIs

CloudHopper · February 4

@xvps said:

@ralf said:

@CloudHopper said:

@Nyr said:

@CloudHopper said:

@Nyr said:

@starx said:

@virtualizor said:

@alfatarsos said:

@CloudHopper said:

@alfatarsos said:

Very much likely indeed...

And Virtualizor didn't issue yet a public statement on the matter. Which would be important. We're not talking about one provider now, we're talking about more.

We have posted this since yesterday :
https://www.virtualizor.com/blog/security-update-transparency-regarding-a-recent-support-ticket-incident/

@CloudHopper said:

@virtualizor said:

@alfatarsos said:
Well... with the script on the wild now, what prevents anyone of attempting to hack Virtualizor-based providers at this moment?

Honest question...

Please understand that there is no exploit in Virtualizor software. Its false information and there is no exploit.

@vitualizor can you clear up for us whether your support system was breached once or twice? And when did the last breach occur?

@Cloudcone can you confirm for us when you last rotated your passwords and whether you had IP whitelisting for your instance and 2FA enabled?

The above should clarify things.

So that's all your fault.

No it isn't?

If those are the facts, the affected providers were highly irresponsible, independent of the fact that Virtualizor got compromised.

Virtualizor requested passwords from their customers, retained them for a year and then [allegedly] lost them in a hack....but it's the providers who trusted them that were "highly irresponsible" 🤔

Of course they were irresponsible. They should have rotated any credentials shared with a third party as soon as they are not required anymore, it is basic security hygiene. Independent of the also very irresponsible actions of their vendor, which nobody is disputing.

That's fair comment, but I don't believe Virtualizor identified a breach and proved that it led to follow-on hacks within the ~36 hours it took for them to shift from "nothing to see here" to emailing that statement anyway.

Given the complexity of the alleged hack they suffered, and the number of customers known to be affected, it doesn't seem plausible that they'd have a definitive answer that quickly...but it sure is a convenient way to shutdown the discussion! 🤷‍♀️

Yeah, think back to the Ouiheberg incident. They hadn't received any logs or access to the affected systems, but somehow declared it was definitively nothing to do with them within only a couple of hours.

Well, some of the providers that have been hacked have stopped using chat software like tawk.to, Zoho, etc. on their websites. Totally random, right.

And one of the times Virtualizor was hacked, it was due to a tawk.to security issue.

Why is nobody talking about that and instead just blaming the Virtualizor software?

And isn’t it natural for them to deny being hacked until there is evidence of a breach/vulnerability, when only one or a very limited number of their clients are affected?

Virtualizor has found a reason and has been open about it, but some people simply deny it blindly because it doesn’t fit their narrative. The same people seem to trust the hackers’ short chat messages more.

And why is the “security expert” who keeps insisting there is an unknown security issue in the Virtualizor software using a hacker group’s (campaign) name / method as a username?

People are talking about Virtualizor as the source of this breach because they've admitted to being the root cause...which you say yourself further down your post...and people aren't talking about chat software getting hacked because it doesn't lead to a hypervisor breach and destroyed VMs.

I'm glad you recognised the source of the CloudHopper pseudonym though. Did you Google it in an attempt to doxx me or were you already familiar?

But as you ask, I used to have to keep up with various APT activities and that's one of my all time favourite campaigns because their approach was ruthlessly effective and they always got straight to the point.

This is an easy read on the subject if anyone else is interested 👇
https://www.reuters.com/investigates/special-report/china-cyber-cloudhopper/

sunkiss · February 4

Day6:2 VPS servers have been restored; one still remains unrestored.

DKAlexander · February 4

I have been communicating with customer service for a long time, and they have been closing my work order very perfunctorily, which is a very bad experience.

I can't rebuild the system, but you say you can. When I send them the mistakes, they continue to pretend to be dead and not talk! I really didn't expect cloudcone to be so bad.

DKAlexander · February 4

Task Progress Status
86461 VPSRestart
COMPLETE
86456 ChangingVPSPassword RUNNING
86455 FstrimHandle
PENDING
86454 ChangingDNSNameserver RUNNING
86452 EditVPSCallback
COMPLETE

And it just keeps getting stuck on this task.

forest · February 5

@xvps said: And why is the “security expert” who keeps insisting there is an unknown security issue in the Virtualizor software using a hacker group’s (campaign) name / method as a username?

Who?

duchenpaul · February 5

@lothos said:

@sr3 said:
I had my server and my backup on the same node because it was faster.

Both now gone.

Asked for the raw disks so I could try and buy my key. CC says no.

Great job

3 copies of your data, on 2 different types of media, with 1 copy offsite

sorry for your loss, not trying to pour salt here, but help with the future

Never trust any cheap VPS providers, > @DKAlexander said:

I have been communicating with customer service for a long time, and they have been closing my work order very perfunctorily, which is a very bad experience.

I can't rebuild the system, but you say you can. When I send them the mistakes, they continue to pretend to be dead and not talk! I really didn't expect cloudcone to be so bad.

Same here, they don't directly answer my question, instead they repeat your VPS needs reinstalling, you can reinstall your VPS now... as if this is the only text in their pasteboard

tonyhead · February 5

@sunkiss said:
Day6:2 VPS servers have been restored; one still remains unrestored.

Hello there, how to restore the VPS? Keep reinstalling from time to time or just waiting 4-6 hours after clieck the reinstall button? thanks.

sunkiss · February 5

@tonyhead said:

@sunkiss said:
Day6:2 VPS servers have been restored; one still remains unrestored.

Hello there, how to restore the VPS? Keep reinstalling from time to time or just waiting 4-6 hours after clieck the reinstall button? thanks.

There's no special method; you just reinstall it through the Control Panel.

Don't know what happened, they removed the Debian installation option.

interesting.

zed · February 5

@sunkiss said: they removed the Debian installation option

wow rude

forest · February 5

@sunkiss said: Don't know what happened, they removed the Debian installation option.

Templates suck anyway. Just go to https://debian.org, copy the URL for the netboot ISO from the homepage, and boot into that.

default · February 5

@sunkiss said:

@tonyhead said:

@sunkiss said:
Day6:2 VPS servers have been restored; one still remains unrestored.

Hello there, how to restore the VPS? Keep reinstalling from time to time or just waiting 4-6 hours after clieck the reinstall button? thanks.

There's no special method; you just reinstall it through the Control Panel.

Don't know what happened, they removed the Debian installation option.

interesting.

That is likely just on the affected servers which were impacted by Virtualizor's hack. Other servers still have Debian as an option. In my client area I still see Debian available for reinstall (rebuild).

Fubukibox · February 5

Got a message from that dumb "hacker" telegram bot lol

To CloudCone users

We remembered one thing we forgot to tell you.
The CloudCone admin password has not changed since 2019 (before we arrived), meaning that for seven years, your data has been exposed and unsafe.

Howdy, Stranger!

Categories

In this Discussion

What happened to CloudCone? Was it hacked?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

What happened to CloudCone? Was it hacked?

Comments