Ok so I'm really starting to get quite annoyed with BluDomain now...
For my day job I work as a computer security bod. Recently I bough a bludomain site and obviously I gave it (and the hosting) a bit of a look from a security point of view. I found quite a few issues, probably the most serious of which allows anybody on the same server as me to replace any of my photos. I obviously haven't been able to check other users but I'm guessing it also means that I can replace any other users photos on my bludomain server. The server I am on contains 200 different users some of the quite big names that people would recognize.
Obviously I immediately contacted bludomain after chatting to Lisa on live chat. It's now been about a month, I've emailed Lisa, 911, info and postmaster at bludomain and I have yet to ever get a response! I'm starting to find it really alarming and in my latest email I've notified them that if they don't respond then I'm going to have to go public. I really don't want to do this but they seem to be leaving me no choice.
My advice? If you're with bludomain get off their hosting as fast as you can. I really can't believe that blu is being this bad and exposing all of it's customers to getting hacked and having their photos replaced.
Here's a quick guide with how I managed to remove my site from blu's hosting:
1. Login to bludomain host admin console (the one you got when you requested a go live)
2. Download the backups of your site and the SQL database
3. Upload the backup of the site to your new host and extract it into the web directory
4. Import the SQL database backup into your new hosts SQL database
5. Edit /bluadmin/flash/blu.php with your new database settings
6. edit /etc/php5/apache2/php.ini with bludomains hosting requirements (these are on the bludomain site, you might not need all of them so I would turn them on one by one)
7. chmod /v1siteimages to allow the users that runs apache to write files (be careful with this if your new host is a shared one...)
Voila, your bludomain site should now work on your new host. If you have any problems with this let me know and I might be able to help.
Great find right there...and I don't blame you at all. People need to know this as a lot of peoples livelyhood is in their site.
For those that are hosted with blu and want a reputable hosting for a great price and great security take a look at gatorhost.com
I do a lot of web developement on the side and I have all my clients hosted over there and there is zero downtime since I've been dealing with them. Great thing is they are ranked #2 hosting on the web as well...and get this....you can get a domain name and your hosting account for under $80 for the whole year.
This is not a plug for Gator Host as I am NOT affiliated with them in any way...just want to share a great deal.
So let me get this straight...I'm on a shared server with other photographers who also paid for their sites and hosting packages,and there is a chance that one of the photographers may hack into my site and replace my pictures? Are there rogue photographers on the loose out there looking to buy BluDomain sites for the sole purpose of invading other photographer's websites?
Think that has ever actually happened? Do you think there is the slightest chance you may be overreacting to something that while plausible, isn't really a problem?
Mattbtn wrote:
So let me get this straight...I'm on a shared server with other photographers who also paid for their sites and hosting packages,and there is a chance that one of the photographers may hack into my site and replace my pictures? Are there rogue photographers on the loose out there looking to buy BluDomain sites for the sole purpose of invading other photographer's websites?
Think that has ever actually happened? Do you think there is the slightest chance you may be overreacting to something that while plausible, isn't really a problem?
Well what it means is that if any of those photographers has a guessable password, if somebody is able to brute force their password (bludomain passwords are only 5 digit numeric passwords by default giving a maximum of 100000 combinations - quite bruteforcable), if anybody is able to sniff their password (blu's admin login isn't over SSL so if they login at, say a public wifi point this is very possible) or if they are just plain nasty then it's you that can get hosed.
As a fellow security administrator for a large county government's HR/Payroll system that has to be accessible internally as well as externally, security is of course a BIG deal. A five digit password is ridiculous, regardless whether or not there is the slightest chance that a fellow photographer would want to hack into someone else’s site. If it's easy enough, somebody will try. Five digits could be as simple as a zip code or house number…easily obtainable information. People don’t give much thought to passwords, other than how easy is it to remember.
I fixed this very easily by using BluDomain on my own server. It took a little longer for them to set it up, but I certainly don't have to worry about it.
