Re: security compromised
From: PhilM (philm_at_nospam.com.am)
Date: 06/06/04
- Next message: Chris Hope: "Re: PHP Classes"
- Previous message: Gama Franco: "Documenting PHP extensions."
- In reply to: Ivo: "security compromised"
- Next in thread: Ivo: "Re: security compromised"
- Reply: Ivo: "Re: security compromised"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Sun, 6 Jun 2004 12:30:36 +0930
"Ivo" <no@thank.you> wrote in message
news:40c07b6d$0$842$a344fe98@news.wanadoo.nl...
> Hi newsgroup,
>
> it appears someone has broken into my site. This morning I found about 20
> files (each called index.htm) suddenly featured this line:
>
> <IFRAME SRC="url-of-bad-site" WIDTH=1 HEIGHT=1></IFRAME>
>
> and their last modified date was set to today between midnight and 1 GMT.
In
> some files, this line was placed directly after the body opening tag, in
> others it was just before </body>. In one file where the whole document is
> written in javascript, they had even escaped their quotes!
>
> The malicious url is www.b00gle.com/fa/?d=get
> I have no access to the raw server logs and my own log script shows no
> strange hits around that time.
> How have they done this? And what can I do about it? I ask here because
the
> site uses PHP a lot but I guess there are more appropriate places to ask.
> Thanks
> Ivo
>
>
did a quick google. you are not the only victim...
Here is tiny url link to google results
http://tinyurl.com/39st6
- Next message: Chris Hope: "Re: PHP Classes"
- Previous message: Gama Franco: "Documenting PHP extensions."
- In reply to: Ivo: "security compromised"
- Next in thread: Ivo: "Re: security compromised"
- Reply: Ivo: "Re: security compromised"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
