Multiple Logins Compromised... Help.

[Patrick-Jiffy]

Basically this is what happened.

We started noticing and recieving e-mails from our uplink about sub-domains created on our machine via some of the accounts that exist on the server. I then went in, checked the logs and confirmed it was a port 2082 login to those accounts(which were mine). The passwords on both accounts were different from each other as well as different from root, but to be on the safe side I changed all 3 passwords for root and the other 2 accounts used to add the phishing sites.

Moving on, I noticed today that within a couple of weeks on the last incident I was getting logins via cpanel on 4 other accounts, none of which were mine(customers). I went in and removed the subdomains on those accounts, but the passwords in question were NOT bruteforced. I had strong passwords on my accounts that were compromised and I'm curious what I should be looking for to be able to tell HOW someone could obtain my passwords in cleartext. I have rootkit checkers that are up to date, I have APF and BFD installed and working properly. I'm at a loss and I'm hoping someone can offer some insight as to what could be occuring. Thanks in advance.

Versions are as follows:
WHM 10.8.0 cPanel 10.9.0-R139
CentOS 3.8 i686 - WHM X v3.1.0

Sincerely,

Patrick Jones

 

[Funkadelic]

So the cPanel logs were showing logins from an ip address that your clients do not use?
Is it one IP Address or are the logins from multiple IPs?

Have you done a traceroute on the IPs? Did you check to see if they are anonymous?

One thing I can say though is that you should enable forced SSL login. Make sure your SSH port is not on port 22. Maybe you could change the usernames of the cPanel accounts as well?

 

[Patrick-Jiffy]

So the cPanel logs were showing logins from an ip address that your clients do not use?
Is it one IP Address or are the logins from multiple IPs?

Have you done a traceroute on the IPs? Did you check to see if they are anonymous?

One thing I can say though is that you should enable forced SSL login. Make sure your SSH port is not on port 22. Maybe you could change the usernames of the cPanel accounts as well?

cPanel access_log shows a user logging in and immediately adding subdomains/adding dirs/etc... and the ftp log shows someone ftping in several files(assuming for the phishing sites) and leaving. Thats all they do. I haven't logged any bruteforce logins to any cpanel user. It just seems REALLY odd that 4-5 accounts are compromised within a 2 month span. A lookup on the IPs stated they originated from Africa, so I blocked the entire block this recent time. The IPs were one person per incident so 2 in total.

I am looking for any reasons on how this could occur like it is has been and if/where any vulnerabilities could be. nobody besides myself has root access, I've been all over the logs to no avail. Any help in this situation would be great.

 

[rvskin]

Do you run RVSkin? If yes, upgrade to latest version. If not, possibly the attacker get root WHM remote access key from one of the application which rely on the remote key. I would suggest regenerate the root WHM remote access key immediately.

 

[ramprage]

Remote access key doesn't use FTP access however. But the could have used a remote access key to grab the shadow file and were cracking passwords offline then once broken FTPed in.

I have a script that can change all cPanel users passwords randomly with output root the admin.

It could also be that those accounts were using easy passwords like a simple name or even their username.