[Dynamo]

Dear Members,

This has been a very difficult decision to make.  Post4VPS has been around for 70 Giveaways and during the course of all this time, we have bonded into a great community.  When post4vps.com was first created in August 2015 I was very proud of the achievement.  I never thought it would turn out as successful as it had at the time.  Especially in the beginning, the Forum was very active with many active sponsors as well.

Unfortunately, times have changed for hosting forums as everyone is well aware off.  I was planning to continue for a little while longer with our new-look theme.  However, during the process of being much closer to all of the files, I made a shocking discovery that our Forum had been compromised as far back as before February 2018.  I discovered an exploit with the dbkiss.php  that didn't belong. Then more files as I was searching deeper. This has been a great and most unacceptable shock to me as of course how can our members have trust in the Forum now? How can I have trust in the Forum ever again.  The Forum has been irretrievably compromised.  I've learned that even if we were to clean up the files that look like exploit files, we'll never really know whether the Forum will be clean again.  Also if we should restart the Forum database clean and from scratch, with the few members we have presently it wouldn't justify the expense. 

I've therefore come to the most difficult decision to close the Forum with the effect of 1st of August.  VPS Holders will have until the 1st of August to empty their VPSs that will be handed back to the sponsors.
Also, New user registrations are disabled.


As far as immediate remedies are concerned.  We have completely and permanently deleted all of the VPS Requests with personal info in them.  We have also closed and disabled the Request Forum for now.  As well as changed all of the passwords where passwords have been used.  We strongly urge our members to do the same with their passwords for the Forum and VPS as long as you will still be using them.

To say that I'm sorry to end the Forum is a great understatement.  It is and was very important to me, and I so much looked forward to continuing with the new-look, and expanding the forum furthermore.  But unfortunately with the hacking that has been discovered, even with three years ago, I think the Forum has been compromised too much for us to be able to continue with it.

I would like to thank all our past and present sponsors for backing the forum. Also All Forum staff for keeping the forum so user friendly, specially @deanhills for organizing the giveaways flawlessly and Lastly all the members for participating actively in the discussions, It means alot.

Please receive my humble appreciation for all of your support during the years.  I will certainly miss it very much.  I hope we won't lose touch and if you should have time to say hello, please feel welcome to find us at the Discord Forum.
Invite link: https://discord.gg/V8fe2tCExP



Kind Regards,

[deanhills]

Real sad news indeed @Dynamo. But I can understand where this is coming from. Thank you for the many years of top quality VPSs I enjoyed. Particularly Virmach VPS 9. I'm definitely going to miss the Forum as well as the VPS very much.

Also thank you to all of the members. We've been together for such a long time. It's going to be quite an adjustment for me for sure to be without Post4VPS.

[tiwil]

What an announcement to start a day hahaha. So sad to see Post4VPS ends here, we absolutely don't expect this to happen since all of us is steady, maybe a little bit d own at member count but still steady.

I absolutely don't want Post4VPS to go down though. Well, I guess, since it's not about sponsor problem then I guess in near time there will be someone to open new forum like this that acquire some of Post4VPS's sponsor.

Time to start sparing some money to buy VPS

[Mashiro]

It's been great to be here. Farewell Post4VPS.

All the best to everyone.

Bon voyage, and best of luck in your future endeavors.

[fChk]

This was totally unexpected!.. But deep-down not surprising if you remember this quote:

My rule was always to never depend on any 3rd-party software in anything. Principle that I also apply on the Web, where I never use any generic framework, WebApps or even Libraries (except for a select few!) When you need something, just Do It Yourself!.. Some may think of it as a 'rediscovering the wheel' kind of thing, but I think of it as a way of building a sound expertise.

Excerpt from https://post4vps.com/Thread-VPS-Manageme...1#pid35851

Using open-source WebApps (forums, CMS etc...) has always a serious security risk to it.. The reason being that there is always someone else that knows your WebApp's internals better than you do yourself.. hence  the constant security threat and the constant feeling of always being one step away of being hacked someway.. someday.. The solution has always been to constantly audit your WebApp and its setup.

