One user opened a support ticket and has posted the very comprehensive debrief response as part of that thread. What basically happened is that someone gained privileged access to the servers (note multiple instances compromised) via the cPanel interface. This then injected malicious HTML code into every .html and .php file it could find. This was then used as part of a large, sophisticated attack as documented by the Symantec virus team here.

At the time of writing, no official explanation or apology has been forthcoming – I guess anyone who complains will get the same script as the user posted in the forums. One of the big plus points is that a script has been run by the hosting team over my website and removed all traces of the malicious HTML code, seemingly without damaging any of my data. This has all happened pretty quickly too. Plus points to Siteground for cleaning up so efficiently. Lose marks for not telling customers.

So can we learn anything from this experience? Not a great deal I think. I had my apps patched to the latest versions, but that was irrelevant as the compromise happened at a much lower level than the PHP apps. From the Siteground ticket response, we see that the cPanel bug was previously undiscovered and can therefore imply that Siteground were running the latest version of their cPanel hosting tool.

After this I would still recommend Siteground as a hosting provider, firstly because it’s cheap (500GB storage / 5000GB/mo for just $5.95/mo), and secondly because the support (while silent in this case) does seem to have fixed the problem.

Googling around the subject showed that in 2006 another one of the big hosting sites suffered a mass attack using another cPanel exploit, which just proves it can happen to anyone. Always worth having a backup of your site, just in case…

There’s a thread I’ve started over in the Siteground forums, which doesn’t have any official apology or reason at the time of writing. This may be corrected in due course, but everything is very quiet so far.

Not a happy man.

The website itself can be found at benandamy.ianburnett.com , but is password-protected. If you want access, either contact myself or Lynne, who can sort it out for you. 

If you want to add your photographs to the website so everyone can see them, let me know and I will sort an album out for you.

I logged-on to the website for more details. One of the things you must do is complete an online assessment to check your “suitability” for this new high-flying career in the brave new world of Information Technology. I duly completed the 40-question “evaluation” and scored 38. The quiz itself was geared exclusively around providing support for novice  Windows PC users. There were some really bizarre questions though: what sort of file systems are available at install time of Windows 98? WTF? Windows 98 support from Microsoft ended nearly a year ago!

Anyway, once you’d scored more than a certain score (presumably 1), you were sent through to a page advertising their road-shows, which were scattered about the country, which is where I left things.

Or so I thought. The following morning (at 10:25, presumably once the girl in the office got round to it) I received an e-mail saying “well done, you’ve passed the assessment, click here to book an appointment” etc. The content of the e-mail wasn’t the problem though. It was the fact that the message was Cc’d to a collection of people who had obviously all done the same as me. There were a couple of obviously fake e-mail addresses (such as “pope@vatican.com”), but there were many that looked pretty genuine accounts.

I wasn’t particularly happy about this, so sent back the following note to the sender: 

Isn’t that a bit, well, crap, sending out e-mails with everyone’s e-mail address on display? While it is fun to imagine the Pope (pope@vatican.com) would wish to take up some basic training for a helpdesk career, should the plans with His Holiness not go as planned, I’m guessing that may be someone telling a little fib.

Computer training tip #1: use “Bcc” if you must do this – at least all the e-mail addresses will remain private. £50 please!

I added that I probably shouldn’t because I had ended up in hospital last time, but because I’d lost 50 pounds before I awoke in an intensive care ward, with tubes coming out of most of my orifices and IVs in both arms, I was willing to try it again.

I told her that it was essentially a perfect diet and that the way that it works is to load your trouser pockets with Winalot nuggets and simply eat one or two every time you feel hungry and that the food is nutritionally complete, so I was going to try it again.

I have to mention here that practically everyone in the queue was by now enthralled with my story.

Horrified, she asked if I ended up in intensive care because the dog food poisoned me. I told her no. I’d been sitting in the street licking my balls and a car hit me.

(originally found in the Sunderland AFC forums)

ATC: “What was your last known position?”
Student: “When I was number one for takeoff.”

“American 751, make a hard right turn at the end of the runway if you are able. If you are not able, take the Guadeloupe exit off Highway 101, make a right at the lights and return to the airport.”

Lufthansa (in German): “Ground, what is our start clearance time?”
Ground (in English): “If you want an answer you must speak in English.”
Lufthansa (in English): “I am a German, flying a German airplane, in Germany. Why must I speak English?”
Unknown voice from another plane (in a beautiful British accent): “Because you lost the bloody war!”

The Cherokee pilot, not about to let the insult go by, came back with a real zinger: “I made it out of DC-8 parts. Another landing like yours and I’ll have enough parts for another one.”

Speedbird 206: “Frankfurt, Speedbird 206 clear of active runway.”
Ground: “Speedbird 206. Taxi to gat Alpha One-Seven.”

The BA 747 pulled onto the main taxiway and slowed to a stop.

Ground: “Speedbird, do you not know where you are going?”
Speedbird 206: “Stand by, ground, I’m looking up our gate location now.”
Ground (with quite arrogant impatience): “Speedbird 206, have you not been to Frankfurt before?”
Speedbird 206 (coolly): “Yes, twice in 1944, but it was dark — and I didn’t land.”

“US Air 2771, where the hell are you going? I told you to turn right onto Charlie taxiway! You turned right on Delta! Stop right there. I know it’s difficult for you to tell the difference between C and D, but get it right!”

Continuing her rage to the embarrassed crew, she was now shouting hysterically:

“God! Now you’ve screwed everything up! It’ll take forever to sort this out! You stay right there and don’t move until I tell you to! You can expect progressive taxi instructions in about half an hour, and I want you to go exactly where I tell you, when I tell you and how I tell you! You got that, US Air 2771?”

“Yes, ma’am.” the humbled crew responded.

Naturally, the ground control communications frequency fell terribly silent after the verbal bashing of US Air 2771. Nobody wanted to chance engaging the irate ground controller in her current state of mind. Tension in every cockpit out around Gatwick was definitely running high. Just the, an unknown pilot broke the silence and keyed his microphone, asking:

“Wasn’t I married to you once?”

• (Referring to Andy Goram who was diagnosed schizophrenic): “There’s only two Andy Gorams!”
• (Referring to Manchester United’s South Korean midfielder): “He shoots, he scores, he eats your labradors, Ji-Sung Park, Ji-Sung Park”
• (Referring to the Liverpool centre-forward): “He’s big, he’s red, his feet stick out the bed, Peter Crouch, Peter Crouch!”

Not exactly PC, but funny.

Psychic Museum Closes

For those who know about telnet, simply open a session to towel.blinkenlights.nl

For those who don’t know about telnet, do the following:

• Click on Start
• Click on Run…
• Type (without the quotes) “telnet towel.blinkenlights.nl “

As an alternative, this link may also work for you: telnet://towel.blinkenlights.nl , but that depends on how your system is setup.