Hi,

"This was taken off of Hostrockets Forums!

Dear Customer,

This message is in addition to the one about the billing problem that occured earlier this week with the 3rd party billing software that we originally used for accounting.

We now have reason to believe that the card information has fallen into the hands of people who should not have it. We have already contacted all of the credit card companies involved more than 2 days ago reguarding the situation so they have had plenty of time to take the necessary steps to protect you the customer.

We do however urge you to contact your card issuing banks yourself just to make sure they have acted in a manner to your satisfaction regarding the situation.

The company who wrote the billing software has been informed of where the security leak is, and how to fix it by our programmers, and told to notify the many other hosts that use the same software package as us. The FBI is now very involved in apprehending the offending parties involved.

Mastercard and Visa asked us to remind you that in the unlikely event that your card is used fraudulently you will not be responsible for any of the charges made.

The details regarding this policy implemented by Visa are located at: http://www.usa.visa.com/personal/secure_with_visa/

The details regarding this policy implemented by MasterCard are located at: http://mastercard.com/general/zero_liability.html/

The billing system was heavily modified to be more secure and moved to a new more secure server in a new physical location and locked down with no outside connection to the general Internet available for the affect backend system, which has also been completely recoded. Along with this, all account passwords have been changed and new passwords sent to all current HostRocket customers. Other security policy changes are as follows.

-3 digit confirmation code on the back signature panel of all cards to be submitted with new orders.

-All new orders to be confirmed by a live person on our staff before account activation.

-All telnet access to all hosting servers and requiring customers to use SSH (secure shell).

-IDS (intrusion detection systems) are being installed on all of our hosting servers.

These additional security measures are to help cut down on possible security breaches on other servers of ours in the future.

We thank you for your support during this, look forward towards serving your hosting needs in the future, and will keep you informed of any further updates reguarding the situation."

-The HostRocket Staff



Arrrg!!:eek:

Beat me to it, although I was expecting Kyle to do so. Almost sent him a PM about it.

But this part:
The billing system was heavily modified to be more secure and moved to a new more secure server in a new physical location and locked down with no outside connection to the general Internet available for the affect backend system,

Shouldn't that have been done a long time ago?

The company who wrote the billing software has been informed of where the security leak is, and how to fix it by our programmers, and told to notify the many other hosts that use the same software package as us. What software was it?

We cannot post what software it was publicly because there are several other hosts out there who use it and need to have their software patched asap before they get affected as well. If anyone has any questions about the situation they can email me directly at bbrader@hostrocket.com

-Brendan

Originally posted by MilkMan
Beat me to it, although I was expecting Kyle to do so. Almost sent him a PM about it.

But this part:
The billing system was heavily modified to be more secure and moved to a new more secure server in a new physical location and locked down with no outside connection to the general Internet available for the affect backend system,

Shouldn't that have been done a long time ago?

Well, probably. There was also a piece over at SitePoint that included this line.

"We have hired additional staff to help with the expected influx of support and to finish up our own in house billing system which we have coded from the ground up and know to be secure." (emphasis mine)

That's a bit of pride talking there, even though the intent is admirable. It's like wearing a big sign that says "hack me".

I hope they do take all necessary steps to keep this under control, but I'm still happy that they don't have my cc data. :)

Seems like everytime a company gets into the public eye, it is attacked in some way. addr.com a few months ago and now HR.

However, it seems like most are not learning from the mistakes of others. :(

The billing system was heavily modified to be more secure and moved to a new more secure server in a new physical location and locked down with no outside connection to the general Internet available for the affect backend system, which has also been completely recoded.

This is the same thing addr.com failed to do. Arrrg!! :eek: History keeps repeating itself. But, i guess when you are dealing with a third party system, there is a certain level of risk you take.

I believe ADDR got hacked through the actual server their stuff was on which isnt what happened to us, it was an exploit of a billing program we bought... a little different but not too much. What happened to ADDR pretty much couldnt happen to us, our billing box itself is locked down tighter than a drum and has no remote access to the net for the admin system.

-Brendan

Playboy.com got broken into the other day as well, they must have lost a TON of numbers on that one, im gonna assume they have alot of customers.

