Re: [bitfolk] Another Exim remote code execution exploit

It was later determined that a user account on the VPS had been

>     accessed starting 3 days ago, via an SSH dictionary attack. The
>     attacker installed another copy of the SSH dictionary attack
>     software and set it going. We do not believe that root access
>     was obtained.

>
> The amount of detail would vary because we may only become aware of
> a compromise when the customer's VPS itself starts perpetrating
> abusive activity, and then we rely on the customer to investigate
> why that is.
>
> If the customer is unable/unwilling to do this then we may never
> know why their VPS began misbehaving. We don't examine customer data
> unless given permission to do so, and even then this is often too
> time-consuming to undertake on an unpaid basis. I would consider the
> above an example of the maximum amount of detail we would go into.
>
> No identifying information regarding the affected customer would be
> shared. We already share non-identifying information similar to the
> above to peers within the industry to aid deterrence and detection
> of future abuses.
>
> Would this sort of posting be welcomed or would it be unwelcome
> noise? If the consensus is that it would be unwelcome noise then I
> may create a new list specifically for it, but I would rather not do
> so as then that is just another list that we have to raise awareness
> of.
>
> Please also note that those with an extremely low tolerance for
> email noise may wish to quit this list and instead join the
> "announce" list, as it contains only announcements from BitFolk with
> no customer discussion whatsoever:
>

>     https://lists.bitfolk.com/mailman/listinfo/announce
>     http://lists.bitfolk.com/lurker/list/announce.html

>
> (just 19 threads this year)
>
> Thoughts?
>
> Cheers,
> Andy
>
> --
> http://bitfolk.com/ -- No-nonsense VPS hosting
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
>
> iEYEAREDAAYFAlDBUj4ACgkQIJm2TL8VSQsqvACgwIgInU6KIOtadzOhGfxJbzq2
> IMwAoKpBPCQW2HYD1Dgs6RPF38QNycai
> =xqsl
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> users mailing list
> users@???
> https://lists.bitfolk.com/mailman/listinfo/users
>
>

--20cf3036370534056b04d03b708a
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p>Would be even better if I replied to the list... </p>
<div class=3D"gmail_quote">---------- Forwarded message ----------<br>From:=
&quot;Moggers87&quot; &lt;<a href=3D"mailto:moggers87@googlemail.com">mogg=
ers87@???</a>&gt;<br>Date: Dec 7, 2012 4:11 AM<br>Subject: Re: [=
bitfolk] Proposal: Security incidents postings<br>
To: &quot;Andy Smith&quot; &lt;<a href=3D"mailto:andy@bitfolk.com">andy@bit=
folk.com</a>&gt;<br><br type=3D"attribution"><p>I&#39