a discussion related to this<\/a>.<\/p>\nWe decided a few hours ago to proactively fix this inside ALL\u00a0machines running Kloxo<\/strong>:<\/p>\n\n- identify offending script that was uploaded and
chmod 0<\/code> the directory<\/li>\n- stop the kloxo daemon<\/li>\n
- email each and every (!) customer about this exploit and explaining the actions we took<\/li>\n<\/ul>\n
Ionut and Ovidiu have just completed these steps and we managed to stop this pest, for now<\/strong>.<\/p>\nWe don’t normally run commands inside customers’ virtual machines, but we decided that it’s the best action we can take in the interest of everyone involved. And by everyone, I mean everyone: compromised machine’s owner, other IntoVPS customers, IntoVPS employees and stakeholders, internet community.<\/p>\n
Here’s the email we’ve sent:<\/p>\n
Subject:<\/b>\u00a0IntoVPS – Kloxo installation compromised for server<\/p>\n
Hello,<\/p>\n
You are receiving this notification because you are running Kloxo panel management on your VPS named XXXXXXX<\/strong>.<\/p>\nIt seems that\u00a0Kloxo\u00a0installations are compromised with a randomly-named PHP file placed into \/home\/kloxo\/httpd\/default\/, which is the ‘default’ site accessible by IP address and that\u00a0kloxo\u00a0appear to be spawning a large number of httpd processes. Further investigation shows they’re all sending out volumes of traffic as part of a ddos.<\/p>\n
Here is an example of a compromised file uploaded in \/home\/kloxo\/httpd\/default: http:\/\/disclosed.info\/?7c12a1a4560b7664#5fpnfdknf4EfBcGqLjeV9\/vAY1RXEKkLC3+fqm16c6E=<\/p>\n
At this moment there isn’t any fix published for Kloxo and as a workaround for this particular issue, we are going to change the permission of that folder to 0 with the following command:<\/p>\n
chmod 0 \/home\/kloxo\/httpd\/default\/
\nchmod 0 \/home\/admin\/*\/cgi-bin<\/p>\n
Also is it better for now to stop kloxo daemon until a proper fix is released.<\/p>\n
\/etc\/init.d\/kloxo stop<\/p>\n
We also noticed the same particular file being uploaded in the cgi-bin folders of the website managed by admin users. I strongly advice to check this as well and remove or change permission of those files that contains the same patern as soon as possible.<\/p>\n
If you have any questions, please let us know.<\/p>\n
Best regards,
\nIntoVPS Support<\/p>\n
<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"
Today we started to see our packet counter monitors triggering all over the place. At a closer look we’ve noticed a common pattern: scripts flooding from customers’ virtual machines running Kloxo. A zero-day exploit has been identified in Kloxo control panel today. Here’s\u00a0a discussion related to this. We decided a few hours ago to proactively […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-393","post","type-post","status-publish","format-standard","hentry","category-intovps"],"yoast_head":"\n
Kloxo zero-day exploit » IntoVPS Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kloxo zero-day exploit » IntoVPS Blog\" \/>\n<meta property=\"og:description\" content=\"Today we started to see our packet counter monitors triggering all over the place. At a closer look we’ve noticed a common pattern: scripts flooding from customers’ virtual machines running Kloxo. A zero-day exploit has been identified in Kloxo control panel today. Here’s\u00a0a discussion related to this. We decided a few hours ago to proactively […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\" \/>\n<meta property=\"og:site_name\" content=\"IntoVPS Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/intovps\" \/>\n<meta property=\"article:published_time\" content=\"2014-01-28T22:06:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-04-11T08:32:31+00:00\" \/>\n<meta name=\"author\" content=\"Adrian Andreias\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@intovps\" \/>\n<meta name=\"twitter:site\" content=\"@intovps\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Adrian Andreias\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\"},\"author\":{\"name\":\"Adrian Andreias\",\"@id\":\"https:\/\/intovps.com\/blog\/#\/schema\/person\/d46c8f5d25b5a8b009c50c0c4f887460\"},\"headline\":\"Kloxo zero-day exploit\",\"datePublished\":\"2014-01-28T22:06:32+00:00\",\"dateModified\":\"2014-04-11T08:32:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\"},\"wordCount\":399,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/intovps.com\/blog\/#organization\"},\"articleSection\":[\"IntoVPS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\",\"url\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\",\"name\":\"Kloxo zero-day exploit » IntoVPS Blog\",\"isPartOf\":{\"@id\":\"https:\/\/intovps.com\/blog\/#website\"},\"datePublished\":\"2014-01-28T22:06:32+00:00\",\"dateModified\":\"2014-04-11T08:32:31+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/intovps.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kloxo zero-day exploit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/intovps.com\/blog\/#website\",\"url\":\"https:\/\/intovps.com\/blog\/\",\"name\":\"IntoVPS Blog\",\"description\":\"VPS Hosting\",\"publisher\":{\"@id\":\"https:\/\/intovps.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/intovps.