On Wed, Aug 22, 2012 at 2:54 PM, Mark Walkom markwal...@gmail.com wrote:
On 22 August 2012 12:00, David Lyon david.lyon.preissh...@gmail.com wrote:
I have a customer with a hacked website.
When I ftp'd to their web-server I found this wart (listed below - saved as
brut.php):
How did the hacker put it on my system ? What could it have comprimised ?
What
can I do to stop further consequences?
Reset any management/admin passwords to be safe. Make sure everything
running on the server is up to date - OS, DB, Apache etc.
Get rid of FTP, use SCP and fail2ban.
Reinstall the machine from bare metal. Verify the BIOS against the
vendors version (not 100% fullproof) and discard the filesystem
entirely (take a backup first).
You don't know what has been altered, its not impossible they got
root, and its not impossible that they put a preboot attack in place
too.
-Rob
--
SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/
Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
