WHMCS.com website hacked - security precautions inside

agentblack said:
I think it's a little shady that a company used stolen data to "alert" clients of an affected company, however today I have received two email alerts from vendors who do use WHMCS outlining what occurred and letting us know our data wasn't accessed.

It's this type of communications that are helpful to clients if you are using the affected software, however using stolen data, there's no excuse for it.

We also have not had ANY questions from our clients about the WHMCS breach, however we will address them if they are asked.
Click to expand...

Yes i have no problems with genuine users that i have had dealings with letting me know whats going on, i have had a few and i have done the same, but when somes contacts me by using date taken from the STOLEN files this is spam and theft, they are as bad as the hackers
 
RandyTHQ said:
anyone having plans to switch billing system or am i the only one?
Click to expand...

I was planning to move to CE, but after a long chat with one of the WHMCS guys via MSN i decided to give WHMCS another chance. but i am still setting up CE just incase i need to move. I thinks its worth paying the extra $12 for a CE licence just as a fallback plan.

I know Blesta are offering upto 50% discounts to anyone migrating from WHMCS at the moment
 
statement released by UGNazi http://pastebin.com/iDgfV8RM

The reason for the hack and database leak of the WHMCS was due to the vulnerability WHMCS and "Matt" have. As most of you know the database contains credit cards, Really? Yup. WHMCS the number 1 Web Hosting Client management company stores your credit card on Hostgator's servers. By Matt hosting this huge domain on Hostgator he made himself and his domain very insecure and that is why we took action and did what we did. It is now 2 days after the attack from us and the site is back up and it still remains on Hostgator after Matt knows it is insecure. Well Matt, guess what... Here at UGNazi We laugh at your security. By releasing your files, we wanted to make it known that we are watching; and will continue to be watching. Stay Frosty.


- Cosmo
Click to expand...
 
another attack
just posted on WHMCS blog (yet still pointing fingers elsewhere. This time blaming vB. Also now meaning two different servers have been hacked in under 48 hours now.)

Wednesday 23rd
> DDOS attack to main server continues
> DDOS Attack starts towards forum
> Forums are attacked - posts edited. vBulletin used as a point of entry. The forums, the documentation, and the blog are all hosted on a different server, entirely separate from our primary server. So this poses no new risk to our main client database. This issue is currently ongoing while the forums are upgraded.

Unfortunately credit card details were taken, and we do urge any clients who feel their credit card might have been included in this to take appropriate steps to secure their card. Further investigations have shown that the social engineering attack did not involve the compromising of any email account. This was only done after access to the server had been gained.

We've been working very hard with our web hosting provider to restore and secure services. The DDOS mitigation continues to be ongoing and we are doing everything we can to limit the impact of this.

Our main priority until now has been getting our main site back online, secured, and operational, so that we could bring our WHMCS installation back online to open up a route of communication to you, our users, and start dealing with any questions and concerns as quickly as possible.

As soon as we have things completely back under control, we will be reviewing all our systems and operating procedures, and making changes as and where appropriate. Steps are already in progress to migrate to a new hosting infrastructure as a first priority.

As I'm sure you can imagine, we are currently receiving a very large number of support tickets and enquiries, and we're doing all we can to answer them as quickly as possible. Your continued patience & support in these testing times is greatly appreciated.

The whole WHMCS team has been working extremely hard, and I'd like to take this opportunity to thank them as well for all their efforts in the past 36 hours.


Posted by Matt on Wednesday, May 23rd, 2012
Click to expand...
 
just thought i would check with the data commissioner (http://www.ico.gov.uk/what_we_cover/register_of_data_controllers.aspx) as i am sure this is a clear breach of the DPA.

but i am unable to find any registration under

WHMCS
WHMCS Limited
Mr Matthew Jonathan Pugh
Mrs Linda Pugh (wife)

their other companies

NETIFY LIMITED
MJP MANAGEMENT LIMITED
NETBILLING SOLUTIONS LLP
NETARA LLP

which being a UK company that holds personal data on computers or manual files it is a legal requirement to be registered
 
Interesting that it's not on file - it should be.

I found a few places listing "WHMCS Limited" and one which shows a google map of the address (4 broadway avenue) - is this a HOUSE address? - http://www.companiesintheuk.co.uk/ltd/whmcs

I have no plans to change out our billing system. I hope they learn their lesson and approach things more secure.

