Gossimer News

Important Update: Safeguarding your Hosting Package against Gumblar Attack

Wed, 10 Jun 2009 20:55:00 EST

Dear Reseller,

On Monday, we alerted you about hosting packages on our Linux Hosting environment being affected by Gumblar attacks. Over the past few days, we have been investigating these attacks, and working on methods to mitigate damage caused by them; this mail contains our findings and recommendations.

Through our investigations, it was confirmed that the infection was not due to any server vulnerability. We enforce stringent security measures to safeguard your data.
The attack is perpetrated through stolen FTP login credentials. It transmits FTP information to an IP address from an infected machine.
This FTP information is then used to log on to the web server and infect the hosted website.
The attack is not limited to Gossimer's hosting services - so far, thousands of websites across a large number of hosting providers have been infected through this attack.

Given the nature and scope of this attack, it is important that proper security measures be taken at all levels to prevent it. We would like to suggest a few steps that would reduce the vulnerability of your computer and remove existing threats.

We recommend you install an antivirus program with the latest updates and ensure removal of any malware, trojans or key loggers on any machine that you use to manage your website's content via FTP.
Several free antivirus software like AVG, AntiVir, Malwarebytes are available for this purpose. Regular virus scans will minimize such threats to a great extent.
Once you are confident that you have a clean machine then you should change all FTP passwords.

Here's a summary of steps we have taken so far, and what we need you to do -

All websites that were determined to be infected have now been cleared.
- If you find any discrepancy with the content of your website, please inform our support team immediately.
We have reset the passwords for all FTP users across all Linux Hosting Packages.
- You need to login to your control panel and set new passwords for all FTP users.
- It is advisable that you set complex passwords and regularly update them for added security.
- This knowledge base article contains instructions on how to reset your FTP passwords - http://manage.gossimer.com/kb/servlet/KBServlet/faq831.html.
We also recommend that you avoid storing the new FTP passwords directly on the FTP clients. Variants of this virus have the potential to grab stored passwords on the FTP clients.
As intimated in our earlier post, we now support FTP access via SFTP only. SFTP or Secure FTP will encrypt both commands and data, preventing passwords and sensitive information to be sniffed over the network.
- This KnowledgeBase article contains more information about SFTP as well as a list of common SFTP clients - http://manage.gossimer.com/kb/servlet/KBServlet/cat208.html
We have also enabled net2FTP connections for all packages, so you may use the File Manager within your control panel to manage your content.
- This knowledge base article contains a guide to net2FTP - http://manage.gossimer.com/kb/servlet/KBServlet/cat289.html

If you have any doubts or face any further issues, please contact our support team; we are glad to answer all your questions and provide any help you need.

Regards,
Gossimer Support Team
http://www.gossimer.com/support

FTP service currently unavailable for Linux Hosting packages

Tue, 09 Jun 2009 18:01:00 EST

Update - 16:00 hrs GMT The process of removing malicious content from every package as a result of the Gumblar attack is now complete. FTP passwords across all Linux Hosting Packages have been reset. Click here to learn how you may reset the FTP password from your control panel. Net2Ftp for all packages has been enabled so that you may start using the File Manager within your Control Panel to manage your website content. Click here to find out how you may do so. Coming soon - More updates regarding the attack and the shift to Secure FTP Several websites on our Linux Hosting Servers have flagged virus alerts. FTP logs from the infected packages indicate that the machines of the customers who own those domains are compromised and have been used to upload malicious content to their respective hosting packages. This form of attack is commonly known as a Gumblar attack. As a precautionary measure, the FTP service for Linux Hosting packages has been temporarily disabled. As such, users will not be able to upload or manage files using FTP for now. We shall update once the services are enabled again. Our apologies for the inconvenience.

Gumblar Attack

Mon, 08 Jun 2009 19:45:00 EST

Dear Resellers,

We were reported of several websites hosted on our Linux Servers showing virus alerts. Our investigations have revealed that these alerts are due to an injection attack on packages hosted on our servers. The FTP logs of the infected packages indicate that the machines of the customers who own those domains are compromised and have been used to upload malicious content to their respective hosting packages.

