PHP include attacks rolling on…

Posted by jerry as Hacking, Security

I’ve written about this a bit, and I’ve started a current attack list on networkstike.com, but the intensity seems to be increasing in these attempts.  I decide to google one of the URL’s that’s included, and right off the bat, I found this article from a web site that’s seeing the same thing.  I believe these attacks are being launched from a botnet, trolling for vulnerable sites to use for some kind of illicit business.

What was really interesting to me in my google search for some of the inclusion URLs is the number of log files that are available and indexed via google.  For a long time, I have gotten many hits with the referral set to a spammy site - an obvious attempt to get some clicks and link mojo with Google.   I never really thought a lot about it, but I can see that it’s probably a fairly effective thing, given the number of log files I found via google.

The current list of php inclusion hits for my sites is below:

http://www.s1ko.jazztel.es/safe.gif?
http://gw-gold.net/dragoc/id.txt?
http://musicgirll.chat.ru/wav/mysong?
http://www.mta.cl/galeria2/galery.txt?
http://www.mta.cl/galeria2/galery.jpg?
http://www.madinaedu.gov.sa/safeon.txt??
http://www.modelismo.alternativo.nom.br//poll/polldata/readme.txt??
http://shellbr.com.sapo.pt/safeon.txt??
http://zamkad.ru/pub/buffer_upload/…/cmd.txt?
http://www.volontaridelrotary2040.com/html/modules/xt_conteudo/NewFile.txt?
http://telkomsex.com/ec.txt?
http://193.109.188.20/0/templates/rhuk_solarflare_ii/css/contr.txt??
http://www.dip-kostroma.ru/bak_skompa/themes/runcms/menu/images/.asc/www?????????????????????????????
http://neu.sv-badbentheim.de/hide.txt?
http://www.smartlabphd.com/book/list/skin/zero_vote/images/setup_pages2.gif???
http://www.smartlabphd.com/book/list/skin/zero_vote/images/setup_pages.gif???
http://www.urjb.com/photos/albums/userpics/10001/thumb_blank.gif??
http://www.hgbruce.com/components/com_rsgallery/safeon.txt??
http://tr-igus.com/safe.txt?
http://www.valerieataylor.com/gb/book2.gif??
http://servergazi.com/portal/images/stories/web.gif??
http://hackbsd.net/.xrt/safe.gif?
http://www.freewebtown.com/w8ting/safe.txt??
http://rumusic.chat.ru/rumusic.wav?
http://ninaru.hut2.ru/images/cs.txt?
http://amygirl.land.ru/baby?
http://www.martinschaab.de/php/id.txt?
http://x0.741.com/pb.txt?
http://location-investment.com/Connections/r8.txt?
http://jjisdfiuw834wsdd.chat.ru/js?

I’ve started downloading the files and looking at them.  Many of them are loosly copied off of one another, some are exactly the same.  Some are quite complex, all-in-one shells, that would allow complete server control.  Most of them appear to give some basic information, like directory, available disk space, effetive UID and GID, and the like.

NSA Encryption backdoor?

Posted by jerry as Security

I am always skeptical of conspiracy in a given situation. The article is basically claiming that the NSA knowingly put a backdoor key in to an algorithm, then forced it into the standard doc. Oh, and it’s apparently ‘obvious’ that secret keys exist, whether known or unknown.

This reminds me a lot of the debate about the sboxes used in DES - the assumption was that the government did it to be able to crack DES, but turned out to be an intentional design element that actually increased the security of DES.

I can think of a few scenarios off hand:

1. The creator knew about the weakness and intentionally chose values that are very difficult to reverse engineer.  The algorithm is substantially secure to be trusted in spite of this.

2. No such set of second numbers are available, and this is a misunderstanding.

3. The creator legitamately did not know about the issue.  People in the NSA are crapping bricks now.

4. There in fact is a secret set of numbers in the algorithm and the NSA has a specific use in government applications for a computationally intensive, and recoverable application. They know that general use is not likely because of those two fact.

I can see some utility in a computationally expensive encryption algorithm. I have to believe that the NSA didn’t ’sneak’ in an algorithm that is so obviously inferior, expecting the world at large to use it so they can snoop. Despite iraq and 9/11, they really aren’t a dumb organization.