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/intovps.com\/blog\/#organization\",\"name\":\"IntoVPS\",\"url\":\"https:\/\/intovps.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/intovps.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/intovps.com\/blog\/wp-content\/uploads\/2021\/04\/intovps-avatar.png\",\"contentUrl\":\"https:\/\/intovps.com\/blog\/wp-content\/uploads\/2021\/04\/intovps-avatar.png\",\"width\":1563,\"height\":1563,\"caption\":\"IntoVPS\"},\"image\":{\"@id\":\"https:\/\/intovps.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/facebook.com\/intovps\",\"https:\/\/x.com\/intovps\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/intovps.com\/blog\/#\/schema\/person\/d46c8f5d25b5a8b009c50c0c4f887460\",\"name\":\"Adrian Andreias\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/intovps.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f7a673269de3c425576541624530ca9c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f7a673269de3c425576541624530ca9c?s=96&d=mm&r=g\",\"caption\":\"Adrian Andreias\"},\"sameAs\":[\"https:\/\/www.intovps.com\"],\"url\":\"https:\/\/intovps.com\/blog\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Kloxo zero-day exploit » IntoVPS Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/","og_locale":"en_US","og_type":"article","og_title":"Kloxo zero-day exploit » IntoVPS Blog","og_description":"Today we started to see our packet counter monitors triggering all over the place. At a closer look we’ve noticed a common pattern: scripts flooding from customers’ virtual machines running Kloxo. A zero-day exploit has been identified in Kloxo control panel today. Here’s\u00a0a discussion related to this. We decided a few hours ago to proactively […]","og_url":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/","og_site_name":"IntoVPS Blog","article_publisher":"https:\/\/facebook.com\/intovps","article_published_time":"2014-01-28T22:06:32+00:00","article_modified_time":"2014-04-11T08:32:31+00:00","author":"Adrian Andreias","twitter_card":"summary_large_image","twitter_creator":"@intovps","twitter_site":"@intovps","twitter_misc":{"Written by":"Adrian Andreias","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#article","isPartOf":{"@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/"},"author":{"name":"Adrian Andreias","@id":"https:\/\/intovps.com\/blog\/#\/schema\/person\/d46c8f5d25b5a8b009c50c0c4f887460"},"headline":"Kloxo zero-day exploit","datePublished":"2014-01-28T22:06:32+00:00","dateModified":"2014-04-11T08:32:31+00:00","mainEntityOfPage":{"@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/"},"wordCount":399,"commentCount":0,"publisher":{"@id":"https:\/\/intovps.com\/blog\/#organization"},"articleSection":["IntoVPS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/","url":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/","name":"Kloxo zero-day exploit » IntoVPS Blog","isPartOf":{"@id":"https:\/\/intovps.com\/blog\/#website"},"datePublished":"2014-01-28T22:06:32+00:00","dateModified":"2014-04-11T08:32:31+00:00","breadcrumb":{"@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/intovps.com\/blog\/2014\/01\/28\/kloxo-zero-day-exploit\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/intovps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kloxo zero-day exploit"}]},{"@type":"WebSite","@id":"https:\/\/intovps.com\/blog\/#website","url":"https:\/\/intovps.com\/blog\/","name":"IntoVPS Blog","description":"VPS Hosting","publisher":{"@id":"https:\/\/intovps.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/intovps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/intovps.com\/blog\/#organization","name":"IntoVPS","url":"https:\/\/intovps.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/intovps.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/intovps.com\/blog\/wp-content\/uploads\/2021\/04\/intovps-avatar.png","contentUrl":"https:\/\/intovps.com\/blog\/wp-content\/uploads\/2021\/04\/intovps-avatar.png","width":1563,"height":1563,"caption":"IntoVPS"},"image":{"@id":"https:\/\/intovps.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/intovps","https:\/\/x.com\/intovps"]},{"@type":"Person","@id":"https:\/\/intovps.com\/blog\/#\/schema\/person\/d46c8f5d25b5a8b009c50c0c4f887460","name":"Adrian Andreias","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/intovps.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f7a673269de3c425576541624530ca9c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f7a673269de3c425576541624530ca9c?s=96&d=mm&r=g","caption":"Adrian Andreias"},"sameAs":["https:\/\/www.intovps.com"],"url":"https:\/\/intovps.com\/blog\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/posts\/393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/comments?post=393"}],"version-history":[{"count":13,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/posts\/393\/revisions"}],"predecessor-version":[{"id":406,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/posts\/393\/revisions\/406"}],"wp:attachment":[{"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/media?parent=393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/categories?post=393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/intovps.com\/blog\/wp-json\/wp\/v2\/tags?post=393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}