Anyone else been "compromised"?

Last month I was contacted by Plusnet and told my webspace had been compromised, to resolve it, and to come back to them with a plan to ensure it didn't happen again. I also spotted this post from someone else at the same time http://forum.webuser.co.uk/showthread.php?t=101881

Being the cynic I am (I've experienced 2 previous Plusnet compromises) I asked for copies of the logs so that I can see exactly how my files were modified (they were linking to malware infected sites).

I was told that Plusnet don't keep any logs.

So I'm in a position where I have to provide Plusnet with a plan explaining how I'm going to stop this happening again in future, but because they don't keep logs, I'm unable to ascertain how the compromise took place.

I think it's highly unlikely that Plusnet don't keep logs, because a) despite being a customer for over 20 years, I still get lied to any time I initially raise any issue (oh no, we've had no problems with that, no we don't traffic shape, no we've never applied throttling to port 25, yada yada yada no no no) and b) they've been compromised at least twice that I know of (that I've been affected by) and logs have always been available that have show exactly what happened after the issue was raised on a public forum.

So anyone else been told that their webspace has been compromised?

The reason they don't keep the logs is because there was an option to have the log files available (not sure if that is still available) and it's then your responsibility to download them from your ftp site if you want them kept. They rotate the files daily so there's only the last 6 or 7 days available.

Does Advanced Webstats appear in https://portal.plus.net/my.html?action=mywebsite&?me... for you?

Edited by jelv (Wed 29-Feb-12 18:38:59)

Yes it does, but it isn't activated. Does this have details of FTP access to my website?

Why do you need details of FTP access? Surely the compromise will have happened via http.

I imagine a decent .htaccess file would be a good start. Also double checking the file and folder permissions and ensuring they are 644 or 755 or whatever is suitable for their purpose. Filezilla shows the file and folder permissions.

@ Jelv - Why surely?

@ Camie - Directory permissions are 755, and all files are 644

@ Both, the point I'm making, is that all the .html files in my website were amended last month, and were redirecting to A N Other site. If the logs show no FTP access, then as far as I'm concerned, Plusnet's web server has been compromised, and in turn, they should be the ones that are giving me a plan for how they intend to resolve the issue, and not vice versa. My website contains no PHP or database. It's a plain old html website.

Have you ever changed the password to something fairly uncrackable? Like 62 characters mixed upper/lower/numeric, and any special characters allowed?

The password was as complex as Plusnet would allow me to be at the time when I created it.

Either way, a brute force attack would show up in FTP logs.

How it is your responsibility if plusnets system has been compromised?

That's my point.