[finally not so solved] site closed hacked ?

My server was attacked too, but the perpetrators didn’t get in since I had deleted the snippet file the day before. I have a couple of entries which say things like...


... but I guess that just means that they were able to download my Japanese Wyevale garden centres page which must have been thrilling for them! All the rest are have 404 codes.

My guess is that the hackers are just going down the list of sites registered at modx.it (like mine) or picking out people (like me) that have placed links to sites in their signature in these forums. This has made me realise that doing so puts you at higher risk: I now know that the next time a security flaw is identified in modx I’ll be one of the first to be targeted, and if I don’t act quickly enough they’ll get me.

Here’s a list of IPs from which I was attacked in case anyone is interested in adding them to their firewall:


Paul

Again, these are attempts only so there is no risk if you are using a secure environment. Attacks would be successful only if register_globals were set to On, which simply should not be done, ever. And if you remove the reflect file they are trying to use, you’re golden. Nothing else to worry about, no potentially spoofed IP’s to block or anything else. Go ahead and access my site and increase my PR hackers.

I do my best to keep my server secure, and I do have register_globals = Off, so you’re right - they wouldn’t have got me even if I had not deleted the snippet. So when I said "the next time a security flaw is identified"... I guess that was a bit harsh since, as you say, with the reflect snippet issue the flaw is actually not having secured the server in the first place.

Cheers.

hi again,


Obviously i never think about the procedure consisting of reinstalling a fresh Modx and "connect it to the DB".

Probably not so hard, but... I’m not very "SQL aware" and most of all i’m overbooked those days, so:

Is there a little standard procedure around here, would be great to read it, just in case.

Thank you