# Email Server Hacked? My Fault or Softwares?



## Jared867 (Mar 25, 2011)

I have a website and I rent a dedicated server. My host has me on a unix box and he is running software called Blue Quartz. It is model 5102R 

My host has already admitted that this is old software (released in 2008) and that there are many vulnverabilities. 

Last night my site was attaciked. 

Someone found a way into the email server through a user account on my server. The account was set up in Blue Quartz.

Whoever got in, was using the mail server to try and send out 9700 emails per hour. 

My host is making it sound as if it was my fault because my user - username = Richard - had a common name and must not have had a hard password to crack. 

He said he stopped the attack by deleting the account richard. 

he is now charging me an extra 350 dollars because he said he needed to purchase the support of an outside source. 

What I want to know is if it this was really my fault or is it the old softwares fault?

Had my host been using a more modern piece of software to run my site would this hacker have not been able to do what he did?? Or was it REALLY my fault because I had a user with a common name who may or may not have had a password that was to easy to brute force? 

I believe that its the softwares fault, but I dont have enough information or knowledge in this area to express my thoughts and concerns to my host. 

I do have a contract... 

Id rather keep lawyers out of it... truth is I am friends with the host so Id rather not get messy... 

but if I can determine whether or not the dilapidated software is the reason this hacker got in and not simply because I had a weak username with a weak password (which by the way has been active for a couple years) then I feel I can argue the extra charge. I feel like I am paying for his error I just dont have any info to back that up and that is what I am hoping to find here... 


Please help me.


----------



## mcorton (Apr 16, 2009)

Read the contract carefully. I'd say that the old software played a huge role in the problem but it boils down to what is said in the contract.


----------



## Laxer (Dec 28, 2010)

the standard username shouldn't be a problem.
Brute forcing your password most likely isn't the problem, if it is:
It's most likely someone you know
Or on of your computers is infected, i would suggest scanning all computers you run on just to be safe.

I would agree with mcorton that it most likely may have been the program although its impossible to tell.

My question for you:

what type of audience does your website draw? it is unusually for an attacker just to attack an random site for fun. if you do any type of business someone might not like you and that type of thing.

Just another thought:

It is not your fault you had a week username and password. The host should have set standards you have to meet in order to make the account.


----------



## Jay_JWLH (Apr 30, 2008)

The way I see it, it could be a bit of both. A good software solution wouldn't allow so many brute force password attempts per amount of time. It may even provide you with an alert if an unusual amount of attempts are made in a short amount of time. That is what I think a software solution with good account security should do. But if you knew this wasn't a feature, then it is probably more to do with neglagince on your part for not practicing the use of lengthy complex passwords, neglegence on their part for not enforcing good password practices (depending on who manages the software for you), and changing them often enough considering what you are liable for. As for whether they had to act, and then charge you, that would certainly be part of the contract. Even seek legal advice if you need to.

The fact that the software is out of date might not have had much of a part in the matter, unless it has something to do with what I mentioned earlier. It might have contributed however if the vulnerabilities were the result of being out of date, and they are just lying to put you at fault, and they neglected to update the software.


----------