I think the real story here is that we have to be so suspicious of the motives of our government. Given the many spying stories, the telecom amnesty issue, Guantanamo Bay, the TSA, etc, it seems like a plausible story that the NSA really would do such a thing.  In that light, maybe I’m wrong - maybe they did try to pull one over on us. One thing’s for sure - we’ll never get an answer we can trust from the CIA.

Strange happenings at Microsoft’s Search Engine

Posted by jerry as Uncategorized

So, with all of the looking at logs I’ve been doing lately, I noticed something really unusual.  Visits from hosts in the same range as the normal MSN bot that appears to be downloading whole pages (css, images, etc), which are referred from a search that looks like this:

http://search.live.com/results.aspx?q=myself&mrt=en-us&FORM=LIVSOP

 The keywords keep changing, and they are landing at different sites.  My theory is that MSN is going through an validating the search results for different terms, and analyzing the whole page - probably in an attempt to stop spam.  I suspect that it is running through the entire index of terms that are associated with the site and “viewing” each in turn.

I’m seeing this activity for all of the sites I own and manage.

 This appears to have been going on for about a week now.  Hopefully MSN is on to something that will help reduce the amount of spam in their search results.

Insight into web attacks

Posted by jerry as Hacking, Security

I’ve been fairly attentive to my web server logs lately.  I noticed something strange this morning in the logs for syslog.org:

200.88.114.166 - - [12/Nov/2007:10:21:21 -0500] “POST /forum/index.php?action=quickmod2;topic=249.0 HTTP/1.1″ 200 11257 “http://www.syslog.org/forum/index.php?PHPSESSID=5537d4fd7661fd20c7aa6aa8b3f05a05&topic=249.msg2124” “Opera/9.0 (Windows NT 5.1; U; en)”

Now, all day long, bots and sites are trying to submit stuff and run automated hacking tools.  This entry caught my eye because it had a session ID.  Not sure why it caught my eye, but it did.  So, I grep for the session id and get this other line:

69.46.16.2 - - [12/Nov/2007:10:21:14 -0500] “GET /forum/index.php?PHPSESSID=5537d4fd7661fd20c7aa6aa8b3f05a05&topic=249.msg2124 HTTP/1.1″ 200 22114 “-” “-”

Grepping the log files for both IPs only gives those two lines.  What I find particularly interesting is that they are clearly different sources, but obviously working together to somehow do something.  Then I decided to look at a longer term - 3 months.  There were a total of 801 hits that included that session ID, going all the way back to the start of the logs.  The sources where from hundreds of different IP addresses.  Some of them running through a battery of tests, but most of them only occuring once.

A search of google for the string turns up nothing - though it probably will now that this article is up.  So, what does that tell me?  At some point long ago, someone probably logged into SMF and included the resulting URL into a database that is used by bots to launch attacks from. 

More on why Google will probably not buy Sprint

Posted by jerry as Uncategorized

So, I thought of a few more issues with this.  The report that prompted the acquisition rumors of Sprint, notes a cancelled partnership with ClearWire.  Why would Sprint back out?  Google is going to buy them, of course. 

Well, not quite.  They may well back out because they were being ACQUIRED, but not necessarily by Google.  BT apparently has it’s sights set on Sprint as well.  So, it’s possible that the source of the rumor is a tie up between BT and Sprint. 

At the very least, this is likely to result in a bidding war for Sprint between Google and BT.  In that event, the $50B that I cited below is probably more like $55B or $60B.  That just makes the deal much less likely to go in Google’s favor.

Can Ron Paul be elected?

Posted by jerry as politics

The answer is: I don’t think so.  I’ve grown to equate the presidential selection process with the top 3 videos on each week’s edition of “America’s Funniest Home Videos”.  You sit and watch the show, and at the end, the producers pick three videos which will be voted on to determine the winner of $10,000, but the videos that are picked are typically lame and definitely not the funniest of the show, but the audience is forced to vote among that set.

The presidential race is not entirely different.  We sit and watch a lot of really interesting candidates, but in the end, we’ll end up having to choose from a select few that the “producers” have hand picked for us - Guiliani &  Romney on one side, Clinton and Obama on the other side.  The media is really the group that determines who gets to play and who doesn’t.  I don’t believe that they have a hidden agenda, are working as part of some covert society, or the like, just that they all want to focus on who they think are going to be the top contenders. In the process, they impact the outcome of the races.

