As many as 100,000 websites have been destroyed by hackers targeting server virtualisation software HyperVM, which powers most virtual private server (VPS) hosting companies.
Most of the VPS systems hosted by Vaserv, and its sister companies CheapVPS and FSCKVPS were taken offline, with data on some of its servers destroyed without backups, when the hackers exploited a zero-day vulnerability in the LxLabs HyperVM software to gain root access to its servers. The hackers were then able to run commands (such as "rm -rf", Linux parlance for "remove everything, all files and folders, no questions asked,") to destroy both user and system data, preventing the servers from booting, and preventing users from recovering data.
Vaserv has estimated that almost half of the data hosted on their servers has been destroyed by the attack.
The identity of the hackers is unknown, and no hacking groups have claimed the attack. Vaserv stated that "This wasn't someone randomly scanning things. It was a deliberate attack on our infrastructure." It has also stated that, although the hackers had full root access to its systems, all sensitive data such as names, addresses, and credit card details were encrypted.
It is unknown whether any other hosting companies running HyperVM have been attacked. Anybody who uses a server hosted by Vaserv or its sister companies can check the progress of the rescue operation here.
55 Comments - Add comment