Bluehost = Jokey joke town.

I finally caught a bunch of shell access attempts and reported them. Same worthless responses from a ‘Computers for Dummies’ dropout. So I captured the logs and did my duty- reported it via Live Support, via many help tickets, etc.

End result? After 2 days, the hacker brute forced through BH’s shell access and replaced the homepage with a different index.html and index.html.1 files.

I was pleading for access to server logs that show more than just generic stuff. I am a CISSP and could easily track the items and fix the problem- if I had access to the info (logs).

So remember me. It’s the 10 yr anniversary of 9/11 and everyone is on alert for cyber attacks- except BlueHost it seems. And when the compromise hits the press, I’ll step forward with the logs and tickets and chat transcripts showing I warned them and tried to get them to take prudent action.

And that, my friends, is how a company is held accountable for neglect. Prudent Man Rule. They were informed by a trained security professional and offered all the backup data, but the refused to take any steps to halt or prevent the compromise.

It gives juries free reign to assign massive punitive damages and paves the way for potential criminal charges and personal liability for those involved when crimes (such as id theft, credit card and password compromise, and of course various computer crimes)

“Yes Sir, I did notify BlueHost in writing and identified myself in my professional capacity. I also made it quite clear the liability they could be risking by ignoring this incident…..”

The biggest issue with Blue Host servers is they are either lazy or totally uneducated in server management and they install the operating system and run it as a default system. This means that if you do not know how to setup your own server and work with a php.ini file to secure your website. Then you are open to attack.

For the price of hosting there are a number of top quality hosts that actually have an educated tech team that understands a default OS install is a fools game. The price to have someone like me come in and move your site, clean out the infection and set it up on a secure platform is never in the budget!!

So ALERT everyone, DO NOT host with these MORONS and if you have to pay a few extra bucks to get an actual support team that will support, backup and take the blame when something is their fault. Go with them and save your sanity and pocketbook!

Very poor security

However, about a week after launch we experienced exactly the same issues that a lot of people are posting about here – malicious files suddently appearing on our server, most of them obviously used for phishing attacks (fake bank of america pages, that kind of thing). This was also after Bluehost introduced the new password requirements. The account was suspended, so working with Bluehost I was able to locate and remove the malicious files. The person I dealt with was excellent and extremely helpful, and was actually able to tell me what directories the files were in.

Then the exact same thing happened again about a week later. So I located the malicious files and deleted them again. But when I called Bluehost the person I talked to said the site was still compromised and it was up to me to find and delete them all before they would reactivate the site. Our site uses a CMS was a large number of files and directories. It took me several hours to troll through each directory and check whether or not the files I was looking at were malicious or not. Finally I fixed it and the site was reinstated. I was annoyed, but the problem appeared to be solved, so I got past it.

Then, less than a week after that it happened a THIRD time. Same deal, Bluehost rep said it was up to me to find and delete the malicious files, so I spent another few hours repeating the exercise. When I called back he told me the site was clear, but since the site had been hacked three times in less than a month I had violated the terms of service and the account was terminated. I could access my files for 30 days, but the site was no longer hosted.

With the help of a consultant we switched hosting providers and fortunately had the site back up and running in less than 24 hours. We haven’t had a single problem since switching hosts. We also had a security consultant audit the site just to make sure, and they were appalled that Bluehost was so quick to blame us and terminate the account.

Now, I still use Bluehost for my personal sites. I like their features, the price is right, all that good stuff. But after my experience dealing with them for my company I’m probably going to switch to another host when my contract is up next year. I accept that site owners should do everything they can to keep their website secure, but it really bothered me how inflexible they were about this.