I have to agree with ShotGun and ladida, that everything is hackable and everything will have it's day that it was hacked. Not just adult companies, but mainstream too. How many exploits have there been for Linux & Windows? How many times have personal information been lost by credit card companies? Everything is hackable and everything will be hacked once. There's no stopping it, the only thing that you can do is get a hold of the company providing the software and have them patch it ASAP. Now if John did have prior knowledge of this prior to today, which it seems, he should have contacted every client running that version of that software that was affected. Let them know what needs to be done and supply a patch, or let them know what to change (ssh passwords, etc, etc).
Quote:
Originally Posted by ladida
Ofcourse John is not gona make a public statement their server is compromised (if it is), or that they have a problem in the code. It'd be a suicide. Same as when any other porn company gets hacked, you don't see a public apology here that people's emails/personal info got harvested do you? No, they fix the shit and move on (or don't even fix it and blame someone else). Or when software companies fix faults in their software on your server without you even knowing that it was a live exploit through which your server got hacked?
|
Now as for this comment. I feel that if John knew it, HE doesn't need to make a public statement, but he does in fact need to let their clients, EVERY SINGLE CLIENT, know that one one of their servers has been compromised. But only if their server contains data about a clients machine (server ip, ssh port, ssh user, ssh pass, etc, etc). But at the same time, it'd be public because a client would post on GFY or one of the other boards. This also brings up the fact that any machine visible on the web should have a software firewall on their machine, iptables is fine. Block every port except those needed by web server (port 80, 443 and any others). Then only allow say for SSH the IP addy's needed for the certain people.
It might be a pain in the ass, but that's the best way to keep somebody out, even if they have your information, atleast they can't FTP or SSH into your box.