Simon Willison's Weblog: dreamhost

Security Breach

2007-06-08T08:16:37+00:00

A statement from Dreamhost.

Massive Dreamhost hack, WordPress not to blame

2007-06-06T09:38:00+00:00

On mezzoblue, Dave Shea reports that someone had modified every index.php and index.html file on his site to include spam links at the bottom of the page, hidden inside a <u style="display: none;">. Dozens of other people in his comments reported the same thing happening to their sites.

At first, it looked like the common thread was WordPress hosted on Dreamhost. Initial commenters were all running WordPress (Dave has it installed for other domains on his hosting account even though he doesn't use it for mezzoblue itself) and there was a vulnerability in WordPress 2.0.7 which was fixed back in January but would still affect people who hadn't yet upgraded. I posted a link suggesting that WordPress users in particular should check their sites.

I apologise to the WordPress team for even suggesting that their product had something to do with this. Here's an e-mail Dreamhost sent out to some of their customers last night:

We have detected what appears to be the exploit of a number of accounts belonging to DreamHost customers, and it appears that your account was one of those affected.

We're still working to determine how this occurred, but it appears that a 3rd party found a way to obtain the password information associated with approximately 3,500 separate FTP accounts and has used that information to append data to the index files of customer sites using automated scripts (primarily for search engine optimization purposes).

Our records indicate that only roughly 20% of the accounts accessed - less than 0.15% of the total accounts that we host - actually had any changes made to them. Most accounts were untouched.

Scary stuff.

Tags: dreamhost, hosting, security, wordpress

Unsettling

2007-06-05T21:16:58+00:00

Unsettling

Sounds like there might be a massive scripted hack going on against out of date WordPress installs on Dreamhost. Check your site. See also discussion in the comments attached to this post.

Tags: dave-shea, dreamhost, hosting, php, security, spam, wordpress

Django on Dreamhost: incomplete headers

2006-12-17T09:36:43+00:00

Django on Dreamhost: incomplete headers

Fix this problem on Dreamhost by renaming django.fcgi to dispatch.fcgi (they special-case for Rails users; Django users can tag along).

Tags: django, dreamhost, fastcgi, rails

Django on Dreamhost: incomplete headers

2006-12-03T19:04:08+00:00

Django on Dreamhost: incomplete headers

Calling your file dispatch.fcgi (as opposed to django.fcgi) fixes the problem.

Tags: django, dreamhost