PDA

View Full Version : WHT CC Info Leaked!


Eclouds
April 7th, 2009, 15:01
This was posted at webhostingboard by Mike Denney.


Hello,

WebHostingTalk.com has been compromised once again but this time the Credit Card details portion of their database was compromised and is now circling the internet as "WHT_XXXX_XXXXXXX_XX.rar". This file contains *thousands* of credit cards with complete details including Credit Card Number, CVV2 Number, Full Name, Bank Name, as well as some other details.

If you have *ever* entered your credit card information at WebHostingTalk be it for a Premium Membership or any other reason you need to contact your bank IMMEDIATELY and cancel the card and be issued a new one. I would also advise you to let your bank know what has happened so that if you need to fight some fraudulent charges your bank will know what is going on.

Keep in mind I am not trying to damage WHT any further by posting this, it seems that this information is being kept "hush hush" when those affected need to be notified so they can pro-actively protect themselves against fraud.

Please - direct anybody you know that may have used their Credit Card at webhostingtalk.com to this thread and feel free to update this thread with pertinent *verifiable* information.

Thank you.
Dynash
April 7th, 2009, 15:05
... so they got hacked again?
SC-Jon
April 7th, 2009, 15:16
... so they got hacked again?

No, according to WHT..


This morning, the hacker who attacked WHT initiated further communication. He provided evidence that credit card information on one of our database servers was, in fact, compromised on March 21st.
Dynash
April 7th, 2009, 15:57
Didn't they say CC info was on another server? I can't remember the details, but I know if I got hacked I'd expect the hacker to go for CC information first. Post/threads and deletion of backups is meaningless, just causes headace and mayhem with no real self gain.
[JSH]John
April 7th, 2009, 16:24
It's just getting worse it seems. Hopefully they get it all sorted out soon.

Another update from iNet Interactive:


UPDATE: 4:24pm est

We have contacted all major credit card companies and are awaiting their guidance. It should be noted that card holders will not be held liable for any fraudulent purchase made using their credit card.
cobrastrike
April 7th, 2009, 16:31
Only time will tell what happens.

All I can say is that drastic changes in security need to be made, and that everyone should use this as a prime example of poor security practices.
Jan
April 7th, 2009, 16:47
and that everyone should use this as a prime example of poor security practices.
Indeed and some self professed "experts" in the field are taking another look at their own.
Schmarvin
April 7th, 2009, 17:14
I thought Rackspace had them covered?
Also, why did they contact the credit card companies? Was it due to them storing personal credentials on their servers?
Dynash
April 7th, 2009, 17:33
I thought Rackspace had them covered?
Also, why did they contact the credit card companies? Was it due to them storing personal credentials on their servers?
It was backup servers that got hacked.
Schmarvin
April 7th, 2009, 18:01
Even so, back to my question. Why did they contact the credit card companies? All CC information is temporarily stored, right?
cobrastrike
April 7th, 2009, 18:08
They had transactions from as far back at 2007 stored which were not encrypted. This lead to many CC #'s being released.
stuffradio
April 7th, 2009, 18:36
Everyone knows it's bad practice to store cc numbers...
cobrastrike
April 7th, 2009, 18:40
Even if you decide to store them, they should at least be encrypted.

Failing to encrypt and storing them leads to issues such as this.
Dynash
April 7th, 2009, 19:01
If I remember again, they posted once before that CC info wasn't taken and was safe, along with it being encrpyted? Unless I'm just pulling this from thin air. I'm sure it's somewhere in the first thread of WHT downtime.
cobrastrike
April 7th, 2009, 19:06
It was the user table that was released right after the hacking occurred. It was not until today that the credit card information was released which was not encrypted. The user table did have weakly encrypted passwords.
stuffradio
April 7th, 2009, 19:30
There is some sort of industry standard encryption you have to use if you store cc numbers, I'm not sure if you have to pay anything as well...
Richard
April 7th, 2009, 19:39
Well stuff - WHT did not use any sort of encryption, not even the bog standard one that your meant to use by law.

I can see quite a few law suits coming out of this problem.

