If you used DreamHost's file manager, a hacker may have stolen your password and read your files

On October 23, DreamHost's online file manager stops responding. From that day on, the US web host blocks access to mailboxes and to FTP and SFTP accounts, which are used to upload a website's files, until each password is changed. It does not give a cause.

The explanation comes on October 29 in a DreamHost announcement, then in the letter sent to affected customers. The letter was filed with the California Attorney General and revealed on November 4 by BleepingComputer. An unauthorized third party exploited a flaw in the software running this file manager, at files.dreamhost.com. The attacker was thus able to access the FTP and SFTP usernames and passwords of people who logged in between roughly August and October 23. DreamHost calls it a deliberate attack.

Website files and emails may have been read

The hacker did not stop there. According to the letter, they also reached some web mail systems. They were able to see the session information, which keeps a user logged in, of a limited number of subscribers. DreamHost acknowledges that the content of emails and of files stored on its FTP and SFTP servers may have been viewed. The host says it found no trace of access to its control panel credentials or to billing data. It adds that it does not store full bank card numbers.

How many customers are affected? DreamHost gives no precise figure: in its October 29 announcement, it mentions a fraction of the mail and FTP/SFTP accounts it hosts, well below roughly 10%. BleepingComputer asked it several times, without a response. The software and the flaw exploited are not named either.

What to do if your site is hosted at DreamHost

The host says it cut off the attacker's access, fixed the flaw, closed open sessions and reset passwords. But an intruder who stayed for several weeks had time to drop a file or read a configuration. The steps to take:

• check your site's files for any unexpected change, such as an added script or an altered page, which DreamHost also recommends;
• check the forwarding rules and filters of each mailbox: a discreet redirect to an unknown address is a classic sign of intrusion;
• change the password of every service where you used the same one;
• review the secrets stored in your files, such as the database password in a WordPress site's configuration or API keys, and change them. The letter itself urges you to examine the content of files and emails to spot other accounts to monitor.

A web host concentrates the access credentials of thousands of sites, which makes it a prime target. In October, the host Railway also warned that API keys stored with it may have been read. At DreamHost, the investigation continues: the company promises to notify its customers if it discovers significant findings. The exact number of affected accounts remains the big unknown.