-Brendan

our billing box itself is locked down tighter than a drum and has no remote access to the net for the admin system.

Whew! That's good to know. :) At least the error was not directly your fault. We all put a certain level of trust and confidence in our third party systems to work as expected, yet things that we cannot control popup every now and then. :(

Originally posted by pcsteve

We all put a certain level of trust and confidence in our third party systems to work as expected, yet things that we cannot control popup every now and then. :(

Not a mistake we'll be making again.

-Brendan

Originally posted by pcsteve


Whew! That's good to know. :) At least the error was not directly your fault. We all put a certain level of trust and confidence in our third party systems to work as expected, yet things that we cannot control popup every now and then. :(

Finally somebody that speaks with reason ..

For all the others , guys, this is the world we live in, crackers are our there to get you and your CC numbers, we ourselves live in fear that one day this might happen to us as well, so stop bashing HR, unless you are a customer affected by this, you have no right to do it so.

We offer our support to HR, as we can only imagine what they and their customers are going thru right now, I said that on Sitepoint, I say it here too.

I for once find it hard to bear when a host that works for so long to get ahead sees his entire live and investiment threaten by some PUNK in a basement with a computer, ... and let nobody think they are immune to it.

<<EDIT: Nothing to do with the thread, just a flame, removed>>

lol Cyrus

Originally posted by Cyrus
<edit>:rolleyes: :rolleyes: :rolleyes:

You are a real class act Cyrus.

lol Melissa, its pretty funny ;)

It wasnt intended to be funny I dont think.

Good luck to HR on sorting this problem quickly... ;)

Originally posted by Cyrus
<edit>
cyrus-
I'm no longer hosted with HR anymore but I can appreciate the manner in which they are handling this situation. I am thankfull that they sent me an e-mail regarding their credit card issues, because I called my credit card company and they advised me to close out my account, and they would issue me a new card. This is a very serious matter, which HR handled very well in my opinion. If you don't want to receive any e-mails from HR the block their e-mail address, so you can't get anymore e-mails from them.

Hostexp-
Personally I don't see anything funny regarding the situation or Cyrus's post, and your 2 worded posts really don't add anything to the subject at hand nor are they helpfull.

Really?

And you think i didnt know that?

Congratulations... at least someones use a percentage of brain power ;)


I also posted the remarks because Cyrus posts the samething in EVERY Hostrocket related thread.


Originally posted by baddealings.com

cyrus-
I'm no longer hosted with HR anymore but I can appreciate the manner in which they are handling this situation. I am thankfull that they sent me an e-mail regarding their credit card issues, because I called my credit card company and they advised me to close out my account, and they would issue me a new card. This is a very serious matter, which HR handled very well in my opinion. If you don't want to receive any e-mails from HR the block their e-mail address, so you can't get anymore e-mails from them.

Hostexp-
Personally I don't see anything funny regarding the situation or Cyrus's post, and your 2 worded posts really don't add anything to the subject at hand nor are they helpfull.

Originally posted by Hostexp

Congradulations... at least someones use a percentage of brain power ;)


This ones too tempting :) You mis-spelled congratulations in the same sentence that you were commenting on brain power... just a joke tho :)

I'll have to get you back for this one ;) grr :angry:

D and the T are close together, it was a typo :D

I'm a HR customer who was affected. Just go off the phone with Visa and they will be monitoring our account for any suspicious activity. Nothing yet. I am not happy this happened, but keep in mind, this hole is potentially going to affect many hosts. I am satisfied at HR's honesty and promptness in keeping their customers in informed.

Originally posted by MilkMan
Beat me to it, although I was expecting Kyle to do so. Almost sent him a PM about it.


ROTFLMAOPMP

LOL!! How does everyone know me from everywhere? BN forums, HostRocket, WHT, everywhere. GEEZ, I guess I must like make my presence known everywhere. I was thinking about starting the thread however I didn't want to hurt the integrity of HostRocket. They meant well by notifying everyone, however, I still think it was very stupid of them not to check the code they got for any errors since they have 9000+ customers.

