NWH Networks Hacked

[NWH Networks]

Okay well this goes to people that were hosted with NWH as well, today we had gotten hacked. Hours later TeppaHosting was hacked and all accounts were removed under it. Luckly NWH made backups yesterday due to server testing. However to see the message of the hackers http://www2.swprozee1.com:8889/nwhnetworks/teppa.jpg

Anyways we plan on getting this started back up and going and I will inform you when NWH: Networks is back up running correctly.

[iLucas]

Well, sorry to hear about the hacking, and good luck getting back on your feet. It's good you made a backup.

On a side note, that image won't show because "Hot-linking is not allowed".

You can see the hacker message at www.teppahosting.com. It's sad that people take their anger out on someone who had nothing to do with the reason they're angry

[umxhost]

Have you pinpointed what was penetrated? What control panel do you offer? I think we would all like to know what happened and if it could have been avoided. I really hate seeing this, as this is not what any of us want to happen.

[NWH Networks]

We used the latest version of cPanel 11. Some how they got into the main root reinstalled cPanel and changed the password, and of course removed all the accounts under Teppa. It is truly sad to see people waste their time on this, anyways from words the hacker forgot to hide their IP so they are going to trace it.

[Valiantheart]

I hope the server would be back up soon. It's a great host and I have several sites running from my account there.

Vaiant on NWHNetworks

[NWH Networks]

Yeah same here. It should be back soon , just makes me upset that people waste their time hacking stuff.. And what type of name is Hacker 1? Thats the worse Hack Name ever. nubs I swear.

[Dan]

Sorry to see this happening.
It kills me to try to realise the kick these idiots get. Sad. Really sad.

[NWH Networks]

Yeah same here...Whats so cool about it? I mean really all they did was found a error somewhere abused it and go into Root, and messed something up that took people time to get. Lets look netwebhost.org took me time to do (dont worry it redirects to nwhnetworks.com now) and got me a bad rep on here pretty much. So I come out when NWH: Networks v2.0 comes strong and good, once we finally reached near 1,020 post with 70members boom our forums down + site. People dont really care I guess of what we do and how much is cost us to do what we do for people. All I can remember that may had flair this was 2 people from some foreign (its our ad on a differ lang) posted by someone used nulled vBulletin, we closed their accounts and reported to vBulletin, and threaten to take legal actions for breaching the Term Of Service as well of using a illegal software. That may had caused it bout I highly doubt it as one was the age of 13 and the other one I am not 100% sure of. I guess im going to sleep some now to take stress off and go to school. Tomorrow we shall find out what Teppa is going to do.

[NWH Networks]

Update:
Good News: 2hours and NWH: Networks will be back up
Bad News: ALL back-ups were removed off the hidden server. :( Sorry for those who was hosted under NWH: Networks. After we get setup again we will yet again reopen applications and to those who lost alot we will be giving you a 250MB extra on your account.

[Dan]

Update:
Good News: 2hours and NWH: Networks will be back up
Bad News: ALL back-ups were removed off the hidden server. :( Sorry for those who was hosted under NWH: Networks. After we get setup again we will yet again reopen applications and to those who lost alot we will be giving you a 250MB extra on your account.

Glad to hear your having things fixed.

Man, what bad luck to lose everything like that. :cry2:

[NWH Networks]

Yeah, well at least we are getting it fixed up. I may have some backups not sure though. That means our NWH Software and all has to be re done. I may have some backups still on this computer not sure though.

[PaulP]

Hi,

I don't understand why the hotlinking message shows as it is a direct link.
Try http://www.swprozee1.com/nwhnetworks/teppa.jpg instead.

Read all your server logs to find out what the last action was etc.etc.
Really, these hackers should be caught, as this could destroy a new hosting instantly. Backups are so important...

At least I am glad to help you out with a temporary account on my free Dutch hosting.
Good luck !

Kind regards,
PaulP.
www.swprozee1.com

[Valiantheart]

No backups? :(

[Aremith]

Sad to hear that. The only backup I have is of my MT Database which I made after creating the demo account. Hope I still have it. Should be on my flash drive. =S

Too bad I hosted some banners I made on the account. I'd need to redo them. Hope some backups appear.

[Cam.]

Damn, That sucks.

[power4hosting]

so have you purchased a new server? or all your server are now offline?

[NWH Networks]

The servers are back to how they were before, except all sites are gone. (Im taking that guess off of teppahosting) anyways Teppa has regain their hosting back to normal and they now no longer offer free hosting due to the fact the user was using their free host at the time of them being hacked.

To my users: You must understand things like this can happen to anyone. Just a bad timing I guess. For the next couple of months their will be double backups (to m computer, and the hidden server). This way things do not go wrong.

[power4hosting]

very true & its good that your server now back to normal.

