Imagine u wake up one morning and try to view a site you administrate and u see dis on d site

http://www.anointedchurchofchristng.org/

I maintain one of the site listed, dat was what brought my attention to it,

checkout d list, it's alarming. all d site listed show d same page. mehn

I don't want to mention d host company.(so someone will not say I came here to spoil their name). it's jus for host companies to be more careful.


SAFE

quadrillio:

Imagine u wake up one morning and try to view a site you administrate and u see dis on d site

http://www.anointedchurchofchristng.org/

I maintain one of the site listed, dat was what brought my attention to it,

checkout d list, it's alarming. all d site listed show d same page. mehn

I don't want to mention d host company.(so someone will not say I came here to spoil their name). it's jus for host companies to be more careful.


SAFE

What exactly do you mean by "Nigerian Host"?

Are you referring to

1. A Nigerian who is running a web hosting business with servers located outside Nigeria whether as a reseller or owner of a dedicated server?

or

2. A Nigerian who is running a web hosting business with servers located in Nigeria?

Since 2003 I started providing hosting services to individuals and even multinationals I have never toyed with the idea of setting up a production hosting arrangement within the country primarily due to internet bandwidth issues.

Just needed to be certain what you mean before making comments anyway.

One common denominator though is that a web hosting arrangement is only as secure as the skill sets of the person or persons in charge of the securing the infrastructure.

I saw something like a bank's website there?!!

Microfinance maybe, but bank is bank, no be so?

Just before we conclude that the problem may be from the web hosting company I hope we understand that the problem can also come from applications we write ourselves or bugs from popular open source content management systems as information concerning such software applications are usually in the public domain so any body can take advantage of any security holes in an application to hijack a website.

Afam:

Just before we conclude that the problem may be from the web hosting company I hope we understand that the problem can also come from applications we write ourselves or bugs from popular open source content management systems as information concerning such software applications are usually in the public domain so any body can take advantage of any security holes in an application to hijack a website.

I dont know much about hacking but it makes more sense to me that the problem is likely coming from the host rather than hosted scripts since they (the hackers) were able to list all the other hosted sites on the webserver.

Besides, if such a hole can come from a hosted script, any serious webhost should know how to prevent such occurence.

biggjoe:

I dont know much about hacking but it makes more sense to me that the problem is likely coming from the host rather than hosted scripts since they (the hackers) were able to list all the other hosted sites on the webserver.

Besides, if such a hole can come from a hosted script, any serious webhost should know how to prevent such occurence.

If you are a landlord and you rent out your property to tenants it is not your duty to ensure that the kitchen knife would not be used to kill someone. A knife is a knife and can be used for several things.

However, the landlord can ensure that he will not rent his house to a known criminal by doing background checks.

My point is that there is no way a web host can secure an insure script written by a client who paid for web hosting. That is the duty of the web developer.

What the web host can do is to isolate breaches to the affected domains but again this is easier said than done unless you are on a private virtual server or a dedicated server notwithstanding claims by webhost management tools that they can make a shared hosting platform bullet proof.

One more thing, with a domain name I can actually get a list of all domains on the same server, you don't even need to hack into a website to be able to do this.

The analogy to me doesnt apply in the context of the topic at all.

Will your knife analogy also apply to a session in one site on your web server affecting another sites session in the same shared server?

Is it not the job of the server owner to make sure that such things dont interfer.

A webhost cannot be like a landlord because landlords allow their tenants to come out and enter their neighbour's rooms but in a webserver, you are not supposed to allow a sites script to work in another.

biggjoe:

Is it not the job of the server owner to make sure that such things dont interfer.

A webhost cannot be like a landlord because landlords allow their tenants to come out and enter their neighbour's rooms but in a webserver, you are not supposed to allow a sites script to work in another.

I already addressed that in the reproduced post below

Afam:

What the web host can do is to isolate breaches to the affected domains but again this is easier said than done unless you are on a private virtual server or a dedicated server notwithstanding claims by webhost management tools that they can make a shared hosting platform bullet proof.

Let us use another analogy to explain my position.

Windows operating system is a software just as Internet Explorer or Microsoft office is a software product.

These software products can be installed on computers.

Have we not heard of bugs or security holes in these software products that have allowed individuals to control thousands or millions of other computers before?

In this case who will you blame? The PC maker or the software maker?

Afam is addressing the issue like a true professional. It is very immature to lay the blame of a hacked website squarely on the webhost. 95 Percent of the time, it is vulnerable scripts being used by the client that is to blame.

If u r observant and carry out ur investigation on the hacked sites (which i have done), u'll realise dat the guy hcked d host (cant give further details).

i happen to get a report from one of the listed sites on they very day it all started, they were seeking my professional opinion and by the time i concluded my investigation, all my ten fingers pointed to the host. By the time we contacted d host (Name Withheld), they were already aware and told us they are trying to track the hacker or something like that. I dont use that host anyway but its a problem that's related to shared hosting.

I dont know if the server is in Nigeria but a popular lagos based hosting company hosted a lot of 9ja sites on that server. Just replace your index file and your site is up and running again.