bugtraq - Re: [Full-disclosure] what is this?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-id: <478C03C7.20071.9C754256@nick.virus-l.demon.co.uk>
Date: Tue, 15 Jan 2008 00:52:23 +1300
From: Nick FitzGerald <nick@...us-l.demon.co.uk>
To: Untitled <full-disclosure@...ts.grok.org.uk>,
	PenTest <pen-test@...urityfocus.com>, bugtraq@...urityfocus.com
Subject: Re: [Full-disclosure] what is this?

3APA3A wrote:

> Dear crazy frog crazy frog,
> 
>   Clear  your  computer  from  trojan,  change FTP password for you site
>   hosting  access,  because it's stolen, access your hosting account via
>   FTP  and remove additional text (usually at the end of the file, after
>   </html>) from all HTML/PHP pages.

Ummmm -- the only part of that likely to be relevant here is the last.

These kinds of web page "compromises" are typically achieved through 
bad/ill-configured/non-updated server-side web applications (or their 
underlying script engines) and are typically achieved without requiring 
any more special or privileged access to the victim sites than the 
ability to run a clever Google search or your own brute-force spidering 
via a bot-net, etc.

Of course, simply removing the undesired iframe/script/etc tags from 
your compromised pages is not enough.  Although doing so does not mean 
that this attacker will come back, it equally does nothing to close the 
hole they used in the first place, and the next attacker searching for 
that hole will hit you just as easily and indiscriminately...

Regards,

Nick FitzGerald