..so a hack into WHMCS causes all the managed sites to go down???
And Israel G, are you in Quebec?
The websites have not been down but simply suspended. In WHMCS there are several modules which sends queries directly to the server, including a suspension module. The hacker has simply used this flaw in WHMCS to run the module suspension on all accounts on the server and then change the page of his suspension. Fortunately for us, no sites have been damaged. The hacker has just executed a command line that suspended all server accounts.
Yes i live in the state of Quebec, more precise at Saint-Jean-sur-Richelieu.
I can't speak for mindraven. But if it were me and I was hacked as a hosting service I would shut everything down till I found a resolution. Being concerned that it may impact all of my customers.
Would not you!
Turn off the server is not always the best thing to do in this case.. After receiving the alert, it took only 20 minutes to realize that the hack was passing by the user WHMCS on our server so we systematically remove all the access to this account. For the rest, we needed about 1 hour to un-suspend all accounts on the server.
I prefer that your sites remain active and you know what's going on than simply shut down the server and give you no news.
Israel Gaudette
Mindraven.com
