RE: [PHP] Help securing a server : Owned by W4n73d H4ck3r

me, too this would be interesting bastien> Date: Fri, 9 Nov 2007 09:01:09 -0600> From: dgiragosian@gmail.com> To: bastien> parasane@gmail.com> CC: robert.mena@gmail.com; php-general@lists.php.net> Subject: Re: [PHP] bastien> Help securing a server : Owned by W4n73d H4ck3r> > On 11/9/07, Daniel Brown bastien> <parasane@gmail.com> wrote:> >> > On Nov 9, 2007 9:27 AM, robert mena bastien> <robert.mena@gmail.com> wrote:> > > Hi,> > >> > > One server that bastien> hosts several domains ended up with the message "Owned> > > by W4n73d H4ck3r". bastien> While still performing an audit I am very> > > confident that this was caused by a php bastien> script (it is a linux server)> > > uploaded via FTP or by a defective site hosted (perhaps bastien> vulnerable> > > version of a CMS)..> > >> > > The symptons seem clear, bastien> files owned by apache are vulnerable and the> > > attacker script scanned the web tree and bastien> started running.> > >> > > So, basically two questions:> > > - how to bastien> detect where this came from> > > - how to prevent it from happening again> > >> bastien> > > Thanks.> > >> > > --> > > PHP General Mailing List bastien> (http://www.php.net/)> > > To unsubscribe, visit: bastien> http://www.php.net/unsub.php> > >> > >> bastien> >> > Robert,> >> > That's really not so much a PHP question, but a general bastien> Linux> > security question. Primarily, my job is computer forensics and> > security, so bastien> if you'd like, you can reply to me off-list and I'll be> > glad to offer you a bastien> hand.> >> > --> > Daniel P. Brown> > [office] (570-) 587-7080 Ext. 272> bastien> > [mobile] (570-) 766-8107> >> > If at first you don't succeed, stick to what bastien> you know best so that you> > can make enough money to pay someone else to do it for you.> bastien> > > I'd be interested in reading this thread. OK with me to keep it on the list.> > bastien> David _________________________________________________________________ Send a smile, make someone laugh, have some fun! Start now! http://www.freemessengeremoticons.ca/?icid=EMENCA122