Blog: June 2007

Rocky Mountain Motorcycle Holidays Rolls Out

June 29, 2007

Get your motor running. Head out on the highway. Looking for adventure, and whatever comes our way.

We at Hop Studios specialize in media and non-profit sites, but that doesn’t mean we can’t stray from the beaten path once in a while. Our latest Web site launch, Rocky Mountain Motorcycle Holidays, was definitely a change—they run motorcycle tours—but still an excellent match for us.

First of all, the site required a lot of the things that a good media site needs:

items organized and categorized in a variety of ways but with a strong date component (check out the trip calendar, for example)
trip descriptions that tell a story, augmented by images and maps
tools that allow members to connect and share their experiences after the trip (coming soon!)

Secondly, and perhaps more important—RMMH needed a really elegant and effective design. They cater to people who are good motorcycle riders, and who are willing to pay a premium for a really top-notch, luxury motorcycle experience, and the site has to reflect the same care and level of service that their riders experience on tour. These potential riders, though, are also often not the tech-savvy online media-consuming audience, which took some special thinking about layout and design.

This project was another successful cooperation between Hop Studios and Work Industries, who handled the project management and content aspects of the project, while we provided the design and programming. The site itself is another wonderful Expression Engine installation, the use of which is going to make it extremely easy for the good folks at Rocky Mountain to update their site with new testimonials, new trips, and new motorcycles.

Now, if I only knew how to ride…

Posted by Travis Smith at 4:03 PM | Comments (0)

Dreamhost Got Hacked

June 6, 2007

Today, one of our clients received an email from Dreamhost about a major FTP hack that compromised many thousand sites.

Hello -

This email is regarding a potential security concern related to your FTP account.

We have detected what appears to be the exploit of a number of accounts belonging to DreamHost customers, and it appears that your account was one of those affected.

We’re still working to determine how this occurred, but it appears that a 3rd party found a way to obtain the password information associated with approximately 3,500 separate FTP accounts and has used that information to append data to the index files of customer sites using automated scripts (primarily for search engine optimization purposes).

Our records indicate that only roughly 20% of the accounts accessed - less than 0.15% of the total accounts that we host - actually had any changes made to them. Most accounts were untouched.

We ask that you do the following as soon as possible:

1. Immediately change your FTP password, as well as that of any other accounts that may share the same password. We recommend the use of passwords containing 8 or more random letters and numbers. You may change your FTP password from the web panel ("Users" section, “Manage Users” sub-section).

2. Review your hosted accounts/sites and ensure that nothing has been uploaded or changed that you did not do yourself. Many of the unauthorized logins did not result in changes at all (the intruder logged in, obtained a directory listing and quickly logged back out) but to be sure you should carefully review the full contents of your account.

Again, only about 20% of the exploited accounts showed any modifications, and of those the only known changes have been to site index documents (ie. `index.php’, `index.html’, etc - though we recommend looking for other changes as well).

It appears that the same intruder also attempted to gain direct access to our internal customer information database, but this was thwarted by protections we have in place to prevent such access. Similarly, we have seen no indication that the intruder accessed other customer account services such as email or MySQL databases.

In the last 24 hours we have made numerous significant behind-the- scenes changes to improve internal security, including the discovery and patching to prevent a handful of possible exploits.

We will, of course, continue to investigate the source of this particular security breach and keep customers apprised of what we find. Once we learn more, we will be sure to post updates as they become available to our status weblog:

http://www.dreamhoststatus.com/

Thank you for your patience. If you have any questions or concerns, please let us know.

- DreamHost Security Team

I feel bad for Dreamhost, and even worse for our clients who use it. Remember—always be vigilant about your site’s security, even if your Web host is as careful as a glass cat in a bowling ball factory.

Posted by Travis Smith at 11:44 AM | Comments (0)

Work	604.408.5722
	604.357.5001