Comments on: IX Web Hosting – Terrible Customer Service? – Part 2

By: DEE

DEE — Tue, 09 Feb 2010 07:03:15 +0000

Oh, and speed of upload and file manager is ridiculously slow.

By: DEE

DEE — Tue, 09 Feb 2010 06:48:52 +0000

Just wanted to add my two bob’sworth. I switched over to another host when my FTP pw was compromised. Of course, as with everyone else, it was MY FAULT. Needed a more difficult password, change it regularly. I had my suspicions. So get this: After switching hosts andbasically abandoning my IX account, I get an email yesterday advising my FTP pw was again compromised. It’s just weird, because I’m not using the account at all.

By: Nightrider

Nightrider — Wed, 01 Apr 2009 18:57:14 +0000

One of the nice things about IX servers is that there is no limit to the number of simultaneous connections to the server. Since I use SmartFtp to access the server, I can increase the number of workers uploading/downloading from the site, which greatly decreases the transfer times. Most hosts only allow up to 4 simultaneous connections at once, so this is an instance where IX excels over most other shared hosts that I deal with…

By: Erik

Erik — Wed, 01 Apr 2009 12:53:34 +0000

What are people seeing as far as FTP transfer speeds? Both down and up are much slower than I’ve experienced with other hosts.

Also, while all of my sites mysteriously had those *.php files in their root one day, I have not seen any ill effect on my sites. This may be because I’m on a Windows server (all of my sites are either .NET or static HTML).

I’ve been looking around in case I need to jump ship, and the best I’ve found (for us on the Microsoft side of the pond anyway) is Arvixe Web Hosting (http://www.arvixe.com). Anyone had any experience with them? They seem quite good – but I guess that’s what I thought of IX.

Erik

By: Nightrider

Nightrider — Wed, 01 Apr 2009 03:19:55 +0000

Jade, I offer tech support to hundreds of sites hosted with many different hosts. As a result, I am often asked to help whenever someone’s site gets hacked. This past year, all the attacks that I have helped to clean up seem to have been exclusively on IX Webhosting sites. I don’t know if this is a disgruntled employee or someone who has found a way to gain easy access to insecure IX servers or what, but it sure seems to be an IX problem either way…

Lately, I have been getting better service from IX Tech Support. Perhaps they have realized that I won’t tolerate their endless excuses and apologies and have decided the only way to get me off of their back is to actually fix something instead of passing the blame. My site seems to be running a lot more stable this last few weeks, knock on wood…

I have found ONE great techie employed at IX Webhosting named Arthur Riskal. If you are unfortunate enough to have to contact IX Tech support, hopefully Arthur Riskal will be the one who happens to help you. He solved several IX related problems on my site that all other IX support staff continued to try to blame on my code. Arthur went above and beyond the call of duty to uncover and fix these long term problems. Right now, he is the only Techie at IX Webhosting that I trust to really help out…

By: Brent Crouch

Brent Crouch — Tue, 31 Mar 2009 14:22:19 +0000

Jade – It is an IX Web issue. They have admitted as much. Your individual case may have been caused by a virus on your computer, but the hundreds of people reporting a problem with IX are due to problems with IX servers.

By: Jade

Jade — Thu, 26 Mar 2009 18:53:26 +0000

Hello everyone. Before you get too angry at IX I have to say that I’d never even heard of them until I got hacked. I’m a web designer and 3 sites I was working on got the injection code: on 3 different hosts on the same day at the same time! The thing is, other sites I have weren’t hacked. The one thing those 3 sites had in common was I had been working on them recently. 2 of the sites are on the same webhost, yet only the one I worked on the same week was hacked. There was only 1 common denomenator between the sites: me.

I originally thought it was my FTP program until I noticed the dozens of sites not compromised, but I hadn’t been working on them. I didn’t upload or even open my FTP program and they got injected a few days later. I changed passwords and so far haven’t been reaffected.

This tells me a couple of things:
1) It isn’t likely a server issue since something running on the server doesn’t need your login info. A password change wouldn’t matter
2) My usernames and passwords were “sent somewhere” from my machine (the only place all of them could have been gotten), but only when I accessed the sites.

I also had a virus the week this happened, and suspect whatever this is got on my machine and started monitoring FTP accesses. So if this is actually what’s happening, changing webhosts won’t solve it as you’ll still be FTP-ing from the same infected machine.

If someone has changed webhosts and hasn’t had the problem since without changing their home machine I’d like to hear about it. It is possible that all 3 web hosts were hacked at the same time, although I think it’s unlikely. Especially since I saw a blog describing the same thing I am. Google “tmp_lkojfghx” to see what I mean. That’s how I got here.

Jade

By: Nightrider

Nightrider — Thu, 26 Feb 2009 03:31:03 +0000

@Brent – when a hacker gains full access to your site, they can change the ownership of the files to prevent you from undoing what they did. I imagine that’s why you had so much trouble with the file. However, when you downloaded it to your PC, you should have had full access to the file. I don’t know of any reason why you wouldn’t…

Your site can be hacked even if you are doing everything correctly. As in the case with IX, I am fairly confident that the problem lies with the IX security. You can have the best secured site on the Internet, but if your Host’s servers are not secure, then your site security is worthless. You are at the mercy of your host’s security, so you really have to hope that they are on the ball too…

It’s not that difficult to write a utility that will allow you to upload a file from one server to another. If the destination folder permissions are set to 777, there is no impediment to uploading content to the folder. If file permissions are set to 666, there is nothing to prevent a hacker from writing to the file from one server to the next. If a hacker can upload a utility to a folder, then (s)he can use that utility to write to files and upload to folders where the permissions are set to 644 and 755. All they need to do is change permissions and make the changes. While they are at it, they can change ownership of everything to make it harder for you to undo what they have done…

And if you ever create a Virtual FTP Directory and give it full privileges, then that’s the same as opening up everything in that directory, including subfolders, to the world. So if you are forced to create a Virtual FTP Directory, when you are done using it, immediately delete it to resecure your site…

By: Brent Crouch

Brent Crouch — Wed, 25 Feb 2009 14:03:51 +0000

@Nightrider – Thanks for sharing. That’s good info.

One thing I’ve never understood. I’ve always heard leaving a folder as 777 would allow anyone to upload to it. But how do you upload without an FTP password?

By: Brent Crouch

Brent Crouch — Wed, 25 Feb 2009 13:59:39 +0000

I never got a warning when I visited the home page of the site either. However, someone changed my index.php file yesterday as well as uploaded an index.html file to another directory it didn’t belong into. I was able to sort all my files by date and then replace the files that were infected. Interesting thing, they files were somehow locked down. When I downloaded the infected file, I was unable to open on my laptop. I kept getting a message stating I needed to have admin access to view it. The account I use has admin privileges.

What is the most frustrating is figuring out how someone got access. I am using the most recent version of a popular shopping cart. All the folders are set to the correct permissions. It’s a real pain to figure out what happened. For now, I’m just going to monitor the file changes each day.