Alas the reality of things has always been that one's vigilance fades away with time and the WeApp becomes pray to whoever bothers to try to compromise it !...

Back to the sad news.
Of course I'm not aware of the severity of the P4V hack; not enough input on that. But because the hack was so old and there is no complaint from any user from any visible annoyance of any kind --especially from the leak of private data...--, I'm a bit perplexed as to the quick decision to just pack up things and close the forum!!..

I would have hoped at least that @Dynamo gave us the full account of what exactly happened to P4V--ie how deep was the exploit.. and why he deemed necessary to just close the forum instead of purging P4V assets from the compromising exploits. This disclosure may also serve as a lesson to(/educate) everybody else using MyBB.

Anyway, glad to have been part of the community for awhile and wish everybody a happy continuation..

-fouadChk

[Dynamo]

Of course I'm not aware of the severity of the P4V hack; not enough input on that. But because the hack was so old and there is no complaint from any user from any visible annoyance of any kind --especially from the leak of private data...--, I'm a bit perplexed as to the quick decision to just pack up things and close the forum!!..

I would have hoped at least that @Dynamo gave us the full account of what exactly happened to P4V--ie how deep was the exploit.. and why he deemed necessary to just close the forum instead of purging P4V assets from the compromising exploits. This disclosure may also serve as a lesson to(/educate) everybody else using MyBB.

As I had written in the first post, while updating the forum, I came across a file named dbkiss.php on googling found out that it was a script to control the database(though the one used here was made for an older version of php). After which I further started to search more came across a script that might be used to gain ssh access upon examining the modification dates and backups it looks like it was there since 2018, not really sure exactly which vulnerability the attacker used. It is not vise to just delete those files and forget about it, since there might be more such files already planted, or even worse, there might be some XSS scripts loaded in the database ready to be exploited in the future.

It happened most probably due to MyBB and plugins not being up to date from time to time.

[sagher]

It is just heart breaking for me because i learn almost everything about linux at this platform and even i don't have any alternate for it. so i wish @Dynamo will back soon with new Forum and great ideas soon.
I have no words to express my feelings...... It's SAD.

[Littlemaster]

Its a shocker, always this was a trusted platform for those developers who wanted a server for his work. Sad to see that post4vps will be leaving. Thanks for your nice services. We will miss it. I do not have a discord as it always hang my phone. I may be missing you all in the future. Soon comes the time to bid farewell. Nice to have met many of you, may be we will meet in any other platform.

About the dbkiss.php, it seems a database control script, I hope it was not uploaded by any admins to control the sql server through web. I think mybb has some hash to encode the passwords, isn't the passwords are encrypted safely? If the hacker hacked database data, then I think the issue will be with the vps passwords shared through threads as plain text. Between deleting threads seems no enough, in case the hacker hacked the data, the hacker could have taken all details already or may have a back up. I think vps owners should have a way to replace the passwords of their VPS panels, otherwise they could not change and hacker will have all working passwords.

[tiwil]

About the dbkiss.php, it seems a database control script, I hope it was not uploaded by any admins to control the sql server through web. I think mybb has some hash to encode the passwords, isn't the passwords are encrypted safely? If the hacker hacked database data, then I think the issue will be with the vps passwords shared through threads as plain text. Between deleting threads seems no enough, in case the hacker hacked the data the hacker could have taken all details all ready or may have a back up. I think vps owners should have a way to replace the passwords of their VPS panels, otherwise they could not change and hacker will have all working passwords.

I guess if it's about VPS password then Post4VPS is not wrong here since admin always ask us to change our password upon receiving the VPS. There may be possible issue where hacker create account with sudo permission but, well, I'm safe here since I always reset the server when receiving the VPS.

[LightDestory]

It has been an amazing journey inside this community and it is so sad to see it go down.

I understand the point of view of @Dynamo and I am on a neutral position regarding its decision.

I wish you all your best for your next projects!

Thanks to:
@Dynamo, he created this amazing community
@deanhills, he was my pillar regarding support
@Mashiro, he helped me learning some nice stuff
and of course all the community!