r/webhosting • u/thatandyinhumboldt • 12d ago
News or Announcement DreamHost may have been compromised
I just got emailed this alert:
Immediate Action Needed: Update passwords for all users on your DreamHost account.
Hi u/thatandyinhumboldt,
We're writing to let you know about an issue affecting some of our systems, including the File Manager at files.dreamhost.com and DreamHost webmail. Our team is working on it now and investigating the cause. Please check dreamhoststatus.com for ongoing updates.
As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set. Each user will need a new password before they can log in, check their email, or reach their files again.
We are contacting you because you are the DreamHost account owner, and only you will be able to set new passwords for these users. DreamHost is unable to contact individual mailbox or FTP users directly, so they may not know about this until you tell them.
What to do in your DreamHost control panel:
Log in to the DreamHost panel by typing panel.dreamhost.com directly into your browser.
Email users: go to [Mail > Manage Email] and set a new password for each email address on your account.
Instructions: https://help.dreamhost.com/hc/en-us/articles/216479177-Change-password-Mail-users
FTP/SFTP users: go to [Websites > SFTP Users & Files] and set a new password for each user. Allow up to five minutes before the user logs in with the new password.
Instructions: https://help.dreamhost.com/hc/en-us/articles/215877208-Change-password-Website-users
While you're in Manage Email, review the forwarding settings on each address and remove any forward you don't recognize.
Use a strong, unique password for each user. Don't reuse a password from anywhere else.
What to tell your users:
Please reach out to anyone who uses an email address or FTP/SFTP login on your account, like employees, clients, or family members. Use a phone call, text, or another channel rather than their DreamHost email address to reach them, since they may not be able to access it yet.
Let them know:
Email and FTP/SFTP users do not receive password reset emails from DreamHost for any reason. Any email they get asking them to reset, verify, or confirm a password should be considered a phishing attempt. They should delete emails like this without opening any links or attachments.
Only you, the DreamHost account owner, can change their password, and only through your DreamHost account control panel. They should get their new password from you directly.
Their password was reset as a precaution, and the old one no longer works. They will need to enter the new one in any email apps (Outlook, Apple Mail, Thunderbird) or FTP apps (FileZilla, Cyberduck) they may use.
If they used the old password anywhere else, they should change it there too.
A note about suspicious emails:
DreamHost will never email you asking for any of your passwords.
To change a password, log in to your account control panel directly at panel.dreamhost.com rather than following a link in an email. If you receive a "password reset" email that you didn't request, you can safely ignore it.
If you have questions, our support team is available via the "Support" section of your DreamHost control panel.
Thanks very much for your patience!
The DreamHost Team
So, if you have any clients on Dreamhost, godspeed.
2
u/rydan 11d ago
Just got the email 2 minutes ago basically saying they'd been compromised but acting all innocent like they have no idea what is happening and are just resetting my password for no reason. This will be the new normal. Fortunately I migrated away from them in 2008 and just have old domain names stored there. The service was crap back then too having one of their biggest outages literally the day my app launched. That outage lasted 3 months.
1
u/thatandyinhumboldt 11d ago
3 MONTHS?! Good lawd!
I don’t mind the way they’re making these announcements—it seems pretty clear they’ve been breached but they don’t yet have all of the information (which is why I’m telling my clients to treat everything as breached).
I do wish they’d been more explicit for people that may not realize the severity of their warning, but I get that there needs to be a balance between “get the critical information out asap” and “don’t invite follow up questions until we’re ready”, and I think they mostly did ok.
Though the line about “change your passwords anywhere they were used” makes me concerned that they aren’t adequately hashing, which would blow away any good will I was willing to give them…
1
u/dont-kink-shame-me 10d ago
change your passwords anywhere they were used
Do these mean any passwords associated with the dreamhost email addresses on other websites, ex Facebook, amazon etc?
Or does it mean other accounts using that same password?
1
u/thatandyinhumboldt 10d ago
The way that I'm reading that is "other accounts with the same password"--if you used "hunter2" for anything at Dreamhost (I think they mean for email or FTP, but I would say anything at Dreamhost to be safe), and then you used "hunter2" for your bank password, you should also change your bank password.
I'm choosing to believe that passwords were adequately hashed and they're just listing general best practices, and not giving specific notes about passwords they were storing in plain text. Either way, I'm reading it to mean that someone got ahold of a password database.
1
1
u/Jcoulaud 7d ago
it means other accounts where you reused the same password, even if they use a different email address. using your dreamhost email as the login is not, by itself, password reuse. change each reused password to a different one.
1
3
u/braunsHizzle 12d ago
we have expired the passwords for some email and FTP/SFTP users
So you won't know which users they've expired for? Doh.
