Reputation
3,133
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 14 20
Newest
 Curious
Impact
~397k people reached

  • 0 posts edited
  • 0 helpful flags
  • 252 votes cast
Aug
24
comment Automatic detection of a compromised web server
@RuchirGodura - no, but I haven't tried. Earlier experiences with "just checking if the website is up", and monitoring other networked services has led me to conclude this is such a hard problem as to have no good solution.
Aug
24
answered Automatic detection of a compromised web server
Aug
23
comment Thousands of 404s from various search engines
@QuestionOverflow - I knew that my 404.php was doing redirects all along, I just missed the fact that someone would actually try those fake URLs against my server. My initial response to the fake porn URLs was to redirect them to real porn URLs, in hopes of making everyone go away. I think my question is relevant here: if there's some way to submit URLs to multiple search engines, you get them to do your DDoS work for you.
Aug
23
revised Thousands of 404s from various search engines
Add paragraph about maximum reqs per second, and who did it.
Aug
22
revised Thousands of 404s from various search engines
added 404 characters in body
Aug
22
comment Thousands of 404s from various search engines
@schroeder - still looking for why Google, Yandex, Yahoo, Baidu and MJ12Bot all decide to ask for the same porno URLs more or less on the same day. Is this revenge for the honeypot or some kind of DDoS? Also, how does one get at least 4 or 5 search engines to all crank up and hit a site on the same day?
Aug
22
revised Thousands of 404s from various search engines
Add apology and explanation.
Aug
22
comment Thousands of 404s from various search engines
Thanks for the in-depth answer, but the porn redirects are on purpose. I put code in my 404.php file to redirect requests for those files to "shock porn". I'm not running WordPerfect or Joomla, I've got a WordPerfect honey pot going to tarpit all those password guessers, and collect malware files.
Aug
22
comment Thousands of 404s from various search engines
@schroeder- this is embarassing, my 404.php file does those redirects - my site isn't compromised. I got fed up with the constant stream of requests for non-existent files, and decided to redirect people to "shock porn", like goatse. You could ask for any URL that has one of the 14 components I listed, and you'd get redirected. I've taken that feature out.. Ask for index.php, wp-login.ph you'll get a WordPerfect honey pot. Ask for index.html, and you'll get the real web site. Apologies for redirecting you to shock porn.
Aug
22
awarded  Curious
Aug
21
asked Thousands of 404s from various search engines
Aug
21
answered What is This Script Trying to do
Jul
24
awarded  Constituent
Jul
20
awarded  Caucus
Jul
2
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - The linux "file" command does a good deal more than looking at magic bytes: support.f5.com/kb/en-us/solutions/public/16000/300/… "file" has an ELF file parser, and it caused some problems. Note that the "strings" utility uses libbfd, also parses ELF headers, and also had a vulnerability: lcamtuf.blogspot.com/2014/10/…
Jul
1
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - certainly. The post-processor could be any hex editor, in the case of the mangled SHeader executable. And maybe such a trick fools anything that uses libelf, but it won't fool anything more robust - it doesn't fool the kernel's loader. But why keep a Linux 2.0.0 machine (or VM) around? What's the advantage there?
Jun
30
asked Why use oddly compiled ELF files for Linux malware?
Jun
10
awarded  Nice Answer
May
17
awarded  Popular Question
Mar
24
awarded  Yearling