What is a Gumblar Attack?

Gumblar appears to be a combination of exploit scripts and malware. The scripts are embedded in .html, .js and .php files using obfuscated Javascript. They load malware content from third party sites without the user's knowledge. It also steals FTP credentials from the victim's computer, which allows it to spread and infect additional sites. Therefore, when someone visits an infected site they get infected and if they have FTP credentials for a website on their machine then those sites will get infected too. This explains the exponential growth of the exploit in such a short space of time.

What makes it different from previous malware exploits?

There are a number of aspects to this exploit that both make it difficult to remove and help it spread. Firstly, it is infecting users who are browsing legitimate websites, if these users are webmasters then it is infecting their websites by using their FTP credentials to inject the script onto their site. The obfuscated malicious code is dynamically generated. This makes it difficult to detect and difficult to automatically remove. Not only does the script vary from site to site but it can also vary from page to page on the one site.

What have we done?

As a precautionary measure, we have temporarily blocked FTP services on our Linux Hosting Servers. This will prevent infection of any other hosting packages. We are in the process of removing malicious content from every package that was infected as a result of this. However if we re-establish FTP connections your clients will re-infect their respective hosting packages since their machines are likely compromised.

What we are doing?

We will be shifting to a secure FTP connection and resetting everyone's FTP passwords across all Linux Hosting packages. You can later on modify these passwords from your website management panel. You should ideally warn your customers about this worm and ask them to scan their machines given its exponential spread so far.

Regards,
Gossimer Support Desk

Third Level .UK for just $4.69!

Mon, 08 Jun 2009 01:00:12 EST

Starting from June 9th, 12:30 UTC, we are effectively targeting the promising UK market with our latest Promo - Third Level .UK Domains for just $5.69. Make sure to register your domains on this exciting Promo while it lasts!

.BIZ Registry Price Hike

Fri, 05 Jun 2009 17:00:01 EST

As you may already know, the .BIZ Registry hiked the pricing for .BIZ Domains today. We would like to inform you that Gossimer will not be increasing its pricing for .BIZ Domains and you will continue to enjoy your current best pricing available.

.TEL MX Records - Now Live!

Wed, 03 Jun 2009 06:00:13 EST

We are proud to announce that you can now add MX records and configure email on .TEL Domains. Simply click on the 'Manage MX Records' button in the Domain Management Console and add the relevant records to get mail@yourdomain.tel. For more information on this new feature, please refer our KnowledgeBase.

.TV @ $18.99 only - Restarts Today

Tue, 02 Jun 2009 22:00:05 EST

Based on popular demand, our .TV Promo that ended on 29th May will restart tomorrow, 2nd June at 12:30 UTC. Make the most of this extended promo, which allows you to avail of .TV Domains at 25% off the current pricing!

.MOBI Promo + Instant Mobilizer

Tue, 09 Jun 2009 18:00:00 EST

.MOBI Promo + Instant Mobilizer Based on the tremendous response that we received to our previous .MOBI Promo, we have decided to re-launch it and offer you great discounts once again. Boost your profits with the return of this great Promo, where we're giving away .MOBI Domains @ $7.99; starting from the 2nd of June at 12:30 UTC. What�s more, you can get a .MOBI Sitebuilder and the recently launched Instant Mobilizer, Free with every .MOBI Domain! You can find more details on how your Customers can use the Instant Mobilizer and mobilize their websites in our KnowledgeBase.

.ORG And .US Promo - Begins Tomorrow

Mon, 01 Jun 2009 19:29:00 EST

As mentioned in our previous mailers, the .US @ $4.99 and .ORG @ $6.99 Promo will be going live tomorrow. Do make the most of the promo-packed June.

Gossimer.com: Email Hosting @ $2.00!

