DreamHost, a major website hosting provider, exposed 814 million user account records in an unsecured database, researchers at Website Planet have found. The data exposed included a wealth of information about WordPress accounts that used DreamHost’s services, such as “WordPress login location URL, first and last names, email addresses, usernames, roles (admin, editor, registered user, etc),” and other information.
DreamHost quickly secured the database after being notified, but Website Planet warns users to be on the lookout for spear phishing attacks.
“The danger of these emails being exposed would be for cyber criminals to launch a targeted attack based on the domain, account, or other information that only the hosting provider or website admin would know,” the researchers write. “We saw records that listed how many administrative accounts or users were associated and listed them all with timestamps of when they were added. DreamHost has a good reputation of protecting their customers from domain hijacking or domain theft and offers domain privacy for free. This exposure appears to contain only information connected to their DreamPress managed WordPress users and not their hosting or domain customers.”
The researchers add that while the database didn’t expose passwords, it still made it much easier for potential attackers to launch social engineering attacks.
“The way the records were structured they identified the URL or website domain name and the user’s role such as: admin, editor, subscriber, etc.,” the researchers write. “This information would provide a clear picture of the hierarchy and who may be the best potential phishing or social engineering target based on their roles. The danger of having even partial administrative credentials exposed is that it removes half of the work required to access an account. Once a cyber criminal has the username, email address, and location of the WordPress admin dashboard, the only thing left is to get the password. Social Engineering is the easiest way to build a position of trust and try multiple methods to trick the victim to provide their password.”
New-school security awareness training can enable your employees to thwart targeted social engineering attacks.
Website Planet has the story.
