Quote:
Originally posted by doober
like fuckig crazy in the past 24hrs
wtf is going on?
|
Something is messed up.
They are not being brute forced. No one is running a bot against your sites trying to guess combos.
They are not username/passwords taken from a wordlist
These are username/passwords that were:
A: sniffed, as your browser passes them in plain text. I am not a nerd, but I believe someone would have to be sniffing packets on the subnet your server is on in order to do this. (highly unlikely)
B: Verotel has some naughty employees (possible, but doubtful)
C: Their servers have been hacked, or backdoored (my guess)
Thing is, the usernames and passwords are of paying, legit customers. They haven't been added to your password file by an exploit of the verotel scripts on your server. And it isn't a few here and there. It is every username/password that Verotel has in your password file.
The odds of that many un/pw combos being brute forced, guessed, or sniffed are nil. These usernames/passwords are being leaked from Verotel's end.
Wutz up, Verotel? Care to come clean on this?