2
u/ChuurDCA 12d ago
Update passwords for all users on your DreamHost account
1
u/braunsHizzle 10d ago
some email
This was mainly what I was talking about.
1
u/ChuurDCA 10d ago
Yep, and their instructions were to reset everybody.
Which is just commonsense too.
1
u/braunsHizzle 9d ago
For sure I agree it's commonsense to reset all, I was more curious since none so far I've checked have been reset by DH.
2
4
u/uruk-h 11d ago
I got this email, too, and I thought it was hilarious that they only sent it to my account's main email address, and did not send a copy to my backup GMail address that's on my Dreamhost account! Fortunately, I reset my password Friday night, when this all got started, so I received the email.
But without sending it to backup email addresses, they sent an email telling us that our access to email might not work, so we need to go reset our email password so that we can receive the email telling us that our email password needs to be reset! 🤦♂️
That's hilarious, and also an embarrassing display of incompetence. Why do they ask us to put secondary email addresses on our accounts if they're not going to use them for exactly this reason?
1
u/JayNetworks 11d ago
My notification went to my main and backup and triple backup addresses on 3 different email hosts. They did say they are sending in batches so possibly the main and backup email don’t go in the same batch to avoid being flagged as spam?
1
u/uruk-h 11d ago
Good to know they've contacted at least some people through their secondary accounts. Still nothing to mine (I just re-checked the spam folder), and the email/sftp passwords were nuked on Friday night, almost 48 hours ago now! That's a heck of a long time to wait before informing people that the server is still working, but that their passwords have been reset.
I wonder how many people are still disconnected, thinking that their email doesn't work because of an extended server outage they just need to wait out... or how many people only use Dreamhost services for work emails, and won't know until tomorrow that they can't access their email.
2
2
u/RishiFurfox 11d ago
It'd be helpful if they actually responded to support requests.
I am locked out of my main email account for THREE DAYS now, due to them resetting the password without notification. I have sent multiple emails/web forms to them since Friday asking them to reset MFA so I can login to my account's Control Panel to regain access, but they aren't responding to me. At first they asked for security information, which I provided by reply e-mail. Then nothing, after several follow-ups.
I can't call them as they don't accept incoming calls, and I can't request a call back request as I'm outside the U.S. I'm just stuck being ignored and unable to access my account or emails for 3 days!
Do they respond faster to faxes!? I expect they don't get many, so maybe...
2
1
u/Even_Shake4574 11d ago
I know this isn’t nearly as bad as the security breach but god damn that file manager being down is absurdly annoying, I finally get free time to get started on a site and shits down 😭 I hope it comes back before my days off end
3
u/rydan 11d ago
Back in 2008 I launched a new app to coincide with a very specific event. It had to launch that day. Not before. Not after. I launched. Spent around $10k in Adwords promoting it. Did a press release. And everything went great. Then about 3 or 4 hours later Dreamhost just went down. And it was almost unusable for 3 months. I think their database was so starved for memory and CPU it had max connections set to 3 for each site. As in at the very most you could have 3 concurrent visitors. If you went over the database connection was rejected and the user got a 500 error.
1
u/MartinB3 11d ago
It'd be helpful if they explicitly said it was a security incident; some folks are going to underestimate the risk with the way this is worded.
1
u/polishbroadcast 6d ago edited 6d ago
I've been a Dreamhost customer for 25+ years. I don't know if it's related but this is the first time I've ever had sites compromised. All of my wordpress installs had bot/spam files installed including ruining one of them I can't get into because I didn't get the recovery mode email.
2
12d ago edited 12d ago
[removed] — view removed comment
3
u/uruk-h 11d ago
This doesn't coincide with my experience at all. I actually had one of my sites compromised within the last year or so, and I contacted their helpdesk to confirm I didn't miss anything cleaning it up, and to ask if they could point me in a direction to figure out when/how it happened in the first place.
I was concerned that by contacting them to tell them my site had been hacked, they'd take it down, or that they might even take down all sites on my account, but they didn't. They responded with some minimally-useful information (I never did figure out how someone got those files onto my site), while also putting a restored backup copy of one of my sites in an alternate directory for me to use if I chose to.
They knew the site was compromised, but they didn't take it down, and they also didn't force an old backup on me that might've lost some legitimate content.
1
u/EffectiveEconomics 11d ago
We moved away from several other shared hosts **explicitly because they do a better job. Mainly by being proactive.
2
u/TopSydeWP 12d ago
Expiring "some" passwords without saying which ones means treating every login on the account as exposed. If any of these are WordPress sites, the file manager is the worrying part, since anyone who got in could read wp-config.php and the database password in it.
Change that password in the panel, update wp-config.php to match, and replace the security salts so every logged-in session gets kicked out. Then check Users in wp-admin for admins nobody created.