{"id":3957,"date":"2018-03-19T16:35:38","date_gmt":"2018-03-19T22:35:38","guid":{"rendered":"https:\/\/www.whitefirdesign.com\/blog\/?p=3957"},"modified":"2018-03-19T16:35:38","modified_gmt":"2018-03-19T22:35:38","slug":"hacker-behind-recent-hack-of-numerous-eig-hosted-websites-claimed-they-had-full-access-to-one-of-eigs-servers-last-year","status":"publish","type":"post","link":"https:\/\/www.whitefirdesign.com\/blog\/2018\/03\/19\/hacker-behind-recent-hack-of-numerous-eig-hosted-websites-claimed-they-had-full-access-to-one-of-eigs-servers-last-year\/","title":{"rendered":"Hacker Behind Recent Hack of Numerous EIG Hosted Websites Claimed They Had Full Access to One of EIG’s Servers Last Year"},"content":{"rendered":"

Last Thursday we mentioned how we had come across a hacker that had recently hacked numerous websites hosted with various Endurance International Group (EIG) brands<\/a>. EIG does business through brands A Small Orange, Bluehost, FatCow, HostGator, iPage, IPOWER, JustHost and\u00a0quite a few others<\/a>. That the hacker was only hitting websites hosted with those brands stood out, since, if say, a hacker was exploiting a vulnerability in a WordPress plugin to gain access to them you would expect to see numerous different web hosts being represented.<\/p>\n

At the least, that seems to indicate that the hacker is targeting website hosted with EIG brands, which is possible explanation of that situation. What would seem more likely though is that the hacker is gaining access to some part of EIG’s systems allowing them access to all of the websites on a server. Considering the hacker was hitting numerous website sharing the same IP address, which would likely indicate they are on the same server, that seemed like a reasonable possibility.<\/p>\n

Proving that EIG systems are being exploited would be difficult without information they only have access to. Our past experience is that web hosts are rarely even willing to consider that they have been breached, much less admit that it has happened. As we mentioned in the previous post<\/a>, things are worse with EIG, since they are run by the majority owners of a security company SiteLock<\/a> and EIG gets a cut of security services sold by SiteLock to their customers<\/a>. That creates an incentive not to provide their customers the best possible security and what we have heard is when contacted about a hacked websites that they just try to push their customers to SiteLock instead of doing any checking into the situation (that includes someone that contacted us last week that has the been hit as part of this hack).<\/p>\n

While doing some more searching around on the message left in one of the files we found on a website hit by the hacker (that is also on the other websites being hit), “Hacked By Isal Dot ID”, we found that a year ago the hacker was claiming<\/a> to have full access to a server that a website had hacked was on.<\/p>\n

At the time of the hack\u00a0that website was hosted on the IP address<\/a> 192.185.142.185. The listed ISP of that IP address<\/a> is\u00a0Websitewelcome.com, which is HostGator.<\/p>\n

(The website is now hosted on the IP address\u00a074.220.219.116.\u00a0The listed ISP of that IP address<\/a> is\u00a0Unified Layer, which is Bluehost.)<\/p>\n

While the claim of a hacker isn’t necessarily reliable, it does raise further suspicion that there may be a security issue on EIG’s end. This seems like something they should be addressing. If you have been hit by this hacker and have gotten a response related to that instead of just being pushed to hire SiteLock please get in touch with us<\/a> or leave a comment on this post.<\/p>\n","protected":false},"excerpt":{"rendered":"

Last Thursday we mentioned how we had come across a hacker that had recently hacked numerous websites hosted with various Endurance International Group (EIG) brands. EIG does business through brands A Small Orange, Bluehost, FatCow, HostGator, iPage, IPOWER, JustHost and\u00a0quite a few others. That the hacker was only hitting websites hosted with those brands stood … Continue reading “Hacker Behind Recent Hack of Numerous EIG Hosted Websites Claimed They Had Full Access to One of EIG’s Servers Last Year”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[75,176,53,39],"class_list":["post-3957","post","type-post","status-publish","format-standard","hentry","category-bad-security","tag-endurance-international-group","tag-hacked-by-isal-dot-id","tag-hostgator","tag-sitelock"],"_links":{"self":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/comments?post=3957"}],"version-history":[{"count":3,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3957\/revisions"}],"predecessor-version":[{"id":3960,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/posts\/3957\/revisions\/3960"}],"wp:attachment":[{"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/media?parent=3957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/categories?post=3957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.whitefirdesign.com\/blog\/wp-json\/wp\/v2\/tags?post=3957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}