Web host DreamHost has told California’s attorney general that an attacker exploited a flaw in its web-based File Manager starting Aug. 15, collecting customers’ file-transfer logins and reaching some webmail systems for about 10 weeks before the company noticed Oct. 23, TechCrunch reported Wednesday. For small and midsize organizations that keep websites and email at shared hosts, the filing shows how long a provider-side intrusion can go unseen and how deep it can reach.
What Happened
DreamHost’s entry on California’s data breach list gives Aug. 15 as the breach date. In the sample notice letter filed with the state, the company said an unauthorized party exploited a vulnerability in the software behind File Manager, a browser tool for managing website files. The intruder could take the usernames and passwords for FTP and SFTP, the protocols customers use to move files to their servers, of anyone who logged in between about August and Oct. 23.
The attacker also reached certain webmail systems, which may have exposed session information, the data that keeps a user signed in, for a limited number of webmail users, the letter said. The contents of email and of files on customers’ file-transfer servers may also have been accessed. DreamHost said it found no evidence that control-panel logins or billing details were reached and is offering one year of free identity theft protection through Equifax.
In an Oct. 29 announcement, DreamHost said it found the activity Oct. 23, took File Manager offline, reset affected passwords, ended sessions, rotated internal credentials and rebuilt the tool. It said the incident was unrelated to recent PHP server updates and affected “well under” about 10% of its email and FTP/SFTP accounts. A spokesperson declined to tell TechCrunch why the attack went undetected so long, citing the investigation.
Why It Matters
A shared host holds logins and data for many customers at once, so a flaw in one tool reaches far downstream. The Primary Wire reported Wednesday that a hijacked update to cPGuard, a security product for hosting servers, reached about 2,950 servers, citing SecurityWeek.
Stolen file-transfer logins can be used to alter websites, and mailbox access can be used to plant forwarding rules that quietly copy messages elsewhere. DreamHost advised customers to treat File Manager credentials used from August to Oct. 23 as compromised, change matching passwords on other services, and check webmail forwarding rules, filters and site files for unfamiliar changes. Executives should also ask hosting providers how quickly they detect intrusions.
What to Watch
DreamHost, which says it has about 400,000 paying customers according to TechCrunch, has not given an exact count of those affected or named the vulnerable third-party software. Formal notices to users and further state filings may fill in the picture.
