12Wonder
April 23rd, 2005, 06:01 PM
Sites on the Jesskahn server were defaced yesterday. As far as we can tell at this point, it was only the site index pages were replaced, no other files were accessed or touched. We found the script they used to do it but to protect the rest of the data on the server, jesskahn was immediately shut down until we fully understood the scope of the damage.
Our original hosting site and these forums are on that server, which is why they were inaccessible and this is the first announcement here. (A 'News' announcement was temporarily posted about it at our web services (http://www.12wonderwebservices.com) site for those of you who checked in there.)
For the safety of the rest of your data, the old jesskahn server is in the process of being replaced and hot swapped with another one; the sites are being restored onto the new server from old backups one at a time. I say 'old' backups because as the tech crews delved into this they discovered that the malicious script that was used appears to have also overwritten anything index.* on the backup drives. So backups which we use to restore sites may have to go as far back as October 2004 for some of you. I understand this may be a problem. But this is the safest and surest way to get the server cleanly back online.
Any index.* file on jesskahn is pretty much toast I am afraid so you may find your index files replaced with a generic index.htm file that says the site is under maintenance. That is the best we can do. Hopefully you have been keeping recent copies of your web site files on your computer as we have been reminding everyone all along, and can republish or reupload your own copies from something newer than Oct. 2004. Although we take many precautions and this is the first time we have ever had anything like this happen, incidents like this are why we remind you to make frequent backups of your own.
We will still have the old server and hard drive and will attempt to work with you on an individual basis pulling any data like newer DB's etc that may be out of date on the backup. Since databases do not appear to have been affected or compromised, we can still recent pull database backups from the old jesskahn server to restore to the new server. If you need a recent database restored, please drop us a help desk ticket (http://www.12wonderwebservices.com/helpdesk.php) and specify the full name of the database including the username, in the form "username_dbname", and the web site to restore it to. The techs have to search through hundreds of sites and databases so we absolutely must have at minimum that much information before we can restore your database from recent.
There are still quite a few bugs to work out while the techs get the new server online, including screwy package quota issues and email issues.
Please bear with us while we and the techs work to get your sites online as fast as possible.
Thanks for your understanding.
Anne
Our original hosting site and these forums are on that server, which is why they were inaccessible and this is the first announcement here. (A 'News' announcement was temporarily posted about it at our web services (http://www.12wonderwebservices.com) site for those of you who checked in there.)
For the safety of the rest of your data, the old jesskahn server is in the process of being replaced and hot swapped with another one; the sites are being restored onto the new server from old backups one at a time. I say 'old' backups because as the tech crews delved into this they discovered that the malicious script that was used appears to have also overwritten anything index.* on the backup drives. So backups which we use to restore sites may have to go as far back as October 2004 for some of you. I understand this may be a problem. But this is the safest and surest way to get the server cleanly back online.
Any index.* file on jesskahn is pretty much toast I am afraid so you may find your index files replaced with a generic index.htm file that says the site is under maintenance. That is the best we can do. Hopefully you have been keeping recent copies of your web site files on your computer as we have been reminding everyone all along, and can republish or reupload your own copies from something newer than Oct. 2004. Although we take many precautions and this is the first time we have ever had anything like this happen, incidents like this are why we remind you to make frequent backups of your own.
We will still have the old server and hard drive and will attempt to work with you on an individual basis pulling any data like newer DB's etc that may be out of date on the backup. Since databases do not appear to have been affected or compromised, we can still recent pull database backups from the old jesskahn server to restore to the new server. If you need a recent database restored, please drop us a help desk ticket (http://www.12wonderwebservices.com/helpdesk.php) and specify the full name of the database including the username, in the form "username_dbname", and the web site to restore it to. The techs have to search through hundreds of sites and databases so we absolutely must have at minimum that much information before we can restore your database from recent.
There are still quite a few bugs to work out while the techs get the new server online, including screwy package quota issues and email issues.
Please bear with us while we and the techs work to get your sites online as fast as possible.
Thanks for your understanding.
Anne