Interesting that they recommend CDGCommerce as a payment gateway/option, which offers credit card information to be stored at THEIR location which is more secure. Odd that WHMCS is failing PCI Compliance. I know that the US and Europe have different dates that were required to be PCI Compliance, but I'm pretty sure the final date for Europe was January 2012
 
handsonhosting said:
Interesting that it's not on file - it should be.

I found a few places listing "WHMCS Limited" and one which shows a google map of the address (4 broadway avenue) - is this a HOUSE address? - http://www.companiesintheuk.co.uk/ltd/whmcs

I have no plans to change out our billing system. I hope they learn their lesson and approach things more secure.

Interesting that they recommend CDGCommerce as a payment gateway/option, which offers credit card information to be stored at THEIR location which is more secure. Odd that WHMCS is failing PCI Compliance. I know that the US and Europe have different dates that were required to be PCI Compliance, but I'm pretty sure the final date for Europe was January 2012
Click to expand...

DPA registration is not automatic. Although it is a legal requirement it is up to you to manually register with them and pay the £35 for the annual registration.

I am also surprised that according to Mcafee daily PCI compliance they show compliance today and even yesterday.

i think required PCI compliance changed depending on EU country . i havew an account with cash flows ( formally voicepay) and i had to provide PCI compliance cert by 1st May 2012
 
Last edited:
another worring this is that WHMCS clearly display the TRUSTe badge on their fromt page but guess what i received from TRUSTe about this

Thank you for contacting TRUSTe. The site is not certified under TRUSTe's program and is using our trademark without authorization. I see no record of that site even having applied for TRUSTe certification. I have opened a ticket in TRUSTe's system so the person who handles trademark enforcement for TRUSTe can investigate.

TRUSTe provides a directory where consumers can look up sites that participate in our program, and TRUSTe seals should never be static images that do nothing when clicked--they should route to a page on TRUSTe.com that shows whether the site is verified as a participant or not. Here is the link to the directory:
http://www.truste.com/trusted_sites/index.html

We really appreciate your bringing this site's misuse of our mark to our attention.

--Simona
Click to expand...

so what else are they using unauthorised
 
the whmcs software itself was not hacked... just change passwords in the client area, and request new credit cards...

also software is only as secure as the server its hosted on...
 
private_html said:
also software is only as secure as the server its hosted on...
Click to expand...

Or in this case, as secure as the site owners public information.

If you run a company, and you're asked security questions, don't make one of them your dogs name, and then post about your dog on facebook.

Facebook, like MySpace back in the day, has become a godsend for hackers. People expose everything from their birthday to their friends, places they frequent, schools they went to and first girlfriends/boyfriends etc etc.

They call it "social engineering" but really it's just someone whose information was made public and used against them. I hate that these "social engineering" guys are called "hackers" - it gives real hackers a bad name :smash: (at least they WORKED to hack things, not just find the information laying around)
 
everyone on WHMCS blamed for their info been leaked.

well we all give this freely in a whois page for our domains and they on as Conor says Facebook/ twitter etc.

if more and more WHMCS users would upgrade versions as they are released ( i still know some using version 4.xx) and then followed WHMCS simple security steps this would make their installations more secure.
 
*************** said:
WHMCS forums are just up now
Click to expand...

yes, but spoke to one of the WHMCS staff and the site is still under DDOS attack.

good new though for us, but bad news for the spammers that are using info obtained from the stolen DB. If these have WHMCS licences then Matt is revoking their licences
 
znetwebhost said:
it was not with their software but due to social engineering hack some one hacked their server. whmcs script is secure.
Click to expand...

oh so you think their script was 100% secure. Soon after 2 days of the attack we listen sql injection was found in their script and they fixed that out. I hope you must keep yourself updated with the newsletter
 
znetwebhost said:
it was not with their software but due to social engineering hack some one hacked their server. whmcs script is secure.
Click to expand...

social engineering is not a hack as such. this is when someone approaches the host and pertains to be you to be given the login details of your server, this was due to someone gaining access to Matts personal emails(so we were told) and then managed to convince someone at hostgator that they were Matt and that he forgot his login details to his server, so they gave them these details.
 
Registration Number: Z3203512

Date Registered: 08 June 2012 Registration Expires: 07 June 2013

Data Controller: WHMCS LIMITED



Address:
4 BROADWAY AVENUE
GIFFARD PARK
MILTON KEYNES
MK14 5QF
 
You must log in or register to reply here.

Supporters

Back
Top