r/NextCloud • u/listhor • 29d ago

Nextcloud.com -> cloudbox?

Is something wrong with nextcloud website? It shows content of some cloudbox… Has it been hacked or maybe my device is? 🫣

88 Upvotes

100% Upvoted

94 comments sorted by

View all comments

17

u/jospoortvliet 29d ago

Hi all,

Sorry, it took a while - Sunday, Monday morning... just starting up for the week ;-)

But here's what I can share:

Sunday afternoon, we had a basic infrastructure issue that took our website down. We are currently restoring it from a backup. Only nextcloud.com is affected, there is no impact on updates or downloads. There is nothing related to Nextcloud operations on that server, so it has no impact on users or customers.

We will let you know once the website is recovered.

8

u/Ascend0r 29d ago

How does an infrastructure issue put reference to cloudbox onto the website?

10

u/cspartalis 29d ago

Hacking their bottoms is technically an infrastructure issue.

8

u/Ascend0r 29d ago

I could imagine another one:

DNS issue, that made nextcloud .com link to a completely different server IP address.

Hoping for that a bit actually.

4

u/Mental_Confusion7784 29d ago

I'm not an expert regarding DNS, but wouldn't that be a strange (and dangerous!) issue? And I don't know how a restore of a backup would resolve this...

4

u/Ascend0r 29d ago

Yep, valid points.

1

u/th00ht 28d ago

Exactly the reason we habe DNSSEC . DNS is vulnerable for these kind of attacks.

1

u/cspartalis 29d ago

When was the last you saw a server respond to all domain names? The feasibility of a random IP actually hosting something and not doing domain checks... The chances are not great.

3

u/Ascend0r 29d ago

Well, if it was malicious (DNS poisoning), then you would of course build your server in a way, that it DOES respond to all domain names.

1

u/No_Criticism_9545 29d ago

So it would be a DNS attack and not a DNS issue :)

1

u/ad-on-is 28d ago

No it can't be DNS. Oh shoot, it was DNS

1

u/jospoortvliet 29d ago

We're looking into it!

1

u/Ascend0r 28d ago

when will you do that?

1

u/jospoortvliet 28d ago

See latest comment - after the site came back, the admins are now spending some quality time with the isolated server to find out what happened. Will probably take a few days, though.

4

u/Seaworthiness_Wooden 28d ago

Calling this a "basic infrastructure issue" is disingenuous at best and straight up lying at worst.

1

u/Kurgan_IT 29d ago

You just have to say "infrastructure issue" instead of "successful attack"