 I was looking at the Ron Paul Money Bomb, and they have a great list of Ron Paul “commandments”:

01. End the Patriot Act Immediately.
02. End the IRS.
03. End the Homeland Security Department.
04. End the Iraq Police Action.
05. End the private ownership of the Federal Reserve.
06. End the national ID Card program.
07. End the sending of jobs overseas.
08. End the flood of illegal immigrants.
09. End preemptive military strikes.
10. End the “future” police state.(a)(b)
11. End nation building & defend OUR nation, not others.
12. End executive war powers. Congress alone can declare War.
13. End the North American Union. Preserve US sovereignty.
14. End the War on terror. Terror is not tangible. Therefore it cannot be won [EVER].
15. End the onslaught of our freedoms and liberties by the Federal Government.

 I definitely want to see most of these put into place.  They are all noble and sensible, but there is so much inertia behind almost all of them, that even if Paul were to be elected, I have no confidence that any of them could be accomplished.  However, there is value in slowing down the course that we’re on, so it might not be all bad. 

In the end, I believe the contortion of Paul’s views by opponents and media, such as abortion and affirmative action, will be his undoing.  I share them, but they will inevitably come across as “minority hating”, “women hating”, etc, even if that’s not the case.

Growing dissent of Ron Paul

Posted by jerry as politics

It’s been interesting watching the groundswell of support for Paul over the past year.  His republican affiliation and anti-war, pro-liberty beliefs are very appealing to many who feel the current administration has been assaulting all that is American.  But now, people are starting to realize that he is a conservative libertarian.  As a libertarian, he has views that the federal government should not be in the education business, it should not be mandating racial quotas or bailing out municipalities after disasters.

I find it really funny that the author of the article in question is clearly anti-Iraq war, yet wants the US to go in and kick some butt in Darfur. Ron Paul’s position is that we don’t go to war unless the threat is against us.  See, it’s a consistent view.

It should also not be suprising that he attempts to pass legislation to stop abortions.  He is, after all, a conservative.  Protecting the lives of a countries citizens is one of the core tenants of a libertarian, so that would appear to be in the perview of the federal government.  You can debate the issue of whether or not a fetus is a life, but in his eyes, at least, it’s clear and he is fighting for what he believes is right.  I’m personally pro-women’s choice, but he isn’t.  His philosophy aligns with mine in many other key areas, though. 

Paul’s desire to do away with the Department of Education is being taken as a anti-education stance.  I can’t believe that for a minute.  I do believe that his stance is that education is a State and local affair, and that the Federal government only screws things up.  History, since the creation of the DoEd, seems to back up his view.

Likewise, hiw view that affirmative action should be abolished is taken as an anti-minority stance.  Again, I can’t believe that is his intent.  Like me, I believe his intent is that discrimination should not be tolerated, and when found, should be prosecuted, but federally mandated minority quotas are not appropriate.

Paul’s view that the Federal government should not have provided aid for Katrina victims is also a hot button. Again, his view is likely not that the people should be assisted at all, just that the federal government is not the right group to do so.  The states  themselves should be doing this sort of thing.

So, in short, it seems that many people are awakening to Paul’s conservative views, and “jumping off the Ron Paul bandwagon”, which will ensure that we continue to have many more years of the same kind of crap that we’ve been experiencing up to now - continued erosion of liberty, increasing our military activities abroad, bigger deficits, more taxes, lower currency value, and on and on.  Good luck with that.  Glad you’re love of the federal programs is worth the complete destruction of the US.

Google to buy Sprint?

Posted by jerry as Uncategorized

Google’s open wireless phone initiative has been discussed frequently, but apparently now there is rumor of Google wanting to buy Sprint.  Certainly it seems to make sense as a way to jumpstart things, but I see a couple of critical flaws that will almost certainly render this just a rumor:

• Sprint (S) has a market cap of about $46B USD.  Google has about $18B USD of assets, and a market cap about over $200B USD.  Sprint would cost more that Google can afford.  Since Google is not in the business, there won’t be synergies similar to other telecom rollups.
• Financing of what would likely by a $50B deal will be very hard to come by in the post apocolyptic credit market. 
• Organizationally, Google and Sprint would tear each other apart, if combined.  The old telecom culture of Sprint would likely be untenable in Google’s fast paced world.
• The bits that I’ve read about what Google wants to do with their phone service leave me wondering if owning Sprint really buys them anything.  If all of the infrastructure needs to be replaced to support some fundamentally new technology that costs say $20B to implement, why would you first spent $50B on a phone company then immediately dump $20B more into gutting and replacing it’s infrastructure. 

