UnderHost - scammers and insecure Servers

[m3th]

Yo, I discovered something about UnderHost and I would like to share it with you and let everyone know they are fucking scammers which are selling you the idea they have secure servers although they got hacked and lost your data multiple times. They are backdoring their own forum, take a look at http://pastebin.com/m496172c and http://pastebin.com/m6593eb79. At the end they got rooted like every other scamm company, they got what they asked for - http://nopaste.org/p/aMd0zMK8gb/txt

m3th Reviewed by m3th on 12th Sep 2009. UnderHost - scammers and insecure Servers Yo, I discovered something about UnderHost and I would like to share it with you and let everyone know they are fucking scammers which are selling you the idea they have secure servers although they got hacked and lost your data multiple times. They are backdoring their own forum, take a look at http://pastebin.com/m496172c and http://pastebin.com/m6593eb79. At the end they got rooted like every other scamm company, they got what they asked for - http://nopaste.org/p/aMd0zMK8gb/txt Rating: 5

[mourya]

Thanks for sharing..

[Danny.M]

this related with http://underhost.us/forums/archives/...mpromised.html

??

[thizzladen]

Offshore hosting is like buying drugs, you can't buy crack from a crackhead.

[SuicidalMedia]

m3th , BlackBay ?

[Mareshal]

this related with http://underhost.us/forums/archives/...mpromised.html

??

Is not related to that. I just studied the SSH text and found this:

Last login: Tue Sep 1 22:42:35 2009


So is almost now.

[Danny.M]

that thread post on sep 3rd server hacked in sep 1st/second

the threads match up its all same servers in thread got hacked in here..

[Phozon]

FUCK THIS IS REAL I FOUND THERE ADMIN PASS !

[teamhonor]

LOL! wow... i heard they sucked, but i didnt know they failed completely....
that is why i just stick with good ol my365host.com

[xmsax]

Moderator, if you we're able to provide the OP IP to abuse@underhost.ca, it will be helpfull.

You customers affected already got email about this and there nothing new those breach has been now fixed and affected servers are also secured to prevent the phpshell which have caused this issue, 4 servers affected on 15 on shared hosting, again no VPS customers or dedicated servers other than shared was affected.

We are not scam and there no insecure servers, 0days can affect anyone, same day we got those servers compromised "Enotch Solutions'' and ''JetNetHost'' got also the same problem with compromised servers due to this kernel hack.

It's fully possible our forum get backdoor'ed before the events and the site was restored with the backdoored vbulletin script, our main site are isolated on one machine without any data from our client or any client on it, to ensure stability we use another servers only for our support/billing system there nothing to worry about that and we will simply upgrade our vbulletin to the lastest build. (forums has been disabled until, newest vbulletin build has been installed)

Since the hacker come from here, we we're not monitor this forums anymore you can bash us like you want and do self promotion for your hosting compagny.

We are on hosting industry to stay and jealous people will always exists