Basically this is what happened.
We started noticing and recieving e-mails from our uplink about sub-domains created on our machine via some of the accounts that exist on the server. I then went in, checked the logs and confirmed it was a port 2082 login to those accounts(which were mine). The passwords on both accounts were different from each other as well as different from root, but to be on the safe side I changed all 3 passwords for root and the other 2 accounts used to add the phishing sites.
Moving on, I noticed today that within a couple of weeks on the last incident I was getting logins via cpanel on 4 other accounts, none of which were mine(customers). I went in and removed the subdomains on those accounts, but the passwords in question were NOT bruteforced. I had strong passwords on my accounts that were compromised and I'm curious what I should be looking for to be able to tell HOW someone could obtain my passwords in cleartext. I have rootkit checkers that are up to date, I have APF and BFD installed and working properly. I'm at a loss and I'm hoping someone can offer some insight as to what could be occuring. Thanks in advance.
Versions are as follows:
WHM 10.8.0 cPanel 10.9.0-R139
CentOS 3.8 i686 - WHM X v3.1.0
Sincerely,
Patrick Jones
We started noticing and recieving e-mails from our uplink about sub-domains created on our machine via some of the accounts that exist on the server. I then went in, checked the logs and confirmed it was a port 2082 login to those accounts(which were mine). The passwords on both accounts were different from each other as well as different from root, but to be on the safe side I changed all 3 passwords for root and the other 2 accounts used to add the phishing sites.
Moving on, I noticed today that within a couple of weeks on the last incident I was getting logins via cpanel on 4 other accounts, none of which were mine(customers). I went in and removed the subdomains on those accounts, but the passwords in question were NOT bruteforced. I had strong passwords on my accounts that were compromised and I'm curious what I should be looking for to be able to tell HOW someone could obtain my passwords in cleartext. I have rootkit checkers that are up to date, I have APF and BFD installed and working properly. I'm at a loss and I'm hoping someone can offer some insight as to what could be occuring. Thanks in advance.
Versions are as follows:
WHM 10.8.0 cPanel 10.9.0-R139
CentOS 3.8 i686 - WHM X v3.1.0
Sincerely,
Patrick Jones
Last edited: