Warning! The ColoCrossing database appears to have been compromised.

tulipyuntulipyun
edited May 25 in General

We warned ColoCrossing, but they decided to restore the email, we
came up with the choice to start leaking the database, and once we
get access to the new data from the email back - we'll send
everything out to the emails
Link to ColoCrossing database https://dropmefiles.com/REMOVED

Removed the download link and I'm not sure if I'm allowed to post it.

Thanked by (2)treesmokah host_c
«13

Comments

  • treesmokahtreesmokah
    edited May 25

    Their Virtualizor got breached. ColoCrossing, HudsonValleyHost, ChicagoVPS are affected. ~11k customers data is there, all in plaintext. Passwords, email and data related to VM's. I would recommend reinstalling all your VM's with them and changing passwords. Or even better, don't use providers with Virtualizor.


    mod edit: snip

    Thanked by (4)tulipyun imok skhron zgato
  • FritzFritz

    Shoot!!

    https://microlxc.net/

  • imokimok OG

    And nothing will happen to them.

  • legendarylegendary

    Did anyone received explanation email from cc? Laughable.

  • AuroraZeroAuroraZero Hosting ProviderRetired

    You mean as usual? This is not the first or last time.

    Free Hosting at YetiNode | MicroNode| Cryptid Security | URL Shortener | LaunchVPS | ExtraVM | Host-C | In the Node, or Out of the Loop?

  • treesmokahtreesmokah
    edited May 25

    Dear Customer,

    We’re reaching out to inform you of a recently resolved security matter involving the control panel software used to manage your ColoCloud virtual servers.

    The issue was identified on May 24th and stemmed from a vulnerability in a Single Sign-On (SSO) feature. While this did not impact the ColoCloud billing system (WHMCS) or expose any personal or payment information, the attacker was able to access limited system metadata, email addresses, and used our mail server API to send an unauthorized message to ColoCloud customers.

    All ColoCloud infrastructure is fully operational and secure. With support from the software vendor, we have taken all necessary steps to address the vulnerability and harden the environment.

    As a precaution, we recommend:

    • Rotating the root password for your virtual server container
    • If you reuse your Virtualizor password on other platforms, consider updating those as well

    These recommendations are made out of an abundance of caution. All stored container passwords remain securely encrypted. Additionally, while we have temporarily disabled access to the Virtualizor control panel, customers may still manage and interact with their virtual servers securely via WHMCS.

    We’ve responded quickly and thoroughly to ensure platform security and prevent this from recurring. If you need assistance resetting your passwords, our support team is ready to help.

    Please note: this communication applies only to the ColoCloud cloud/vps platform. It does not involve any part of the ColoCrossing dedicated server or colocation infrastructure, which operates on a separate system.

    Thank you for your continued trust.

    Sincerely,
    The ColoCloud Team

    This is the response. And they are lying about the scope.
    There is evidence of several VM's being compromised as a result of this, and the leaked data speaks for itself.

    Thanked by (2)imok skhron
  • cybertechcybertech OGBenchmark King

    dont know why anyone would use CC vps. far from best in price and performance.

    Thanked by (2)imok vyas

    I bench YABS 24/7/365 unless it's a leap year.

  • NeoonNeoon OGContent WriterSenpai
    edited May 25

    Looks pretty ugly, they also posted the link on nodeseek....

    Free NAT KVM | Free NAT LXC

  • LowEndLowEnd

    "the attacker was able to access limited system metadata, email addresses" passwords are not limited system metadata. They are literally lying.

  • doghouchdoghouch

    @LowEnd said:
    "the attacker was able to access limited system metadata, email addresses" passwords are not limited system metadata. They are literally lying.

    Plaintext container passwords 🫠

    I wonder why other panels only show a generated root password once…

  • cmeerwcmeerw

    @treesmokah said: I would recommend reinstalling all your VM's with them and changing passwords.

    Do people keep the password set by the panel during installation (and/or set the root password through the panel)? Is this ever a good idea?

    Or if you are using the VPS for something important - shouldn't you install the VPS from scratch anyway, so you know what's actually running on the VPS?

    Thanked by (1)skorous
  • teamaccteamacc OGSenpai

    Sorry, but how does
    "leaking email addresses"
    qualify as

    ".. this did not ... expose any personal ... information"

    Thanked by (4)MichaelCee Wonder_Woman burntascii mfs

    Hey teamacc. You're a dick. (c) Jon Biloh, 2020.