So, to me at least, this doesn’t add up.  Given that the stock market is in the toilet, I suspect that if Google did announce such a deal, it would be a boost to the overall market, but I suspect that Google would suffer a beating on Wall Street if they did.  In fact, I would expect rumors of the acquisition to have a negative impact too.

Bad deal.  Buy a start up with the tech you want.  Hire away the talent needed from ATT, Sprint, etc.  Just don’t buy a dinosaur.

My deer crash pictures are apparently pretty popular

Posted by jerry as Uncategorized

This blog doesn’t get a lot of traffic, but I noticed that nearly all of it is to look at the pictures of my car accident.  Many of them are referrals from google for people searching for images of car and deer accidents.  That’s pretty morbid.  My picture is on the second page of nearly all the search results, which means that there are LOT of people searching for pictures of car crashes with deer.  It’s also apparently going around in an email.  To be honest, it’s not really that impressive, but since it seems to be what people want to see and I’m all about delivering, here you go:

Web Site Security Guide

Posted by jerry as Security, Uncategorized

So, in the aftermath of my little incident, I decided to write an article for NetworkStrike on how to keep your website secure.  I’ve included it below: 

Background

The “cost of entry” to run a website is very low now, and we have seen an explosion of small sites on the Internet. Supporting this trend has been the availability of free and open source applications that allow site owners to do nearly anything they want, from blogs to wikis to forums. 

Unfortunately, nearly all of the software has inherent bugs that can be exploited by bad people. The exploitation of such bugs has matured in a similar fashion to the applications themselves.  Compromised web sites are a foundation to many threats currently on the Internet. Site owners are unknowingly supporting illegal activities such as:

• Hosting warez
• Hosting copyrighted files
• Hosting tools to compromise other sites
• Sending massive amounts of spam
• Host phishing sites to steal money
• Become part of command and control for botnets

Running a web site properly is truly becoming a social responsibility. If you are not part of the solution, you are likely part of the problem. 

This guide outlines some general and basic security measures that you MUST take if you want to make sure your site is not defaced or otherwise compromised.

Key elements needed in a web hosting platform

Try as you might, if another site on the server you share does not follow prudent security measures, then your site it still vulnerable. Suphp executes php scripts as the user-id and group-id of the account – not the userid/group id of the web server.

This will allow more restrictive permissions on your directories and will prevent an attacked from being able to read your php files.

Some hosts will not want to use suphp, as it can cause performance problems.

Build a relationship with provider on dealing with security issues

Firewall outbound connections

 This is not always practical or possible, but firewalling traffic originating from the server – other than what is expected – can prevent backdoor tools from phoning home.

Run suhosin patch for php

Suhosin can stop the exploitation of many different types of coding weaknesses and some vulnerabilities in php itself.

Keeping up with the web software you use

• Subscribe to mailing list for any application software used as part of your site.  Nearly all such applications have an “announcement” list that is low traffic.
• Attempt to participate regularly in the forums or discussion lists for the software you use. You will often get advanced warning of security issues and interim fixes.  You will also know if the software is at risk of being abandoned and not updated.
• Upgrade after a security fix release within 3 days.  Vulnerabilities are often exploited soon after they are discovered.
• If an application you use becomes abandon, plan to migrate your site to a new tool as fast as possible.
• Try not to customize software.  This will slow down your ability to patch or upgrade, because you’ll have to rewrite code, test, etc, and that can be difficult to do when it’s not on your timeline.
• Attempt to remove ‘powered by’ and version number references.  Nearly all open source web applications proudly, but this has turned out to be an extrodinarily efficient way to systematically identify sites running vulnerable software. 
  
• Create a file with a random name in your html directory. Do not reference the file in your site. Grep your web logs daily for the file being accessed. Any hits may indicate that your site has been compromised.
  
• Scan for file differences and notify of differences
  

Your responsibilities as a site owner

• Perform frequent off-site backups.  Even if you have a local backup strategy, such as to another server, it is imperative to maintain an offsite backup.  While it doesn’t happen often, datacenters are broken into and servers are phyically stolen.
• Do not store sensitive data like credit card numbers.  Just don’t do it.
• Change account passwords regularly