Terrific Tuesday The Twenty-Third

cd34 · 2006-05-23, 07:43 AM

its only 75F here, but with the wind chill, its 75F.

Got an icq from a client:

hey, my website is down.

Odd, the zend encoded file you uploaded requires php5, we don't run php5 on that machine. But I'm on holiday in ______, I have been here for 7 days.

Account was FTPed into, they went directly for a zend encoded file, replaced it with their own version (which didn't work, and I'm not sure why they didn't test it) and left.

So, I figured, lets see what this thing does. I installed it on a machine running zend 3.0 + php5 and lo and behold, without any database connection, a picture perfect copy of their page (with a toolbar javascript at the bottom), but, it gets better. It still sends traffic through their click tracking system, and, skims to another unrelated site.

If you have the ability to change your FTP password, do it frequently. This person claims to have run spyware and antivirus full scans on a weekly basis and has a live update. There are two people that may have the ftp info, either of which could have been compromised as well. If you cannot guarantee that their systems are clean, change your password, let them in, change your password after they are done doing what they need to do.

The logs show that this person logged in from Poland and the UK, went in, grabbed a zend encoded file, uploaded a zend encoded file 38 seconds later. downloaded a few html files, uploaded them 4-5 seconds later each. There were no authentication errors, no mucking around the system. Total connection time was under two minutes.

Other than that, my fuel guy called and I missed his call. And I need a haircut.

Useless · 2006-05-23, 08:13 AM

Quote:

Originally Posted by cd34

its only 75F here, but with the wind chill, its 75F.

You better run outside and cover the plants - sounds a bit frosty down there. Brrrr.

I'm not sure what today's weather will be, or even is. The one inch opening at the curtain tells me that the sun is shining to some degree. I guess I'll get a good taste of it when I bring the kids to school.

Oh shit, it's almost time to bring the kids to school.

2006-05-23, 07:43 AM	#1
cd34 a.k.a. Sparky Join Date: Sep 2004 Location: West Palm Beach, FL, USA Posts: 2,396	its only 75F here, but with the wind chill, its 75F. Got an icq from a client: hey, my website is down. Odd, the zend encoded file you uploaded requires php5, we don't run php5 on that machine. But I'm on holiday in ______, I have been here for 7 days. Account was FTPed into, they went directly for a zend encoded file, replaced it with their own version (which didn't work, and I'm not sure why they didn't test it) and left. So, I figured, lets see what this thing does. I installed it on a machine running zend 3.0 + php5 and lo and behold, without any database connection, a picture perfect copy of their page (with a toolbar javascript at the bottom), but, it gets better. It still sends traffic through their click tracking system, and, skims to another unrelated site. If you have the ability to change your FTP password, do it frequently. This person claims to have run spyware and antivirus full scans on a weekly basis and has a live update. There are two people that may have the ftp info, either of which could have been compromised as well. If you cannot guarantee that their systems are clean, change your password, let them in, change your password after they are done doing what they need to do. The logs show that this person logged in from Poland and the UK, went in, grabbed a zend encoded file, uploaded a zend encoded file 38 seconds later. downloaded a few html files, uploaded them 4-5 seconds later each. There were no authentication errors, no mucking around the system. Total connection time was under two minutes. Other than that, my fuel guy called and I missed his call. And I need a haircut. __________________ SnapReplay.com a different way to share photos - iPhone & Android