Mon, 01 Jun 2009 19:12:00 EST

We are proud to unveil Email Hosting @ $2.00 with Unlimited Email Accounts and 1GB storage space per email account. At Gossimer.com, we are always working towards offering our Customers comprehensive business solutions at great pricing that meets your every need.

Details of the New Email Hosting Plan:

One Email Hosting Plan
Unlimited Email Accounts per plan
1 GB storage space per email account
All this @ $2.00/month
The features and management of this Product will continue to be the same as the existing Email Hosting Product
This Email Hosting Plan launched on the 27th of May, 2009

Impact on Existing DNS Orders

1) The current four plans will be deprecated and replaced with the new single plan for $2.00.

2) All existing Email Hosting Orders will be upgraded to the new 1 GB plan on the 27th of May. The login credentials, management and features of the existing orders will continue to function as is.

Gossimer now accepting Liberty Reserve

Thu, 07 May 2009 22:53:00 EST

Gossimer is proud to announce we are now accepting Liberty Reserve payment for all web hosting, domain registration and other services.

Added Free Services - Bulk Tools

Fri, 10 Apr 2009 05:00:09 EST

The Bulk Tools make managing your entire Domain Name portfolio as easy as possible. Using the Bulk Tools you can Register, Renew, Transfer and make other modifications to multiple Domain Names in a single step. What's more, we offer you these tools with every Domain Name for no extra cost!

Added Free Services - Easy-to-use Control Panel

Thu, 09 Apr 2009 17:00:03 EST

Any Domain owner knows that Domain Names need to be managed on a continuous basis, which makes a simple and effective Control Panel absolutely essential. The Control Panel that we offer Free of cost, make changing contact information, modifying nameservers, renewing the Domain Name, etc. extremely easy.

Added Free Services - Domain Theft Protection

Wed, 08 Apr 2009 12:00:15 EST

Domain Theft Protection is a security service offered to provide an additional layer of security to Domains. This FREE service allows you to lock your Domain Names, guarding them against unauthorized Transfers.

Added Free Services - Privacy Protection

Tue, 07 Apr 2009 09:00:12 EST

Protect the information that you display in the WHOIS details of your Domain Name with Privacy Protection. Although most providers charge anywhere between $6 - $14 for this service, we offer you Privacy Protection absolutely FREE of cost! You can safeguard your personal information from spammers, data harvesters, etc. ensuring that your WHOIS information is never misused. Please Note: As per the Registries' mandate, Privacy Protection cannot be used for certain Domains.

Added Free Services - DNS Service

Mon, 06 Apr 2009 19:49:00 EST

Any product you buy from us, comes with complete control to manage the DNS records for the associated domain, absolutely FREE of cost! Plus, our FREE DNS service is hosted on globally distributed and highly redundant infrastructure making it one of the most reliable in the industry. Manage SOA, A, AAAA, MX, CNAME, SRV and NS records - with all updates reflecting instantaneously.

Gossimer.com fitted with new design

Sat, 14 Mar 2009 22:44:00 EST

We have completed the upgrade to our new design today, giving Gossimer.com a facelift. Customers who would like to continue to use our previous interface and website design, it will be available at http://www.gossimer.co.uk

Spanish Webmail Interface

Thu, 05 Mar 2009 07:00:16 EST

Based on popular demand, we are pleased to announce that the Gossimer Webmail Interface is now also available in Spanish. Email Hosting Customers can now view and manage their emails in this very popular language hence allowing us to expand our business to the vast Spanish Customer Base.

.IN Domain (3rd Level) Promo

Wed, 04 Mar 2009 16:00:01 EST

You can now avail of slashed pricing on every .IN Domain (3rd Level). CO.IN, NET.IN, ORG.IN, GEN.IN, FIRM.IN, IND.IN SALE! USD 6.99 Take advantage of this unbeatable offer and SAVE BIG on every domain name registered! We hope to see you make the most of this fabulous bargain. This is a limited time offer. So hurry!!