[NWH Networks]

Yeah, just gotta go to school now when I get back home we should have our site back up... Laters

[power4hosting]

congrates on that, hope your site grows more :-)

[JonnyH]

Unlucky. Throughout the time we've been open we've never been hacked.

[power4hosting]

Unlucky, throughout the time we've been open we've never been hacked.

lol so you want someone to hack your host? strange.

[JonnyH]

lol so you want someone to hack your host? strange.

I said unlucky to the above then said we're lucky because we haven't been hacked. :P

[power4hosting]

I said unlucky to the above then said we're lucky because we haven't been hacked. :P

oh alright then its fine :-)

[NWH Networks]

Well I should have my site back soon, till then I guess I will work on the site finding files etc.

[raversworld]

Notice it was a free user. You guys we have to watch out for these hackers that sign up for free accounts. It kills us enough to support them. And especially if they can move easily inside cpanel. I think from my point of view that we should limit free users inside cpanel.

[NWH Networks]

Well people that were hosted with me gets x3 cpanel which is offered to only paid.. so yeah..

[Adam]

One big problem is there are many scripts that allow clients to emulate a shell which allows them to change directories outside their home directory. Also another problem is many scripts that are not updated regularly and have several open holes that allow someone to do much more with the script than was ever intended.

One of my hosting accounts was circumvented because of a image hosting script I was using that became out of development. The intruder uploaded a script that allowed them to compile an eggdrop. This caused my account to be suspended. The hacker then left his calling card in form of an index.html in all of the directories of each hosted domain. If I remember correctly the script that was used was called PHP Shell or something similar.

[NWH Networks]

Yeah we use to have a Image Hosting we removed it, found a Bug Shell or something similar to that so we removed the file along with the Image Hosting. That could had caused it but that was long time ago.. Not sure, however once Teppa remakes the accounts I will be sure to only use updated software.

[xd3vilx]

I am sorry to hear about this. All the best in the rebuilding NWH Networks.

[NWH Networks]

Yeah well once teppa remakes my account I shall get busy doing so.

[Alec P]

I'm sorry to hear this.

Good luck recovering.

[BananaMaster]

Hello,

I am the co-owner of NWH Networks, and I am here to say that where back up! We just need to set it all up! The forums are up at: http://www.nwhnetworks.com/community/


From
Admin Ed
Co-Owner of NWH Networks and head of NWH Software

[BananaMaster]

Double Posted by accident

[NWH Networks]

NWH is back! Check it out www.nwhnetworks.com

[DanTheMan]

Hi,

I don't understand why the hotlinking message shows as it is a direct link.
Try http://www.swprozee1.com/nwhnetworks/teppa.jpg instead.

Read all your server logs to find out what the last action was etc.etc.
Really, these hackers should be caught, as this could destroy a new hosting instantly. Backups are so important...

At least I am glad to help you out with a temporary account on my free Dutch hosting.
Good luck !

Kind regards,
PaulP.
www.swprozee1.com
it doesn't work since it's being read a referred from here. so if you just copy and paste it in the browser youll see the image :D

sorry to hear that you've been hacked but glad that your back online!

[NWH Networks]

Yep after so long we are back up.

[Valiantheart]

I can't seem to access the site. :( I get a unable to find IP address error.

Also, I had more than 60 posts previously. Would I need to get all the posts again?

[NWH Networks]

Just enough to request again.

[Valiantheart]

Do I get the additional services with just the post need to host again?

Also, can you help me to access the site? Here's the full error:


While trying to retrieve the URL: http://www.nwhnetworks.com/

The following error was encountered:

Unable to determine IP address from host name for www.nwhnetworks.com
The dnsserver returned:

Server Failure: The name server was unable to process this query.
This means that:

The cache was not able to resolve the hostname presented in the URL.
Check if the address is correct.

[NWH Networks]

Should work, and u would get everything else and 250MB extra

[Valiantheart]

I can't seem to access the site again. :(

[umxhost]

Site seems up to me:

Quick check for: nwhnetworks.com (http)
Date City Country Time (s) Result
September 12, 2007 19:34:09 San Francisco United States 0.346 Ok

[Valiantheart]

I've been trying all day long but I still can't reach the site.

Edit:
I ran a check and here's what it says:


HTTP: The website is accessible!

FTP: Connected to the FTP!

MAIL (Pop3): There seems to be a problem with the Pop3

MAIL (SMTP): Connected to SMTP successfully!

MySQL: The MySQL seems to be offline.


I believe the database is the cause of this.

[hip_hop_x]

to not get hacked again next time, block open_basedir commands.
Most of hackers gets immportant data using php shells.

[iiPanel]

It's sad to hear about this bad incident. Hope you will quickly regain all losses.