My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked it. The last time I was logged into WHM, root control was taken and all HDDs were no longer bootable. I believe the same person used a worm to monitor my desktop remotely. 5 pcs and 5 mobile devices, bricking my ddwrt r7000 router with PIA VPN killswitched. A dozen or so mint/ubuntu vms were taken over. Many usb drives were made to be write-only.It was relentless. I stopped trying to figure out what was going on and reformatted all devices.
I am now waiting on the server image and a memory snapshot, as well as an rsync copy. Upon transaction ill get a fresh server image...certainly of a different IP, unless they aren't to be convinced.
Here is the email I received today:
Blockquote This ticket was just assigned to me. I have made a backup of the account >out of the way of the backup processes here.
[2018-03-25] pkgacct completed
I was reading over some of the conversations and would like to just make sure we are on the same page.
We can not dd ( bit for bit copy ) the current state because the account does not have a storage medium that can handle it. If you wanted to add keys that we can rsync over ssh to a remote destination just give us the destination of the output file and we will be happy to help with that.
We normally do not keep hacked operating systems around unless there is some specific interest. What I find interesting is the openVPN software:
uperior.hosting.com [home]# ifconfig as0t0 Link encap:Ethernet HWaddr inet6 addr: Scope:Link UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:436367538 errors:0 dropped:504 overruns:0 carrier:0 collisions:0 txqueuelen:200 RX bytes:0 (0.0 b) TX bytes:26310498062 (24.5 GiB)
asbr0 Link encap:Ethernet HWaddr inet addr: Bcast: Mask: inet6 addr: Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:431222324 errors:0 dropped:0 overruns:0 frame:0 TX packets:1492069 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:20595591150 (19.1 GiB) TX bytes:634373123 (604.9 MiB)
If you are using this server as a production WebServer I would recommend using CentOS 7 and installing something like 'Cockpit' instead of using a VPN through a cPanel server on CentOS 6.
What is in the scope of our support is to insure you have a path to and from the server while you salvage the barebones data. I will conclude with some options and questions. (The following are my answers)
An inquiry about the openvpn activitu
Letting them know, again, I want a copy of the server image, a memory snapshot, and all logs available
Fresh installation of cPanel/WHM
Fresh IPs for sites and VPS
Is having a VPN, IDS, firewall, honeypot enough? Have I left anything out?
VPS is a from Bluehost, running CentOS 7 with any alternative to WordPress...