.IN Domains @ $6.99 only!

Wed, 04 Mar 2009 15:38:00 EST

Our .IN Promo is finally here! Starting from the 4th of March, 12.30 UTC onwards, you can avail of .IN and Third Level .IN Domains at just $6.99! The .IN Domain has proven to be a great Vanity TLD, representing both the Indian market and the Internet as a whole. So make the most of this profitable Domain by adding it to your portfolio today!

Gossimer Promo: .MOBI Promo Extended!

Tue, 03 Mar 2009 18:56:00 EST

We are happy to announce the extension of our .MOBI Promo. You can now avail of this exciting offer right through the month of March! Get New Registrations for $7.99 and Transfer-Ins for $6.99 only. Not to mention, a .MOBI Site Builder absolutely Free with every .MOBI Domain you buy! So what are you waiting for; explore this profitable opportunity today!

.IN Promo - Coming Soon

Wed, 25 Feb 2009 20:27:00 EST

Make the most of the discounted pricing of $6.99 only for New Registrations of .IN and Third Level .IN Domains and watch your profits increase exponentially. .IN which is not only a ccTLD but also a great Vanity TLD, has been growing at a consistent rate since its launch. So, look out for more information on this great promotion that will be launched on the 4th of March, 2009.

Gossimer CEO Interviewed by Web Host Directory

Mon, 23 Feb 2009 21:21:00 EST

Web Host Directory requested an interview with CEO Marvin Dreyer, the interview request was granted and the interview can been seen in its entirety on webhostdir.com.

Rock Bottom Pricing on .US Domain

Mon, 23 Feb 2009 20:28:00 EST

Dear Reseller/Customer, You can now avail of slashed pricing on every .US Domain right now only $6.99. Take advantage of this unbeatable offer and SAVE BIG on every domain name registered! We hope to see you make the most of this fabulous bargain. This is a limited time offer. So hurry!!

Rock Bottom Pricing on .BIZ Domain

Mon, 23 Feb 2009 20:26:00 EST

Dear Reseller/Customer, You can now avail of slashed pricing only $4.99 on every .BIZ Domain. Take advantage of this unbeatable offer and SAVE BIG on every domain name registered! We hope to see you make the most of this fabulous bargain. This is a limited time offer. So hurry!!

Rock Bottom Pricing on .MOBI Domain

Mon, 23 Feb 2009 20:25:00 EST

Rock Bottom Pricing on .MOBI Domain Dear Reseller/Customer, You can now avail of slashed pricing on every .MOBI Domain. Take advantage of this unbeatable offer and SAVE BIG on every domain name registered! We hope to see you make the most of this fabulous bargain. This is a limited time offer. So hurry!!

Updated support and knowledgebase released

Mon, 23 Feb 2009 19:19:00 EST

Our comprehensive Knowledgebase, we even have it in two flavors, let us know which you like best, the first is http://manage.gossimer.biz/kb and the second is http://www.hostingknowledge.com (currently being developed)
Our support Ticketing System is the fastest way to get assistance, http://support.gossimer.biz
Our email support at support_ticket@gossimer.biz
Toll free telephone support (888)902-4678

Current Domain Registration Promotions

Mon, 23 Feb 2009 12:34:00 EST

We are currently offering domain registrations at unbelievable prices. .Biz for only $4.99 a year, .US only $6.99 and .mobi are currently only $7.99, these sale prices will not last for long so please get to http://www.gossimmer.biz to place your order now.

The .US Promo has now been extended!

sales@gossimer.biz — Mon, 23 Feb 2009 12:11:00 EST

The .US Promo has now been extended! You can now avail of .US Domains @ $6.99 only all through March and enjoy the lowest pricing in the industry for .US Domains till the 30th of March, 2009! Although we had announced earlier that the .US promo would end next week, thanks to the overwhelming response that we received to the promotion, we have decided to extend this promo till the end of March. So make the most of this exclusive promotion from Gossimer and target the largest online market today!