Skip to content
Register

My host got owned, what should I check?

General Discussion by RAJ 6 replies 395 views
RAJ

Member OP

14 #1

Got email from RackNerd. Says "security incident affected some systems." No details. Very vague guys. My clients on 12 VPS there.

What should I check? Any leads on checklist? I did not receive root compromise notice but wording unclear. Changed all passwords already.

Billing panel was down 6 hours. Could be anything.

your margin is my opportunity
Nadia59

Member

#2

Oh no not again this is exactly why I left the other place last year when they said incident and it turned out to be everything and nothing all at once you need to check your backups first always backups then check if they have your payment info still stored did you use same password anywhere else thats the real killer not the server its the reuse

Ray

Member

4 #3

Young man, in my professional opinion from 1987, you must verify the SCOPE. The vendor owes you CLARITY. I have seen this before with the Google and the Facebook. "Some systems" means NOTHING. Demand they specify if customer VMs affected or only the BILLING system. Two very different threat models, young man.

wendy

Member

#4

RAJ said:
No details. Very vague guys.
Their actual infrastructure runs Windows Server mixed environment. Hyper-V isolation is solid. Customer VMs likely untouched. The breach probably hit their WHMCS or whatever panel they use. Still worth checking your own attack surface though.

Have you tried restarting it?
ME

Member

#5

Peering

BGP looking glass still showing RackNerd v4/v6 reachable. No rt changes. Fw logs on my end clean. Transit-level issue would show in cfg, not seeing it.

Check: did they rotate api keys? Old keys = blast radius

salavi

Member

Threat Modeler

#6

Assume compromise: threat model this as full tenant escape until proven otherwise.

  • Blast radius: all 12 client instances, their data, your API credentials, any stored ssh keys in their panel
  • Attack surface includes your local machine if you downloaded invoices during incident window

Zero trust: rotate everything. Verify their new certs. Do not trust "some systems" — that is lawyer language, not incident response language

zoekyo

Member

Less Is More

#7

Complication is the enemy
They said affected, they meant billing

Fear travels faster than facts

rm -rf / --no-preserve-root ☯

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft