Paycom Clients Change your FTP Passwords!!! - GoFuckYourself.com

aico · 06-22-2006, 10:23 PM

I have just been informed by my server company (reflected.net) that they have found the source of how I, and other clients of theirs, that apparently Paycom has been hacked and they got my FTP passwords from them, which is how they fucked with my and many other peoples sites lately.

Discuss...

Pron Don · 06-22-2006, 10:25 PM

very very shitty

artman · 06-22-2006, 10:27 PM

that's fucked

aico · 06-22-2006, 10:27 PM

*how I, and several of their other clients, got hacked (sorry got sidetracked mid-sentence).

aico · 06-22-2006, 10:30 PM

Ok, I may have jumped the gun, they are not sure it was Paycom, they are still looking into it... my bad. Will let you know more as I do.

marketsmart · 06-22-2006, 10:36 PM

sounds to me like your host needs to lock down your server... if its just ftp issues have them make ftp restricted to ip's.....

Phil21 · 06-22-2006, 10:43 PM

Just thought I'd interject here..

We've been tracking an issue a few other hosts have been looking into over the past weeks or so. The common thread essentially is a one-shot successful login to a valid FTP account (e.g. no password guessing, etc.), and adding of some malicious code containing an iframe to various html and php pages.

Currently, at least with our customer base, it appears an external third party may have had a password database compromised. Paycom is just one of a few sources this data could be from, and in Aiko's case that was one biller used. Some unfortunate language was used by an technician in the ticket response, which made it look like we were certain of the source.

The other possibility is a backdoor of some sort (like spyware) going around that may look into FTP software saved passwords.

Anyways, as we know more we will dispense info on to our clients. A good practice for most everyone would be to change any FTP or other account passwords you have given out to any third parties immediately. Also as someone mentioned, if you have the ability to know where you'll always be FTP'ing from, firewalling off everything else provides a good level of protection from leaks such as these in the future.

-Phil

WiredGuy · 06-22-2006, 10:48 PM

I have a feeling if the source was the processor, there would be a lot more clients who were compomised.
WG

CaptainHowdy · 06-23-2006, 12:26 AM

Holy crappers, that's bad...

Choppa · 06-23-2006, 12:38 AM

hmmmm not good at all

gooddomains · 06-23-2006, 12:40 AM

that's not good news

V_RocKs · 06-23-2006, 01:47 AM

Doesn't mean Paycom was hacked... Could mean you are leaving the info open or the FTP software itself is hackable.

06-22-2006, 10:23 PM	#1
aico Moo Moo Cow Join Date: Mar 2004 Location: Washington State Posts: 14,748	Paycom Clients Change your FTP Passwords!!! I have just been informed by my server company (reflected.net) that they have found the source of how I, and other clients of theirs, that apparently Paycom has been hacked and they got my FTP passwords from them, which is how they fucked with my and many other peoples sites lately. Discuss...

06-22-2006, 10:25 PM	#2
Pron Don Internet Entrepeneur Join Date: Jun 2006 Posts: 572	very very shitty __________________ Sig currently being donated to science. don of pron at gmail dot com

06-22-2006, 10:27 PM	#3
artman Confirmed User Join Date: Nov 2005 Posts: 770	that's fucked __________________

06-22-2006, 10:43 PM	#7
Phil21 Confirmed User Join Date: May 2001 Location: ICQ: 25285313 Posts: 993	Just thought I'd interject here.. We've been tracking an issue a few other hosts have been looking into over the past weeks or so. The common thread essentially is a one-shot successful login to a valid FTP account (e.g. no password guessing, etc.), and adding of some malicious code containing an iframe to various html and php pages. Currently, at least with our customer base, it appears an external third party may have had a password database compromised. Paycom is just one of a few sources this data could be from, and in Aiko's case that was one biller used. Some unfortunate language was used by an technician in the ticket response, which made it look like we were certain of the source. The other possibility is a backdoor of some sort (like spyware) going around that may look into FTP software saved passwords. Anyways, as we know more we will dispense info on to our clients. A good practice for most everyone would be to change any FTP or other account passwords you have given out to any third parties immediately. Also as someone mentioned, if you have the ability to know where you'll always be FTP'ing from, firewalling off everything else provides a good level of protection from leaks such as these in the future. -Phil __________________ Quality affordable hosting.

06-22-2006, 10:48 PM	#8
WiredGuy Pounding Googlebot Industry Role: Join Date: Aug 2002 Location: Canada Posts: 34,486	I have a feeling if the source was the processor, there would be a lot more clients who were compomised. WG __________________ I play with Google.

06-22-2006, 10:30 PM	#5
aico Moo Moo Cow Join Date: Mar 2004 Location: Washington State Posts: 14,748	Ok, I may have jumped the gun, they are not sure it was Paycom, they are still looking into it... my bad. Will let you know more as I do.

06-22-2006, 10:36 PM	#6
marketsmart HOMICIDAL TROLL KILLER Industry Role: Join Date: Dec 2004 Location: Sunnybrook Institution for the Criminally Insane Posts: 20,419	sounds to me like your host needs to lock down your server... if its just ftp issues have them make ftp restricted to ip's.....

06-23-2006, 12:26 AM	#9
CaptainHowdy Too lazy to set a custom title Industry Role: Join Date: Dec 2004 Location: Happy in the dark. Posts: 93,591	Holy crappers, that's bad... __________________ Sig Coming Soon

06-23-2006, 12:38 AM	#10
Choppa Confirmed User Join Date: Mar 2006 Location: Webmasters send sexyads.com your dating traffic and live the webmaster dream!! sexyads.com = $$$$$$$$$$ Sexyads adult personals at their greatest since 1997 Earn $$$$$$ today and become one of the thousands of Sexyads Affiliates Posts: 4,079	hmmmm not good at all __________________ SexyAds: 10 years in business and still going strong. Become an affiliate today! Choppas ICQ: 283 090 747 Want to know more? [email protected]

06-23-2006, 12:40 AM	#11
gooddomains Too lazy to set a custom title Join Date: Jul 2003 Location: Netherlands Posts: 10,127	that's not good news

06-23-2006, 01:47 AM	#12
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,409	Doesn't mean Paycom was hacked... Could mean you are leaving the info open or the FTP software itself is hackable.