Michael Posted September 24, 2014 Report Posted September 24, 2014 Just to inform you guys that there's a Phishing scam going around pretending to be Blesta, please don't fall for it and it's not a hotfix. Blesta Tweet: IMPORTANT NOTICE! If you received an email about a security hotfix today, we DID NOT send it. #PhishingScam Clare, Chris, marcel and 1 other 4
Paul Posted September 24, 2014 Report Posted September 24, 2014 If you received an email like this, ignore it. The email contains an encoded admin_login.php file, DO NOT UPLOAD IT TO YOUR SERVER. From: Blesta Support <blesta.com@gmail.com>Date: 2014-09-24 18:26 GMT+02:00Subject: Zero-day exploit \ Hotfix Hi First Last! A hotfix has been released for Blesta that addresses a bug discovered in3.2.2. This hotfix is very IMPORTANT and should be installed immadiately, becauseotherwise your admin area is not secure. We are sorry that we cannot give more information about this hotfix, but itis very safety-critical. You can find the hotfix in attachment, please upload it to /app/controllersand replace the existing file. Please logout after installing it and login again into the staff area,because the hash algorithm changed. As usual, a big thanks to everyone who reported and confirmed this bug, weappreciate your help. Best RegardsPaul PhillipsBlesta CEO Michael, ariq01, Clare and 3 others 6
eversmile_host Posted September 24, 2014 Report Posted September 24, 2014 Re-tweeted i haven't received any email but Thank you guys to save blester's.
marcel Posted September 24, 2014 Report Posted September 24, 2014 Thank you guys for letting us know about it...
Paul Posted September 24, 2014 Report Posted September 24, 2014 If anyone did receive the email, please let us know. So far only 1 client has reported receiving the email.
PauloV Posted September 24, 2014 Report Posted September 24, 2014 If you received an email like this, ignore it. The email contains an encoded admin_login.php file, DO NOT UPLOAD IT TO YOUR SERVER. I have not recived to peak at the code. If anyone uploads that file, what does it do? If we "fingerprint" the code we can trie to see the source of the malware (underground foruns, blogs, irc, etc..) and know whois responsible for this
Paul Posted September 24, 2014 Report Posted September 24, 2014 I have not recived to peak at the code. If anyone uploads that file, what does it do? If we "fingerprint" the code we can trie to see the source of the malware (underground foruns, blogs, irc, etc..) and know whois responsible for this I have the file, but my attempt to decode it using a popular service failed. My guess is that it probably captures your login credentials and emails the attacker.
PauloV Posted September 24, 2014 Report Posted September 24, 2014 I have the file, but my attempt to decode it using a popular service failed. My guess is that it probably captures your login credentials and emails the attacker. If you want we can trie to decode it we have some powerfull decoding tools
Paul Posted September 24, 2014 Report Posted September 24, 2014 If you want we can trie to decode it we have some powerfull decoding tools I emailed you a copy from our phillipsdata gmail. Michael 1
ModulesBakery Posted September 24, 2014 Report Posted September 24, 2014 Lol, used to see such kiddies trying to get Facebook accounts using phishing ... but now it is Blesta, i suppose the users of such software are not that naive to fall for this one ... most of them are hosting providers ... I guess. It is also not hard to check the sender email address if it is Blesta's official email address then go for it otherwise it is an obvious scam
PauloV Posted September 24, 2014 Report Posted September 24, 2014 I emailed you a copy from our phillipsdata gmail. Every tool we tested didnt decrypt the file I think is encoded with the latest ioncube encoderes and and we only support IC <=7 and PHP <=5.3 to decode, we will trie to to get the lastest decoders and post it back gutterboy 1
Michael Posted September 24, 2014 Author Report Posted September 24, 2014 So tempted to get a small vps testing server and install Blesta and check the logs daily lol ModulesBakery and PauloV 2
PauloV Posted September 24, 2014 Report Posted September 24, 2014 I emailed you a copy from our phillipsdata gmail. I have send to you an email regarding this, asking you for one thing Thanks
Joseph H Posted September 24, 2014 Report Posted September 24, 2014 So tempted to get a small vps testing server and install Blesta and check the logs daily lol That's clever was thinking of the same... lol .... By the way thanks for Informing us
Cody Posted September 24, 2014 Report Posted September 24, 2014 Lol, used to see such kiddies trying to get Facebook accounts using phishing ... but now it is Blesta, i suppose the users of such software are not that naive to fall for this one ... most of them are hosting providers ... I guess. It is also not hard to check the sender email address if it is Blesta's official email address then go for it otherwise it is an obvious scam It's easy to spoof from addresses. You should never trust emails like this, regardless of who they look like they're from. We will never send patches via email. Michael 1
PauloV Posted September 24, 2014 Report Posted September 24, 2014 I emailed you a copy from our phillipsdata gmail. File decoded I have sent u a PM on this forum I have detected the injection and the url that you will be able to find easily wfitg and gutterboy 2
Paul Posted September 24, 2014 Report Posted September 24, 2014 File decoded I have sent u a PM on this forum I have detected the injection and the url that you will be able to find easily Thanks for that. As I suspected, it does capture your Blesta URL, Username, and Password. Michael, PauloV and wfitg 3
Michael Posted September 24, 2014 Author Report Posted September 24, 2014 Clever bugger you are Paulov haha. decoding PauloV 1
wfitg Posted September 24, 2014 Report Posted September 24, 2014 This is how to tell it is a fake: "We are sorry that we cannot give more information about this hotfix, but it is very safety-critical." I don't know any developer that would NOT give the reason for a hotfix.
Michael Posted September 24, 2014 Author Report Posted September 24, 2014 This is how to tell it is a fake: "We are sorry that we cannot give more information about this hotfix, but it is very safety-critical." I don't know any developer that would NOT give the reason for a hotfix. It's like WHM** they and cPanel do a fix and release more information two weeks later so people don't get effected. What the idiot who sent it forgot was Blesta doesn't send emails and they announce what it sort of is and who found it if someone did outside the team. PauloV, wfitg and ModulesBakery 3
wfitg Posted September 24, 2014 Report Posted September 24, 2014 If you received an email like this, ignore it. The email contains an encoded admin_login.php file, DO NOT UPLOAD IT TO YOUR SERVER. It takes balls to sign your name to their scam. heh... I am glad that we have to log in to our blesta account to get patches, betas and new versions. This keeps them safer.
wfitg Posted September 24, 2014 Report Posted September 24, 2014 File decoded I have sent u a PM on this forum I have detected the injection and the url that you will be able to find easily Good job PauloV PauloV 1
cloudrck Posted September 24, 2014 Report Posted September 24, 2014 I have the file, but my attempt to decode it using a popular service failed. My guess is that it probably captures your login credentials and emails the attacker. Can you email me the file, I'd like to take a stab at manually decoding it.
Michael Posted September 24, 2014 Author Report Posted September 24, 2014 It takes balls to sign your name to their scam. heh... I am glad that we have to log in to our blesta account to get patches, betas and new versions. This keeps them safer. The patches and new versions are public and can be downloaded by anyone, ourselves we upload them to our download manager to save customers time if they wish to use them, but they are only for logged in users as the best place to get them is direct. Except beta's which are closed to Blesta customers only.
domaingood Posted September 25, 2014 Report Posted September 25, 2014 Please E-Mail I will decode and send in 10 min. I emailed you a copy from our phillipsdata gmail.
Recommended Posts