So PcPro awards = nothing. Summary of last nights info. Will wait for someone to correct me.
So PcPro awards = nothing. Summary of last nights info. Will wait for someone to correct me.
Thanks for the hosting offers, someone has stepped forwards though (and their PM box is full ).
I also have a backup domain name, www.pitchblack.me.uk , that hasn't cropped up in any phishing reports to my knowledge. Would that help and be low traffic if all the spammers are clicking on a link to ssib.co.uk?
Apparently, their actions are because I am not economically viable. I'll post the transcript later (checked it on my phone) but the Marketing Manger stepped in to the dispute saying "30mins of a technicians time fixing hacked accounts equates to 6 months subscription fee." He then said it'd cost £5 extra per month to swap to a dedicated virtual server and £20 to patch it up to make it secure (I expect only once though!).
Apparently they shove customers with breached accounts to a new server so they can grant shell access (which is denied on shared hosting for security reasons) and leave them to do the security.
It's their fault for letting customers host vunerable versions of sofware ala wordpress.
Why did their technicians jump in and fix your files all you need to do was delete and upload a good install.
If your db wasn't attacked then your data would be safe.
Sorry that I am coming to this late but I am sorry mate if a host as me to pay for a secure server ON TOP of what I pay monthly I would walk away.He then said it'd cost £5 extra per month to swap to a dedicated virtual server and £20 to patch it up to make it secure (I expect only once though!).
I would expect the server (dedicated or VPS) to be secure from the point I got it, now there are things such as SLA's and non managed servers in that from this point onwards its down to you but the least they could do is give you a secure server in the first place.
Not good if you ask me.
Guess the consensus is to jump ship then. Now the fun of fighting for a refund!
[Anonymised Tech Transcript logs removed by the OP since it causes so much offence to their techs. :/]
Last edited by CAM; 15th May 2009 at 01:40 PM.
However it is the providers responsibility to keep the servers secure & related software up to date (PHP/MySQL/Apache etc). It's also good idea for hosting providers to educate their customers on the importance of keeping popular scripts such as Wordpress (and especially Joomla!) up to date to avoid them getting comprimised. We usually do this as a little reminder in newsletters and offer assistance to customers on updating their software
It sounds like the company in question are simply trying to get you to upgrade to a premium package as they've almost given up on shared hosting. VPS's do have their place in hosting, but I'd personally not put anything on a 512MB server. You also need the technical ability (and time) to look after a server/VPS.
The normal way we deal with compromised sites is:
1. Try and find how the site got compromised in the first place via logs
2. Attempt to try and clean up the site and get it back on-line
3. If it can be cleaned up and offending code removed, upgrade the customers script to the latest version and secure appropriately (with correct permissions on files/folders).
4. If it cannot be cleaned up, we will restore the domains content from our backups, bring the site on-line and update the script/secure it.
5. Notify the customer of the importance of keeping scripts up to date/secure, should it be compromised again and we have to use our own backups there will be a charge of £15 + VAT (our standard rate for backup retrievals).
CAM (14th May 2009)
After cancelling my Memset account, they replied "If you feel that way then fine, we will supply a full refund" and they have also granted me access to the my data and EMail system to recover my stuff. I can hopefully investigate the logs too.
EDIT - And to keep things fair, post the good reply now I am back from work and can copy the message.
[Good anonymised transcript removed too by OP].
Last edited by CAM; 15th May 2009 at 01:42 PM.
I must state my intentions here - I'm a systems administrator at Memset.
Any web hosting company worth their salt will suspend/deactivate any web site that has been compromised. WordPress has had it's fair share of vulnerabilities over the years that have allowed hackers and phishers to upload their own content. Joomla also has suffered it's fair share, and we've seen many compromised sites who have not updated when security updates have been released.
What happened in the original poster's case was that he was running an insecure version of WordPress and a phisher had found and exploited a vulnerability in the WordPress (or plugin) module that allowed them to upload the phishing site. We suspended the account because (a) we had received complaints from our upstream provider and (b) it is a potential threat to our other customers, our server and our network.
