Head Guru

Stanward, I am reviewing your post and account. We will respond shortly with an update.

I have three of the following servers available for immediate deployment. TotalChoice Fully Managed Dedicated Server 2x Intel Xeon Quad Core CPU @ 3.00Ghz 2GB RAM 2 x 1TB SATA6 7200RPM 64GB CACHE Hard Drives 100 Mbps Uplink Port 1000 Mbps uplink port to our private cloud based backup network 5 IP Address Allocations 4TB Monthly Bandwidth Allocation 1TB Remote Backup space on TCH Cloud R1 Remote Backup Software Featuring 12 hour incremental backups to remote cloud of backup servers Remote Reboot Facility PRTG Network Tracking Remote and Mobile Phone Monitoring 24/7 Support and unlimited tickets Normal price is $219.99, however we are discounting these three servers with a $100 off coupon. So your bottom line pricing would be $119.99 per month with no setup fee and no long term contracts. This offer applies to new server orders only and can not replace any existing server on your billing account. Honor system please! Once these three servers are gone they are gone. Please open a ticket with "server sale" in your subject and we will get moving on your order. Help desk is located at http://support.totalchoicehosting.com

We have already had two outages at this new data center. Both were brief and one just occurred. Nothing like home sweet home TCH.

Thank you for the kind word and wisdom. We work very hard to make everyone happy. Thank you for your business.

Horde should be fixed by looking at the tech response to your ticket.

Please drop in a help desk ticket and we will take a look for you. Thanks

Thanks for your long term business and support.

I wanted to give everyone a update. We are still monitoring and working thru tickets on the help desk. If you are having any issues, we ask that you please submit a ticket. Only a few servers were effected with the site defacement and we are very aware of how this happened. cPanel is also very aware of the issue and they have released an notice on their site. http://www.cpanel.net/2012/05/targeted-security-release-20120531-announcement.html We will be posting more in the coming days but at this point please know that we are here working in our clients best interest. Thank you

WHM is still locked down. We are still working thru this cPanel issue. Everything is going well and will update soon.

Hi, cPanel passwords should be working without issue. If your have issues with your cPanel password just open a ticket and let us know. We are not seeing cPanel password issues currently. We did lock out all users from cPanel and FTP for a bit, but that has now all be restored.

Services are being restored now. FTP will be coming on line shortly.

Multiple threads and topics have been all merged into this thread. Updates to follow.

Hello, We have identified a security flaw in the cPanel services that allowed a remote party to inject code into your web sites. This is being actively worked on and I will update everyone shortly. Services are being restored across all servers shortly.

I have asked the techs to not reply to tickets until we give the all clear. Stand by please. We are going to be ok.

Guys - Thank you for your patience. We are working this as fast as possible. I have a complete update coming soon.

We are blocking access until we figure this out.

Were working this. I will update everyone shortly.

TCH Friends and Family. Some of you may remember when we held the greatest give aways on our user forums. I remember the free laptops, desktops and more that we gave away in the past. Well I am happy to say that the forum contests are returning. We will be giving away tons of goodies and gadgets over the upcoming months and I am excited to begin this project starting on June 1st 2012. Stay tuned for tomorrows big announcement. It is a great day to be a TCH GURU! Yours in Hosting... Bill Kish

Hello TCH Family, We have been asked by many to have better communications with our clients during times of need. To that end we understood that during any network outage that we ever have had (and there have only be a couple in the 12 years of TCH) it would be very nice to have a open line of communcaitons with our family. Effective last night we have moved these here user forums to a off network server. This means that these forums are being hosted in a totally different data center that is not dependent on the TCH Network or DataCenter. So... if TCH ever does suffer a network outage these here forums will be up and running for all our clients to check in on and recieve any updates from us directly on the forums. I hope this makes sense, I am thinking i confused myself during this post. It is a great day to be a TCH Guru! Thanks in Hosting! Bill Kish

