Server IP address hijacked by other website

Serious security flaw

[ning]

I host a few websites on a dedicated unix server in US.

Yesterday another unknown site showed up when I accessed my site. I reported the issue to the NOC. After four hours (!) my site was showing up again.

Later the same day the same thing happened, my site was gone and replaced by the other site.

The "explanation" from the NOC:

Another customer with a plesk server on the same C class net deleted by error his range of IP addresses, so he retyped them in his control panel. He mistyped one to be my IP. So when he added it, my site stopped working and the NOC's routers re-rerouted the IP to his server. The flaw was is the router, they say, both of us use the same router and in the same class C net.

After 4 hours, when the DNS TTL expired, the router somehow discovered the error and fixed it. That was the first incident. As such, I was hijacked 4 hours.

The next incident, the guy must have tried to use his IP or something, and he re-hijacked by error the IP.

The server re-asked control of the IP to the router, and got it. Then the guy was p*ssed off beacuse his server was not working again and my site was showing up instead. So he called the NOC to complain his server was not working. They immediately corrected the IP on his server.

The NOC has now reloaded our IP lists. The NOC tells me that no clients have access to edit their IP list anylonger. The NOC says they will bind/check the MAC address associated with every IP, and this will never happen again, as it now reserves an IP to a specific MAC address. They tell me that this NEVER happened to any of the techs before.

I asked for an e-mail from them, explaining the situation,
they said that they don't do that, because of the liablity laws in the USA. They says this is not a situation they could anticipate, this was not their fault, and they tried their best to solve it.

Is this is a known security flaw?
Have you heard about this issue before, or have I been taken for a ride here?

[ning]

I forgot to mention, that the hosting company is one of the top notch leading hosting companies in the US, with thousands of hosted sites.

[Leosghost]

It can / does happen ..and I think I know who they are

[huski]

i think the routing table was changed by a NOC engineer and the story was made up to protect the ISP. the ISP should never have allowed anyone to have the ability to change the settings within a routing table.

if you couldn't reach your IP on the second incident <that rules out hijacking> and leads me to believe a NOC engineer blocked it.

[ning]

So this is the answer? It can happen!

Any fellow webmaster?

[digitalv]

Why any hosting facility would allow a class C to be "shared" by more than one customer is beyond me. They should break up the range into separate subnets. Even if another customer DID enter the wrong IP address, it would just be a dead IP sitting on their box with no route to it.

Totally lame on their part. This would never happen on a properly configured network, they shouldn't use 255.255.255.0 in THEIR router unless they're giving a single customer the full range.

[sonjay]

They give customers access the ability to change the IP tables for sites other than the customer's own site, and they say this is not a situation they could have anticipated?

I'd be looking for hosting elsewhere right quick.

[mcavic]

A hosting customer should not have access to change a host's IP.

I suspect that the NOC people accidentally changed either an IP or a DNS entry. This has happened to me twice with a large ISP that I use.