Somebody hacked the Hostgator

[mtahta]

I want to know that, what is this ? Hostgator's linux admins are NEWBIE?
Look there: http://www.zone-h.org/component/opti...tion%20MasTer/

I talked with hacker;

Mehmet Tahta (00:30):
how did u leak my system
wordpress vulnerability?
how did u hacked my HTML site.
InjeCtion MasTer (00:30):
im not damage your site
InjeCtion MasTer (00:31):
im hacking the server

Can somebody say me, what is this He hacked my 16 web site and thats not my FAULT.

He taked our passowords.. Probably he taked our domains..
He taked my time..

Now, who is the responsible for this situation.? What ll linux admins do?
How can somebody take the ROOT, HOW?
I didn't understand.. I talked the operator from live chat, he said me we can't talk this via live chat, i said OK i'm calling the hostgator, operator said me, OK send an e-mail to security@hostgator.com. I'M CALLING, WHAT S THE EMAIL ??? I ALREADY KNOW WHAT EMAIL IS! I CALLED HOSTGATOR FROM TURKEY, BECAUSE I WANT MY BACKUPS, AND I WANT SOMEBODY FIX IT IMMEDIATELY.

I thinked, operator ll call admins, and admins fix it immediately. But, he only said me send an email ))))))

Thank you Hostgator, for spending my time and for my dollars.

[GatorNathon]

I'm sorry to hear that this has happened to you. After looking in to your issue I was able to find ticket number MHB-3119376. In this ticket you do not appear to provide your domain name or any relevant data so we can assist you.

Now that you have provided the link in this post to a list of your domain names I have updated your ticket so a security admin can look into this further.

The preliminary findings are very clear. There is no root exploit on this server at all. I know it seems strange but who would have thought a hacker would lie about exploiting a server.

I apologize that you had to go through the ticket system for this but we do have a specially built security team designed just to work on these issues. As soon as we receive a report we are more than happy to assist you in any way possible but as you did not provide any relevant account information we could not find your account.

As of right now a security admin is working on your ticket and we will update you from there. As your account is the only one compromised on this server I would have to assume your password was exploited or you had the same outdated version of scripts on all of your domains. We will be able to provide you with an exact reason shortly.

[mtahta]

Hello,

I'm sorry for my badwords. I was too angry and shocked. I called, i talked with the operator, when he said me "open a ticket" i was shocked too.. I was hope that he ll call the security admin and he fix the server.. But he said only open a ticket. Anyway...

My main domain name www.ircdzone.com, and i have lots of addon domain. For example www.nsohbet.com, it was only HTML, there is no PHP or something, it was exactly secured, but defaced. You can take a look that mirror; http://www.zone-h.org/component/opti...tion%20MasTer/

2008/11/16 InjeCtion MasTer sehirrehberi.ircdzone.com View Mirror
2008/11/16 InjeCtion MasTer sehirrehberi.org View Mirror
2008/11/16 InjeCtion MasTer trdot.ircdzone.com View Mirror
2008/11/16 InjeCtion MasTer trdot.org View Mirror
2008/11/16 InjeCtion MasTer nsohbet.com View Mirror
2008/11/16 InjeCtion MasTer ircdzone.com/forum View Mirror
2008/11/16 InjeCtion MasTer emooattack.ircdzone.com View Mirror
2008/11/16 InjeCtion MasTer emooattack.com View Mirror
2008/11/16 InjeCtion MasTer depo.ircdzone.com View Mirror
2008/11/16 InjeCtion MasTer demo.nsohbet.com View Mirror
2008/11/16 InjeCtion MasTer ceptelefonu.nsohbet.com View Mirror
2008/11/16 InjeCtion MasTer btdersleri.ircdzone.com/forum View Mirror
2008/11/16 InjeCtion MasTer btdersleri.com/forum View Mirror
2008/11/16 InjeCtion MasTer bilgi.nsohbet.com View Mirror
2008/11/16 InjeCtion MasTer arte24.ircdzone.com View Mirror
2008/11/16 InjeCtion MasTer arte24.net View Mirror

Thats all my site. And they all have different passwords, so hacker can't run different folders etc. After talked the hacker, i changed my all passwords. He said that, i didn't damage you, i only changed the index.html / index.php pages. I haven't got indexs backups. So, when you give me the index backup of these folders, everything will be OK for me. But, you shouldn't forget that, the hacker said me "i was hacked the server".

You can check the mirror page and take a look of other sites. I'm using shared hosting, so somebody might be damaged like me.

How can you refusal this situation i don't understand. Don't u know my username or main domain name or server IP? I gived you a web address, you can check the mirrors. For example look this: http://www.zone-h.org/component/opti...60/id,8157472/

Thanks for your care, and i'm so sorry for my badwords. Please check the dedicated which i 'm hosted, and give me the index page's backups of these web address. OK?

Kind regards,
Mehmet Tahta

[mtahta]

By the way, i changed all index pages yesterday. So you can only check it from the http://www.zone-h.org/component/opti...tion%20MasTer/ page.

Please check your system security.

[GatorDHanna]

After talking to a system administrator, I can say that the server itself is secure and was not compromised and that the issue was specific to the script you were running being compromised. Because other accounts on the server were not compromised, we feel confident in saying that the issue was specific to your account and not an issue of overall server security.

With that in mind, we would of course like to help you resolve the problem. Our security team can verify that you have successfully updated your scripts to the latest version of WordPress and that your account will be more secure.