Yes, my credit card was in their system and I was very perturbed about that. Not just that but my contact information was in there and everything which I am VERY MAD AT. This is totally immature and I don't think they took all the precautions they could have in the first place to avoid this problem. Some strangers know probably know my physical address of a minor, me, which is UNACCEPTABLE! I will not be doing business with HostRocket anymore, and I have asked per their forums for them to delete my contact information entirely from their systems and I am awaiting on that. We have cancelled that Credit Card and they issued us a new number, and all my logins for everything from WebHostingTalk to HostRocket to my FTP to everything I have have all been changed. I have like 25 different passwords now for everything, so it's hard to remember them.

I think this could've been avoided, however, what's done is done. I do praise Mr. Brader for contacting us as that made me quite happy with them. I do wish them the best of luck in their future enduavors. Most of their staff is VERY Nice, and I have to personally Comment on Mr. Laube (Dave Laube) for his courtesy, and all that good stuff. I have also talked to Melissa before and she seems extremely smart, sagacious, and she is very kind. I think HostRocket will be fine once they get their hardware upgrades up and when this whole matter is settled.

BTW: I do know which Billing System they have. LOL. We talked about it months ago, and I was going to put it here, however, I respect that other hosts bought this creap crappy software and I don't want this to happen to them. Thanks HostRocket for handling this like you did, and I do wish you the best of success!

Sincerely,
Kyle R. Reilly

Originally posted by Kylecool


BTW: I do know which Billing System they have. LOL. We talked about it months ago, and I was going to put it here, however, I respect that other hosts bought this creap crappy software and I don't want this to happen to them. Thanks HostRocket for handling this like you did, and I do wish you the best of success!

Sincerely,
Kyle R. Reilly

So does the rest of the world, Kyle. :D

http://www.sitepointforums.com/showthread.php?threadid=40912

Well, I guess now many folks know how I felt when I had to cancel my credit card because HostRocket had charged my credit card months after I had left them, without permission!

Welcome to the club, folks! Maybe you can understand now why I was so mad! :D - Hey, if those hackers can read this post. You can take my number of the list - the card got canceled in September.

C.

(Hm, never got a response from Hostrocket - guess they got what they deserve!)

This is an unfortunate thing, but not unusual. This happens all the time, hackers spend all there time trying to do this, they will succeed once in a while. We had this problem happen with our provider who is also a big company mentioned on this board allot and they sent us all an e-mail last year. The problem was fixed and all of us customers did what we felt we should do. It was not dragged out in the public eye.

We use a credit card with a low credit limit for just this reason, if it does get in the wrong hands, only so much damage could be done.

I commend HR for bringing this to their customers attention and also doing the foot work to let other hosts using the same software know. So please don't knock HR for what happened, praise them for what they did when they found out.

I'm of two minds about this, as an observer. I like the fact that it was addressed, which is more than can be said for playboy.com and their problem. I don't like some of the things I've read, especially at the HR forums where people who aren't customers anymore are trying to get their information deleted from the HR database and don't seem to be having much luck. I also don't like the secondary explanation about what happened with WHNBilling, but there isn't enough information there to do anything other than speculate right now. It just seems a little.....off.

Well, I wonder.. what could HostRocket possilbly do to prevent hacking? I don't think anything would have been done. It's the hackers we are talking about... But I guess something could have been done since I haven't seen MS site hacked for long time.

Originally posted by Peeps
I'm of two minds about this, as an observer. I like the fact that it was addressed, which is more than can be said for playboy.com and their problem. I don't like some of the things I've read, especially at the HR forums where people who aren't customers anymore are trying to get their information deleted from the HR database and don't seem to be having much luck. I also don't like the secondary explanation about what happened with WHNBilling, but there isn't enough information there to do anything other than speculate right now. It just seems a little.....off.

Well, I told them via TT as per their forums they said they will delete past customer's information per my request. I told them to do so, and they said they did it ... I then said are you 110% sure and they said yes. I entrusted them to do this. I then logged into rocketsupport.com and my information is still there, my address, everything. I even have screenshots.


--------------------------------------------------------------------------------
On 2001-11-24 EST at 17:44:47, jrossi wrote:
--------------------------------------------------------------------------------

This has been done.