  • somiksomik OG

    @teamacc said:
    Sorry, but how does
    "leaking email addresses"
    qualify as

    ".. this did not ... expose any personal ... information"

    Maybe the email that got leaked was their company email address, not personal email. :lol:

    Never make the same mistake twice. There are so many new ones to make.
    It’s OK if you disagree with me. I can’t force you to be right.

  • skhronskhron Hosting Provider

    @cmeerw said: Do people keep the password set by the panel during installation (and/or set the root password through the panel)? Is this ever a good idea?

    Someone apparently does, and it is definitely not a good idea. Better approach (from a providers' perspective) is to enforce password reset on first successful login. The best approaches are use of SSH public keys, or, as you've mentioned:

    @cmeerw said: Or if you are using the VPS for something important - shouldn't you install the VPS from scratch anyway, so you know what's actually running on the VPS?

    However, there is a problem with this approach - virtual machine provision will take significantly longer or more effort than installation from a provider provided template.

    Check our KVM VPS plans in 🇵🇱 Warsaw, Poland and 🇸🇪 Stockholm, Sweden

  • cmeerwcmeerw

    @skhron said:

    @cmeerw said: Or if you are using the VPS for something important - shouldn't you install the VPS from scratch anyway, so you know what's actually running on the VPS?

    However, there is a problem with this approach - virtual machine provision will take significantly longer or more effort than installation from a provider provided template.

    Right, but using the provider provided template will hit you later (most likely at the most inconvenient time): when something breaks (probably because you are upgrading to a new version) and you have to figure out why, and then you have to ask "why on earth did they make that modification in their template?"

    I have yet to see a provider provided template without any issues.

    Thanked by (1)quicksilver03
  • skhronskhron Hosting Provider

    @cmeerw said:

    @skhron said:

    @cmeerw said: Or if you are using the VPS for something important - shouldn't you install the VPS from scratch anyway, so you know what's actually running on the VPS?

    However, there is a problem with this approach - virtual machine provision will take significantly longer or more effort than installation from a provider provided template.

    Right, but using the provider provided template will hit you later (most likely at the most inconvenient time): when something breaks (probably because you are upgrading to a new version) and you have to figure out why, and then you have to ask "why on earth did they make that modification in their template?"

    I have yet to see a provider provided template without any issues.

    Depends, there should be no issues with templates that are official images with cloud-init.

    Check our KVM VPS plans in 🇵🇱 Warsaw, Poland and 🇸🇪 Stockholm, Sweden

  • zgatozgato

    @teamacc said:
    Sorry, but how does
    "leaking email addresses"
    qualify as

    ".. this did not ... expose any personal ... information"

    Full names are also exposed, since those are migrated from WHMCS when they create your Virtualizor account for management. Unless you manually changed it.

  • somiksomik OG
    edited May 25

    @zgato said:
    Full names are also exposed, since those are migrated from WHMCS when they create your Virtualizor account for management. Unless you manually changed it.

    Anyone know where to download such files? Asking on behalf of some very reputable hosts looking for new customers :lol:

    EDIT: ^ The above is a sarcasm and not to be taken seriously (cant believe i have to explain it)...

    Thanked by (1)satorik

    Never make the same mistake twice. There are so many new ones to make.
    It’s OK if you disagree with me. I can’t force you to be right.

  • MasonMason AdministratorOG

    @tulipyun said:
    Removed the download link and I'm not sure if I'm allowed to post it.

    Good move. Feel free to discuss what happened but there will be no sharing or distribution of compromised databases/customer details on this platform.

    Thanked by (7)AuroraZero skhron saibal vyas skorous Wonder_Woman mfs

    Head Janitor @ LES • About • Rules • Support

  • cybertechcybertech OGBenchmark King

    @VirMach are you secretly enjoying this

    Thanked by (6)sh97 VirMach beanman109 Wonder_Woman satorik burntascii

    I bench YABS 24/7/365 unless it's a leap year.

  • imokimok OG

    I'm sure he can neither confirm nor deny it.