Quick Synopsis: Our network was the target of a large scale website defacing attack on Sunday, September 28th commencing at around 8:30am. A large number of servers were involved in this attack; however our internal servers and infrastructure were not vulnerable to this attack. We were able to get control of the situation by 10:00am and had identified the method of attack. The attack hole was closed and we started a methodical review of what happened. Once we learned that index files were the attack focus, we wrote a custom script that would review each index.* file on an effected server and look for certain keywords that were present in the hackers file placed on the effected servers. If this file was present our script deleted it and restored your last available backup from our weekly backups. In theory a simple method of restore but it took us a bit to get it working correct. I am confident that there are still some users on the effected servers that will wake up tomorrow and find that their index pages are blank. I should say during the chaos we ended up breaking php mail handlers on some servers, however this was fixed and was a simple mistake on our end. What the attacker did: At this time, the attack does not appear to have been any more malicious than replacing the web site's home page. The defacement worked by replacing index files in all public_html directories with the attacker's index.php file. The hacker’s main goal was to deface websites. Our entire internal infrastructure, including Domain Management, DNS Clusters, Billing, Forums, Help Desk or any Client Credit cards or personal information was not targeted or accessed. Furthermore, the entry method that was used was not an available entry point on any of our Internal Infrastructure. The attacker did not obtain user passwords. This apparently was not the hacker’s goal. The hacker used a system exploit to allow him to access index files. As always though, it is prudent that you update your cPanel and FTP passwords. The exploit used to gain entry has been blocked. The issue was with an authentication system that was in use for an application controlling cPanel. The exploit itself was something not seen before and has been forwarded to the prospective people for review. Where we are at this point: We have a complete understanding of the attack method used and we have already taken needed steps to block future similar attacks. In the future: While not related, we are going to start phasing out our dual version PHP platform servers. We have many servers that are running two versions of PHP. This was done for clients that asked for us to allow them time to upgrade their scripts to the new 5.3.x versions of PHP. The time has come and passed and we will be removing the dual versions of PHP and will only be rolling with the latest version of PHP on all our servers. Like I said this is not related to the web site defacements, however it is something that we need to address. We also ran software and system updates on all servers last night and rebooted every shared / reseller server. These updates were originally slated for June to coincide with the coming PHP upgrades, however in light of this incident; we choose the precautionary approach and completed them now. In addition: Even though our team responded quickly to disable the attack and limit the exposure to our customers, and even though the damage done was straightforward, this was a serious incident. At TotalChoice we are very aware of the threats that every website faces on a daily basis and are committed to protecting our server farm and all of our clients. Our security record up until this point has been excellent. Whilst we do view this incident as a failure, please know that this security hole was not known to anyone and if it had been we would have taken prior action. Final thoughts: I want to personally thank each staff member for the amazing work done during this incident. More importantly I want to thank each and every client for their understanding and support after all without the clients we would have nothing. Please let us know if you have any questions and or concerns about this matter and we will gladly answer them for you. Once again, thank you for your business and support.

Good morning TCH Family, What a long day yesterday was. Things are much calmer today, the help desk is not filled with tickets and my staff appears to be humming along and drinking mountain dews as normal. I have completed a overview report and am making some final reversions and will be posting it shortly.

I have replied to all the emails from clients. I am now working on returning phone calls. Things are running smooth on the servers. We have identified the method of this hack and we will be releasing a post sometime tonight with full details. We are all still monitoring, watching and working any tickets that come in. I still have not got to a Mountain Dew, however I have run out of milk and Marlboro lights. lol

TCH Family, I have tons of emails from many of our concerned clients. Please understand that we have all been working non-stop since this am to get things corrected on our servers. I will personally reply to each and everyone of you that have emailed me. Just asking that you all be a little patient on my replies. Anything urgent should be sent thru our help desk as we have full 24/7 support waiting to help you. Thanks and we will update again shortly.

Mail form fix is rolling out to all servers now. Updates coming shortly.

What is your domain?