Thank you for using HostRocket.com
==
Have A Nice Day!
Joseph Rossi
HostRocket.com Support


--------------------------------------------------------------------------------
On 2001-11-24 EST at 17:50:01, he/she wrote:
--------------------------------------------------------------------------------

Are you 110% Sure that my Credit Card information, my Address, and everything is GONE from your systems?
-Kyle


--------------------------------------------------------------------------------
On 2001-11-24 EST at 17:50:09, he/she wrote:
--------------------------------------------------------------------------------

Are you 110% Sure that my Credit Card information, my Address, and everything is GONE from your systems?
-Kyle


--------------------------------------------------------------------------------
On 2001-11-24 EST at 17:55:39, jrossi wrote:
--------------------------------------------------------------------------------

Yes.

Thank you for using HostRocket.com
==
Have A Nice Day!
Joseph Rossi
HostRocket.com Support


--------------------------------------------------------------------------------
On 2001-11-24 EST at 18:13:20, he/she wrote:
--------------------------------------------------------------------------------

Joseph,
Guess What? My Address is still in your systems. I just took a screenshot of it. I\'m in rocketsupport.com, and I just looked and my address and all relevant information is STILL THERE. Looks like I caught you in a lie. I was thinking about going to WHT, but I\'m not sure I\'m going to do that. Why must you guys always constantly lie to me? This is RUDE. Please respond. I\'m leaving, but I\'ll be back tonight to read this. Thanks Guys. I just don\'t want this to happen again, thats ALL.... Thanks!
-Kyle


--------------------------------------------------------------------------------
On 2001-11-24 EST at 18:42:43, jrossi wrote:
--------------------------------------------------------------------------------

What information are you using to login to rocketsupport.com

Thank you for using HostRocket.com
==
Have A Nice Day!
Joseph Rossi
HostRocket.com Support


--------------------------------------------------------------------------------
On 2001-11-25 EST at 00:12:18, he/she wrote:
--------------------------------------------------------------------------------

I am using my username Kylecool and I can still see my information Mr. Rossi. :)
-Kyle


This just pisses me off so much I had to post it here. They flat out lied. I am in rocketsupport.com now, and I can view my name, cc expiry, and address. I just want it out, that's all.

-Kyle

EDIT: Well, I guess all my information is gone now. I am not getting emails from the TT system anymore and I can't log into rocketsupport.com either. Since that CC is gone anyway, I guess it doesn't matter. What's done is done, and I will NO longer be doing business with them, however, I do wish them the best of luck. Good luck HR!

-Kyle Reilly

I applaud HR's professional letter that was handed out. I have read it over and over again, there was no other way to say it, nor shape it.

Simple truth, the internet is still young, more and more solutions are out there to make life easier, making a choice on a product usally is a gut feeling. There is no manual for making programs perfect. Theres an old saying about making a server 100 % secure, "unlpug it it from the Internet".

I would expect those who are not related to the issue not to judge what has happned, only to judge what is going to happen.

Never make the same mistake twice, and HR will honor that.

William,
I agree with you there. It was a nicely written letter. I am happy they notified us, it's just the lies I don't like. :)

-Kyle

Kyle,

You had multiple entries in our system for some reason, probably when your account was moved to another server. This is not the forum to get things like this resolved as this is not HR tech support, if you are still having a problem contact us through one of the means provided as there are several.

-Brendan

EDIT: Well, I guess all my information is gone now. I am not getting emails from the TT system anymore and I can't log into rocketsupport.com either. Since that CC is gone anyway, I guess it doesn't matter. What's done is done, and I will NO longer be doing business with them, however, I do wish them the best of luck. Good luck HR!

-Kyle Reilly

You were not lied to, you just dont know what happened. Joe removed one of the entries and not the other one because he didnt realize there were two. Again this forum is net here as a technical support forum for us, please dont turn it into one.

-Brendan

EDIT: Well, I guess all my information is gone now. I am not getting emails from the TT system anymore and I can't log into rocketsupport.com either. Since that CC is gone anyway, I guess it doesn't matter. What's done is done, and I will NO longer be doing business with them, however, I do wish them the best of luck. Good luck HR!

-Kyle Reilly