WHT has been Arrogant for quite a time, and now, the tables are turning. They cut corners, and its biting them on the ---.
XFH-Jay
April 7th, 2009, 20:47
Their site shows that the CCs are from a while ago though.. the new orders are safe. It seems that they just didn't delete the CC #'s from a long time ago, which they should've done a long time ago...
cobrastrike
April 7th, 2009, 21:07
You misread. New memberships are protected, but new sticky thread advertisement costs are not. Also, most CCs have at least a 3 year activation span which makes about 80% still active.
sellwhm
April 7th, 2009, 22:03
New premium memberships use paypal as far as I can remember and paypal should be used for all future transactions from now on. The company needs to keep the paypal password away from any server that they use. Instead of checking the security of the server(s), they need to reload the OS of all of the servers just in case the hackers have access to the servers right as of now. How do they know if an employee isn't working with a hacker etc.?
Schmarvin
April 7th, 2009, 22:40
Even if they are old CC #s....it is illegal in the US to store CC credentials. You may keep a temporary session for authentication, but you are certainly not allowed to store permanently.
ganesh.rao
April 7th, 2009, 23:36
Even if they are old CC #s....it is illegal in the US to store CC credentials. You may keep a temporary session for authentication, but you are certainly not allowed to store permanently.
You are allowed to store the info (what does PayPal do then?) but it has to pass a few encryption standards (again, not set by the law per se) set by the card issuing companies like Visa, MasterCard, etc.

I'm pretty sure that iNet will lose its contract with its credit card processor and perhaps be denied by every new processor they attempt to deal with.
Jan
April 8th, 2009, 01:10
Well stuff - WHT did not use any sort of encryption, not even the bog standard one that your meant to use by law.

I can see quite a few law suits coming out of this problem.

WHT has been Arrogant for quite a time, and now, the tables are turning. They cut corners, and its biting them on the ---.
This is absolutely nothing to do with the forum.
AdamJ
April 8th, 2009, 02:09
As much as I think the community is full of stuffed up host's who all they care about is getting good reviews and spamming the place with their boring adverts, I do feel sorry for the staff and techies on WHT who have to suffer this kind of thing. But they could've at least encrypted things surely, or maybe stored the information offline?
Ben
April 8th, 2009, 04:31
Is it wrong that this makes me laugh?
JasonS
April 8th, 2009, 04:33
Is it wrong that this makes me laugh?

Nope.

You can laugh, like most of us. The industries biggest forum community is not as safe as FWS, lmao.
Richard
April 8th, 2009, 06:05
This is absolutely nothing to do with the forum.

I guess not - I mean, its not as if it was credit cards used on their site that got leaked.

... oh wait
Webdude
April 8th, 2009, 17:31
The industries biggest forum community is not as safe as FWS, lmao.

And the evidence of that would be .... ?
Just because nobody has bothered to hack FWS doesnt mean it's more secure.
Dynash
April 8th, 2009, 17:32
It was hacked. Recoil.
Patrick
April 8th, 2009, 17:33
Wow, I was considering buying a premium membership but I'm glad now that I didn't...
Tracker
April 8th, 2009, 17:45
Even still FWS uses paypal [correct me if I am wrong] so its still safer!
Peo
April 9th, 2009, 01:44
That's correct Tracker, we don't have any credit card info here. Advertisers pay with Paypal or in some cases bank wire transfer.

Hi Webdude! :wave:
GlennBeforeTime
April 9th, 2009, 02:10
God damn. You'd have to be a real retard to hack a hosting comparison website like WHT.
Ben
April 9th, 2009, 02:48
And the evidence of that would be .... ?
Just because nobody has bothered to hack FWS doesnt mean it's more secure.
He returns!
Webdude
April 9th, 2009, 16:51
He returns!

Yeah cuz you woke me up. Dont rub the lamp anymore..
iNETTeam
April 9th, 2009, 17:14
Hi Everyone,

I'm from the Web Hosting Talk/iNET Interactive team and wanted to let all of you know the best place to get updates on the current events happening at Web Hosting Talk. We're working hard to resolve current issues and want to make sure everyone is informed of the latest updates and happenings.

To get the latest information and updates, visit the following threads at Web Hosting Talk:

http://www.webhostingtalk.com/announcement.php?f=31&a=134
http://www.webhostingtalk.com/showthread.php?t=852943

Thanks!