i got attacked, my files had links added to the bottom of each page!

[spewn]

i had an attack on my server last night, and the perp was able to add text links to the bottom of various pages, in various folders. not all of them, but most.

the perp was also able to create a folder with the link destinations, etc.

i was told that it might be a vunerability in my scripting, and the way in might have been a buffer overun(?).

the crazy thing is, i have an index page that pulls the content for the page from a sub file, through the 'require' call. the perp was able to know that, and put his code in that sub file, too.

it seems that the code was put in right before the closing body tag, and on pages that had multiple end body tags due to if/else statements, it was only put in once.

i'm trying to figure out if it was a scripting issue, or what. i know you may require more info, but i really don't know where to start.

thanks for any help that can be offered.

- g

 

[travs69]

It's really hard to say but most people don't do the proper verification on the data and you can get it to do a lot of things you normally shouldn't be able to. It's normally pretty easy with system calls and such. You can post your code and ask for ideas on how to harden it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those who say it cannot be done are usually interrupted by someone else doing it; Give the wrong symptoms, get the wrong solutions;

 

[KevinADC]

Without a thorough examination of all of your scripts there is no way to tell. It could also have been another user on the same server if the server is not well setup. I really doubt anyone here can help you unless you are using some code that is obviously dangerous.

------------------------------------------
- Kevin, perl coder unexceptional!

 

[KevinADC]

I suggest you look through your access logs if possible and see if you can find anything that might help determine what was accessed that could have been the entry point for the hacker.

------------------------------------------
- Kevin, perl coder unexceptional!