Virtualizor compromised again - very very bad

AnthonySmith

Just read on OGF that virtualizor has been compromised badly, anyone using it needs to look into this asap.

http://virtualizor.com/blog/security-incident-bgp-hijacking/

Something about injected packages after being compromised in another area so if you have pulled any updates or have auto updates it may already be to late.

Saving grace may be that the auto update was about as reliable as an eastern block politician if I remember.

Time to move on from this shit show of a panel in my opinion, huge red flag if you use it now.

reikuzan

Here we go again. . .

tulipyun

The list includes but is not limited to:

dedirock
solidvps
hosteroid
host4fun
strike.bz
sitehub
digirdp
rarecloud
virtono
littlecreek
chunkserve
naranjatech

xHosts

We are sharing our basic bash script that allows you to quickly check and do a basic cleanup of the known files and services.

This will do basic checks and quarantine these while keeping logs for later

wget -qO /root/contain-node.sh 'https://files.xhosts.uk/contain-node.sh' && chmod 700 /root/contain-node.sh && /root/contain-node.sh

AnthonySmith

So the tl;dr version is virtualizor themselves were compromised and someone managed to push malicious packages via their domain/distribution to hosts hypervisors that either ran updates or had auto update enabled.

Ultimately leading to a backdoor being set up and the attackers gaining full remote root access to hosts hypervisors.

It's likely many hosts that are compromised don't even know yet and ultimately anything running virtualizor should be considered compromised at this point.

If your host runs virtualizor you should probably consider your VPS compromised or at risk.

Honestly at this stage if hosts are not planning to move away from virtualizor by the end of the year I don't really understand what you are doing, there are many options and lots of help available, I am even happy to assist myself if I can if the migration task feels overwhelming.

My understanding from contacts is that the lead developer removed himself from virtualizor a few years ago, and the people left behind have done a terrible job since.

AnthonySmith

@xHosts said:
We are sharing our basic bash script that allows you to quickly check and do a basic cleanup of the known files and services.

This will do basic checks and quarantine these while keeping logs for later

wget -qO /root/contain-node.sh 'https://files.xhosts.uk/contain-node.sh' && chmod 700 /root/contain-node.sh && /root/contain-node.sh

Thanks for sharing that here too.

AnthonySmith

http://virtualizor.com/blog/security-incident-bgp-hijacking/

AnthonySmith

I feel like this probably also impacted Softaculous more broadly, so if you run cPanel with it, you might want to start reaching out and checking stuff.

AK_KWH

@AnthonySmith said:
I feel like this probably also impacted Softaculous more broadly, so if you run cPanel with it, you might want to start reaching out and checking stuff.

yes it might be possible