Reputation
3,173
Top tag
Next privilege 5,000 Rep.
Approve tag wiki edits
Badges
1 14 20
Newest
 Curious
Impact
~397k people reached

  • 0 posts edited
  • 0 helpful flags
  • 254 votes cast
Aug
24
comment Automatic detection of a compromised web server
@RuchirGodura - no, but I haven't tried. Earlier experiences with "just checking if the website is up", and monitoring other networked services has led me to conclude this is such a hard problem as to have no good solution.
Aug
23
comment Thousands of 404s from various search engines
@QuestionOverflow - I knew that my 404.php was doing redirects all along, I just missed the fact that someone would actually try those fake URLs against my server. My initial response to the fake porn URLs was to redirect them to real porn URLs, in hopes of making everyone go away. I think my question is relevant here: if there's some way to submit URLs to multiple search engines, you get them to do your DDoS work for you.
Aug
22
comment Thousands of 404s from various search engines
@schroeder - still looking for why Google, Yandex, Yahoo, Baidu and MJ12Bot all decide to ask for the same porno URLs more or less on the same day. Is this revenge for the honeypot or some kind of DDoS? Also, how does one get at least 4 or 5 search engines to all crank up and hit a site on the same day?
Aug
22
comment Thousands of 404s from various search engines
Thanks for the in-depth answer, but the porn redirects are on purpose. I put code in my 404.php file to redirect requests for those files to "shock porn". I'm not running WordPerfect or Joomla, I've got a WordPerfect honey pot going to tarpit all those password guessers, and collect malware files.
Aug
22
comment Thousands of 404s from various search engines
@schroeder- this is embarassing, my 404.php file does those redirects - my site isn't compromised. I got fed up with the constant stream of requests for non-existent files, and decided to redirect people to "shock porn", like goatse. You could ask for any URL that has one of the 14 components I listed, and you'd get redirected. I've taken that feature out.. Ask for index.php, wp-login.ph you'll get a WordPerfect honey pot. Ask for index.html, and you'll get the real web site. Apologies for redirecting you to shock porn.
Jul
2
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - The linux "file" command does a good deal more than looking at magic bytes: support.f5.com/kb/en-us/solutions/public/16000/300/… "file" has an ELF file parser, and it caused some problems. Note that the "strings" utility uses libbfd, also parses ELF headers, and also had a vulnerability: lcamtuf.blogspot.com/2014/10/…
Jul
1
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - certainly. The post-processor could be any hex editor, in the case of the mangled SHeader executable. And maybe such a trick fools anything that uses libelf, but it won't fool anything more robust - it doesn't fool the kernel's loader. But why keep a Linux 2.0.0 machine (or VM) around? What's the advantage there?
Mar
18
comment Why would malware try to remove other malware?
Does the removing program qualify as "malware" if it's removing malware?
Aug
3
comment Is Linux really that secure, with only root password denying external access?
@SPRBRN - you don't need root access. It's certainly possible to set up a particular linux installation so that doing "sudo pacman -S spork" is what you would do. I believe Ubuntu and maybe Debian do things that way - no root user, just temporary permissions. But an installer is a pretty intimate piece of software - if you can get someone to install kinked software, the system can be corrupted, ACLs, root users or sudo or some other mechanism.
May
21
comment What attack requests “wp-admin” URLs without login cookies?
see updated question for extra information. My site has only ever run a honey pot that resembles WordPress. The requests appear isolated - not preceded by requests for wp-login.php, or followed by requests for anything else.
Feb
25
comment How big is the threat of Desktop Linux malware?
@curiousguy - great. Write your own explanation of why Linux has so much more malware than Windows. Oh, wait...
Jun
22
comment Are Linux vendor-supplied security updates enough for PCI Compliance?
Don't confuse "PCI DSS compliance" with "security".
Jun
14
comment Why is blog spam always written so badly?
+1 for mentioning the Herley paper. All of the explanations above assume huge amounts about spammers that can't often all be true.
Mar
18
comment Concrete figures on password cracking in the wild
Why leak the password DB if you're not going to crack the passwords - I don't think you can safely try to guess motives on that sort of thing any more. We've seen enough Anonymous and just plain random things (like the leaked credit reports last week) for me to believe that imputing a motive makes sense.
Feb
17
comment Need advice on linux server being hacked
That crontab entry is bizarre and interesting. If you google for skdet, you find that it's a circa 2008 rootkit detector. skdet.tgz seems to constitute a rootkit, albeit one that has 2004 dates on all files. The readable parts look ancient, and like they don't work. I bet the crontab entry isn't the real rootkit, just some vestigial code left in the real rootkit.
Feb
6
comment How do antiviruses scan for thousands of malware signatures in a short time?
Are you sure about ignoring non-executable files? Given how often a Windows exploit pops up using a previously believed-to-be-un-executable file, and the lack of documentation about what extension goes to what executable, I'd think that every file would have to be scanned.
Jan
2
comment Are older viruses removed from virus definition files?
I suspect that the answer is "no, they're never removed", as there's no incentive for A-V companies to remove signatures of old viruses. The old viruses never change, so the signatures can just rest in peace. On the other hand, if you take out a signature too early, well, "Virus Bulletin" might ding you when you can't detect EICAR.COM or something really ancient, Lehigh, maybe.
Dec
20
comment How can I explain SQL injection without technical jargon?
@Kevin - well, I believe this site has a pretty international audience. I've only written checks in the USA, I would guess that UK or European checks would work similarly, but I don't know personally. I haven't written many for some years. I mostly do payments on-line. So "back in the day" seems correct to me, as does "In the USA". Please accept my most humble apologies for any misapprehensions I might have promulgated. I only meant to give an analogy that might not apply anywhere outside the USA.
Dec
20
comment How can I explain SQL injection without technical jargon?
@Kevin - I'm told that checks/cheques are pretty rarely used in the UK and maybe elsewhere in Europe. I very rarely write out a check these days, although I often do ACH, which doesn't require me to write much, if anything.
Dec
15
comment Lamp server sandbox for testing malicious php script
The difficulty with that is that calls to eval() can be arbitrarily obfuscated. If you don't discover and replace all calls to eval(), you can end up running the malicious code, instead of writing it to a file.