Skip site navigation (1)Skip section navigation (2) 
Date:      Tue, 25 Aug 2009 19:33:18 -0400
From:      Steve Bertrand <steve@ibctech.ca>
To:        Adam Vande More <amvandemore@gmail.com>
Cc:        Paul Schmehl <pschmehl_lists@tx.rr.com>, Bill Moran <wmoran@potentialtech.com>, Colin Brace <cb@lim.nl>, freebsd-questions@freebsd.org
Subject:   Re: what www perl script is running?
Message-ID:  <4A9474BE.6020501@ibctech.ca>
In-Reply-To: <6201873e0908251511q643f3662nc73f264cbfcfe645@mail.gmail.com>
References:  <4A924601.3000507@lim.nl> <25132123.post@talk.nabble.com>	<20090825082604.41cad357.wmoran@potentialtech.com>	<25134277.post@talk.nabble.com>	<E668BECE594402B585544841@utd65257.utdallas.edu>	<20090825120504.93a7c51d.wmoran@potentialtech.com>	<6201873e0908250921w46000c2by78893a1c5b581e78@mail.gmail.com>	<20090825130616.20ab0049.wmoran@potentialtech.com>	<6201873e0908251237n5c819d9ag36f867b5e68e258c@mail.gmail.com>	<20090825154358.7c792d3a.wmoran@potentialtech.com> <6201873e0908251511q643f3662nc73f264cbfcfe645@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail 

[-- Attachment #1 --]
Adam Vande More wrote:

[ huge, huge snip ]

> You said block by destination port.  What you presented is not this,
> although it gives give a functional environment of it.  Sorry for the
> pedantic pursuit here, but IMO terminology is important here.

I've read this thread on a 'best-effort' basis throughout the day.

Although I can *personally* translate what Bill's excellent feedback is
saying into functional protection, I have to say that your statement
quoted was the 'politically correct' way to express it.

We've (ie: I've) been compromised in the past (several times), and
experience based on having an installed Perl-based httpd program tells
me thus:

- it is likely a PHP script that was the root cause
- it is likely that the script had access to a MySQL database
- bulletin boards, mailer apps and blog software was often the culprit
- it's a common hack, the Perl code that is installed can be downloaded
anywhere

We have a multi-site hosting environment, so we see things like this
from time-to-time. I can't remember for sure if it was this list or not,
but I know I've posted "what to look for" someplace.

In this case, OP, look for:

- directories named as such:
-- ...
-- . ..
-- . .
-- etc, particularly under:
-- /var/tmp
-- /tmp
-- or anywhere else the [gu]id of the webserver could possibly write to

There are other similar problems that are prevalent out there that
someone running a web server may run into (one I've seen recently). It
inserts HTML redirects into files (or directly into a MySQL table, in
situations where links are generated dynamically) that direct the
browser to foreign pages (presumably so that the browser will
inadvertently download rogue programs into the visiting computer).

This has had the effect of having Google block the page, and for client
relations, it doesn't look good. Any time we've seen this, we refer the
client to their web developer for assistance (heh).

This such infection has noticeably been caused by server-side PDF
management software, and a specific PHP video management software.

We've never found that such 'kiddie/automated' hacks tried to manipulate
or steal any information directly/initially, even after reviewing the
code. With that said, I firmly agree with Bill that you should/must
replace all passwords both on the Unix side of things, as well as within
MySQL.

tcpdump(1) is your friend.

On the firewall side of things...

I am on the fence with both Paul and Bill's comments as to whether
having protection on each machine is a bonus or a failure. This really
depends... and it depends on the environment which and where the box is
logically attached.

Given that I'm in an ISP environment, I don't want to manage ACLs for
web servers on my network edge routers, so it's best that I contain them
locally to the hosted web box itself. In other cases (such as an
enterprise environment), it would be easier to manage such ACLs at the
network perimeter. For a home box, a firewall-per-box may lead to better
understanding and experience.

What I haven't read in this thread so far is the term 'state', relative
to stack protection.

For instance, if I were to:

% ipfw add 10 allow all from any to me 80 keep-state
% ipfw add 15 deny  all from any to any

... it would dynamically allow all requests to my web server (fw running
on the host itself), would allow all responses back to the client
(regardless of the port they used to send the request (because of
state)), but it would deny everything and anything else, inbound and
outbound.

Note that in heavy environments that keeping state can have it's own
detrimental drawbacks, which there is no need to get into here. These
drawbacks are generally why one might decide not to block everything at
the network edge, but on the box itself.

Steve




[-- Attachment #2 --]
0	*H
010	+0	*H
00CK9AbxIUw0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
090507231610Z
100507231610Z0B10UThawte Freemail Member10	*H
	steve@ibctech.ca0"0
	*H
0
DZ杙<2IⵀfrsE6q?0.>
S@Œ!V?A\Q
r-aZ
Ōf/0{OYQhɏߴ
F_\Q0BF=<_.a*3epeY|tݼcvlҷ+@piQA{2E9WN4[Z`h6VM/zPbd(GC^K6XV4j<t-0+0U0steve@ibctech.ca0U00
	*H
æ|85aQz-*3HG		.s*Fw*`HvFw;9ytƘn0taC/:WC+LÙ{Oq 1n00CK9AbxIUw0
	*H
0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA0
090507231610Z
100507231610Z0B10UThawte Freemail Member10	*H
	steve@ibctech.ca0"0
	*H
0
DZ杙<2IⵀfrsE6q?0.>
S@Œ!V?A\Q
r-aZ
Ōf/0{OYQhɏߴ
F_\Q0BF=<_.a*3epeY|tݼcvlҷ+@piQA{2E9WN4[Z`h6VM/zPbd(GC^K6XV4j<t-0+0U0steve@ibctech.ca0U00
	*H
æ|85aQz-*3HG		.s*Fw*`HvFw;9ytƘn0taC/:WC+LÙ{Oq 1n0?0
0
	*H
010	UZA10UWestern Cape10U	Cape Town10U
Thawte Consulting1(0&UCertification Services Division1$0"UThawte Personal Freemail CA1+0)	*H
	personal-freemail@thawte.com0
030717000000Z
130716235959Z0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CA00
	*H
0Ħ<UsUNʙZhup[v:aQP
0cZ,p+Z?qV˯<6$*+w=+>@dקe*TH<a@dr`00U00CU<0:08642http://crl.thawte.com/ThawtePersonalFreemailCA.crl0U0)U"0 010UPrivateLabel2-1380
	*H
HP.
fgCL!6-6/P p<ab:~t%Pb'qW%ݩ9 Oe_N4[5MwV!x!5$F]_eO1d0`0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0	+0	*H
	1	*H
0	*H
	1
090825233318Z0#	*H
	1dH(#g؅x6Ua0R	*H
	1E0C0
*H
0*H
0
*H
@0+0
*H
(0	+71x0v0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0*H
	1xv0b10	UZA1%0#U
Thawte Consulting (Pty) Ltd.1,0*U#Thawte Personal Freemail Issuing CAK9AbxIUw0
	*H
A98=%ԴUa3DI{ZRfjηol{1؄r>cJE^4l#Tg]l@
lhY&
j7mC:&k-wÕ%GLgMx-*]vm]1i/7~f
j
f]GA+(1VAp+	4o<l_`c(O!<H}5£jrBn6u)4Q&5
Ҭwt
help

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4A9474BE.6020501>