bugtraq - Re: New web malwares attacking big hosting providers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4BE3AC73.2010907@davidecanali.com>
Date: Thu, 06 May 2010 23:00:19 -0700
From: Davide Canali <davide@...idecanali.com>
To: bugtraq@...urityfocus.com
Subject: Re: New web malwares attacking big hosting providers

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I confirm this affects GoDaddy hosting too. Found a file called
ferdy_simonette.php in my web hosting root directory.

This file injects malicious code in all the .php and .html files in
your hosting directory and subdirectories (and maybe other file
extensions).

I'm going to analyze the "injector" code, as well as the one it
injects, in the next few hours.

So far, if you find any new file in your hosting directory, I just
recommend not to execute it. Or, if you dare,  make sure to
redirect your visitors somewhere else, or bring down your website
before you do.

Regards,

    Davide Canali
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkvjrHMACgkQ6yrfzQzWVMHIEgCfQcxDxG7mT8zU6o2KJys6n5iI
3pIAnjYqbcF9kHomL9I0hQSH2a1r8PCE
=5Cc3
-----END PGP SIGNATURE-----