Just to update you all on this, finally got this from bludomain a month ago:
"> the permissions of the image and music directories are set to 777 in
> order to allow files to be uploaded via the php-based web admin. we
> haven't found a way around that yet."
I instantly emailed them back specifying a fix to the problem. Guess what? A month later and still no reply. I really have to recommend that anybody hosting with blu switches. I can't believe how bad they've been about this. I recently saw a post on DWF about another member getting hacked and having his email address changed. I hate to think what other security bugs there are in the site however they obfuscate the code and have large notices threatening anybody reverse engineering.
This is kind of disconcerting...I just ordered a Blu with hosting on monday...I can't imagine there's a huge cause of concern for me (yet?), I'm not hosting any unwatermarked images or client data on Blu, I have my own secured hosts for that and my galleries are securely on SmugMug. I'm a little weary about it now that I'm thinking more about it, but I've had to pay the mandatory $100 for hosting anyways, it would've cost $100 to have them port it to my server...I dont know...
I just signed up on Tuesday, I'm only going to be hosting the site so I'm not too worried. I'm keeping zenfolio for client galleries and I host my own email server.
Sam Obeid wrote:
I just signed up on Tuesday, I'm only going to be hosting the site so I'm not too worried. I'm keeping zenfolio for client galleries and I host my own email server.
While this will keep you mostly protected, what would happen if I replaced all of the images on your site with illegal or inappropriate ones? The consequences to a photographers reputation and the possibility of legal action would have me worried.
Who do you all recommend for hosting the site? I was hoping to host through Blu, but I can see that might not be a good idea. But I don't really feel like spending another $100. Ideas?
Realmstalker wrote:
I host through 1and1.com. They have great business packages that start at about $10/mo. Been using them for over 4 years with no complaints
X2. 1and1 rocks...I've got three sites through them, and I'm nothing but happy with them. Way more features than you'd expect for the money.
I just had a wonderful tech support call with BluDomain. I too am an I.T. professional and I actually contacted them to point a problem out with their hosting company THEY use and an SSL certificate. The person I talked to who will remain nameless thought I was asking for an additional service and was going to charge me, then got defensive and would not listen to me WHEN ALL I WAS TRYING TO DO WAS HELP THEM!!!!
So as of right now, they have a problem with the SMTP server but will not even call THEIR hosting company to fix because I pissed them off.
I would love to start a new thread in a few days with the complete text of the support call to show how rediculous they acted, but will not do so for a few days to actually see if they call their hosting company to get the issue fixed.
other than this trainwreck, I love BluDomain and have 2 templates with them and also gotten 6 friends or collegues to purchase and host through them, and would in the future. I just have to warn them that they know more than you no matter who you are and what you do and will just close a support call because they are "tired" of you!
oh, I forgot to mention, after they add you to the "clients launched" page, look out. I had someone from India (or proxy through an I.P. located in India) hack a side site I had and stole a bunch of photographs of my son. It was my own fault because I should have locked it down, so it is not BluDomain's fault, but their "client's launched" page is a target for stock photography companies to raid.
I should also say that I offered this person to do a webex on MY DIME so that I could show them the error, but this person said "I don't do webex, so your request is closed." Great customer service!
BluDomain also used the same password on my site 4 or 5 times when I requested support. They would change the login so they could work on it, and every time it was the same password and I had to change it back to my normal one even though I requested to have it set. So, if they use this password for everyone, hacking the site is A PIECE OF CAKE.
Other notes on their support. You cannot respond via email, you have to log into the link in the email to edit the call. So if you are on the go, you need to find a machine to login to the support link and edit, or try and few a website on your little itty bitty phone screen.
Second, if you are having an issue and need to upload a file to their support, there is no option to upload a file. Since you cannot email their support, there is really no way to get a file to them unless they ask.
I hate to think what other security bugs there are in the site however they obfuscate the code and have large notices threatening anybody reverse engineering.