  • AuroraZeroAuroraZero Hosting ProviderRetired

    Well it appears they have received the ColonCleansing they needed

    Thanked by (2)vyas burntascii

    Free Hosting at YetiNode | MicroNode| Cryptid Security | URL Shortener | LaunchVPS | ExtraVM | Host-C | In the Node, or Out of the Loop?

  • legendarylegendary

    @AuroraZero said:
    Well it appears they have received the ColonCleansing they needed

    Colonoscopy was done and some artifacts discovered. Now long path to healing... Both reputational damage + damage for deleted servers.

  • AuroraZeroAuroraZero Hosting ProviderRetired

    @legendary said:

    @AuroraZero said:
    Well it appears they have received the ColonCleansing they needed

    Colonoscopy was done and some artifacts discovered. Now long path to healing... Both reputational damage + damage for deleted servers.

    They are like slimes man they always recover for awful reason. Like the bad guys in DBZ.

    Free Hosting at YetiNode | MicroNode| Cryptid Security | URL Shortener | LaunchVPS | ExtraVM | Host-C | In the Node, or Out of the Loop?

  • sh97sh97

    @VirMach any any refugee offers? Just got 3 of VMs nuked.
    Reguards

    Thanked by (1)Wonder_Woman

    The Ultimate Speedtest Script | Get Instant Alerts on new LES/LET deals | Cheap VPS Deals | VirMach Flash Sales Notifier
    FREE KVM VPS - FreeVPS.org | FREE LXC VPS - MicroLXC

  • treesmokahtreesmokah
    edited May 25

    @cmeerw said: Or if you are using the VPS for something important - shouldn't you install the VPS from scratch anyway, so you know what's actually running on the VPS?

    Looks like you won't have to reinstall it anymore, the attackers nuked all the vm's lol
    They still have access to Virtualizor, prior to that some Chinese users started getting infected with crypto miners on their VPS.

    What a disaster

    Thanked by (1)Wonder_Woman
  • NeoonNeoon OGContent WriterSenpai

    colocrossing is also not loading anymore

    Free NAT KVM | Free NAT LXC

  • VirMachVirMach Hosting Provider

    @sh97 said:
    @VirMach any any refugee offers? Just got 3 of VMs nuked.
    Reguards

    We can probably honor whatever amount of service you had left with them and renewal at the same price, but I don't know much about the type of offers they've been posting. Let's just say it'd be to help out any LES members, as I don't want to open the floodgates to a bunch of tickets at the moment (it'll be difficult to go through all of them, verify, and manually create.)

    @cybertech said:
    @VirMach are you secretly enjoying this

    I'm waiting for the @raindog308 "ColoCrossing Teeters at the Edge" LEB post.

    Thanked by (9)Lee imok sh97 skorous cybertech Wonder_Woman satorik ZA_capetown someTom
  • LeeLee OG

    @VirMach said: I'm waiting for the @raindog308 "ColoCrossing Teeters at the Edge" LEB post.

    Yeah, he won't bite the hand that feeds him. CC ultimately feeds him contrary to other statements. I foresee an LEB post of "all is really fine, they are on top of it, you should thank CC for their effort and not worry, etc".

    Thanked by (2)kheng86 burntascii
  • sh97sh97

    @VirMach said:

    @sh97 said:
    @VirMach any any refugee offers? Just got 3 of VMs nuked.
    Reguards

    We can probably honor whatever amount of service you had left with them and renewal at the same price, but I don't know much about the type of offers they've been posting. Let's just say it'd be to help out any LES members, as I don't want to open the floodgates to a bunch of tickets at the moment (it'll be difficult to go through all of them, verify, and manually create.)

    Wow nice. Their main plan was a $10 one - 1c/1g/20gb SSD and 20tb bw. I think most people are on that.

    @cybertech said:
    @VirMach are you secretly enjoying this

    I'm waiting for the @raindog308 "ColoCrossing Teeters at the Edge" LEB post.

    Already out
    https://lowendbox.com/blog/colocloud-breach-virtualizer-bugs-lead-to-wild-lowendtalk-thread/

    Thanked by (3)Wonder_Woman satorik burntascii

    The Ultimate Speedtest Script | Get Instant Alerts on new LES/LET deals | Cheap VPS Deals | VirMach Flash Sales Notifier
    FREE KVM VPS - FreeVPS.org | FREE LXC VPS - MicroLXC

Sign In or Register to comment.

© LowEndSpirit 2025

ipv6 ready