When phishing sites are detected, what happens is that the security companies acting on behalf of the company that the phishing site is trying to spoof will contact both the web hosting company AND their upstream provider. Whole servers and networks can be blacklisted, null routed and various other fun things if they do not remove sites/code/whatever that is a threat to their operations.
In the case of unmanaged web sites at Memset - it is assumed that the customer is fully responsible for the system administration and maintenance of their own web site INCLUDING security patching, etc. If not, sites are suspended. We have to do this to protect ourselves and other customers, as I have said. On the shared hosting service, we manage the main OS patching, Apache patching, MySQL patching, etc. but it is up to the customer to ensure their applications are kept patched and up-to-date.
Unless you're on a fully managed support contract with *whatever* web hosting provider you're using, I am confident that pretty much every other web host would have done the same thing in our position.
I am thoroughly disappointed with some of the ill-informed comments on this thread. Surely most of you should understand that patching software such as WordPress, vBulletin, Joomla, etc. is very important - as is keeping yourself informed of what security vulnerabilities are out there.
P.S. - It's not particularly polite to repost private communications on a public forum.
Last edited by mbdrake; 15th May 2009 at 10:39 AM.
Your Marketing Manager said himself that he would prefer only to be offering only more secure solutions, and that may well be sensible for all the reasons you've mentioned, but the fact is if you are offering a service you should not turn your back on a customer the moment something goes wrong. That is simply poor customer service. I would be interested to know if he really expected the customer to roll over and fork out more money given that poor level of support?
We could debate the practicalities and financial viability of all this for hours, but what it comes down to in this case is that the response of your company to this incident was not handled well from a customer service perspective. My overall point is that you should ensure your own house is in order before lecturing other people on etiquette.
As for not supporting the shared hosting customers when they need help - this is absolutely not true. I (and my colleagues) have gone out of our way on many occasions to assist our shared hosting customer base. However there must be some limits to this support for these services. I've found that shared hosting takes up far more support time than providing support for VPS and dedicated server customers. We're now focusing on businesses rather than the consumer market (of which there are plenty of web hosts out there for home users) and indeed, our shared hosting facilities are being phased out (I don't believe you can buy any shared web hosting packages with us now).
Last edited by mbdrake; 15th May 2009 at 11:49 AM.
I've used a lot of web hosts myself over the years. I started my career as a technical manager/systems administrator/developer for small ISPs/web hosts before working for six years in the film industry for a busy visual effects facility in London. I used a LOT of web hosts during that time and none of them gave me the kind of level of support that my employers give our customers - especially those shared hosts that I used (and gave up before moving over to VPSes and dedicated servers). Sometimes paying that bit more money to get quality support is a necessity. Oversold cheap hosts do not work out well at all.
I DO believe in good customer service, yes, absolutely. But I feel that our recommendation of upgrading to a miniserver was a reasonable one given the circumstances.
Last edited by mbdrake; 15th May 2009 at 01:55 PM.
TronXP (15th May 2009)
Right, as per your request I have removed theanonymised transcripts from my posts. I'm sorry for doing it and may have made a mistake, butI saw no wrong in posting them and felt it would provide better clarity to the situation as I have never been in this situation before and didn't want to come accross as one sided. Yes, there are a few "angry customer" moments but what do you expect when you are left feeling like your dangling from the end of a rope with EBay's legal sharks circling below you?
In response to your claims of an old version of Wordpress, if you read the thread you will see I posted that as far as I knew, it was the most up-to-date version. The control panel bugs the hell out of me if I don't update, so I do. We all know that keeping web software up to date is as critical as keeping Windows up to date. It may have been Image Gallery which I assumed would be no threat if disabled in the control panel. But I did ask for this information plus more and it wasn't given, hence why I opted to leave.
I have spoken to the company MD who I have to say was incredibly good and helped calm the situation down and clarify the potential source of confusion. I have dealt with the matter and putting it behind me to move on and deal with more important things (like dodging the camera lenses of our school leavers ).
There are currently 1 users browsing this thread. (0 members and 1 guests)