Skip to main content
Information Security

Return to Answer

deleted 36 characters in body
Source Link
rook
rook
  • 47.3k
  • 10
  • 97
  • 183

1)Make sure all libraries, modules and applications are fully updated.

2)Stop using FTP. There are worms that spread by sniffing for FTP Logins.

  1. Run PHPSecInfo

4)Consider using a Web Application Firewall (WAF) like mod_security.

  1. If you don't have a WAF you might not have logs of this incident. If by chance you can get an IP address of the attacker or someone accessing the backdoor. REPORT THEM TO THE FBI. (A WAF helps with this)

(Bonus points: replace the backdoor with a simple .php script that logs the ip address. If anyone hits it you'll have an ip for the fbi)

1)Make sure all libraries, modules and applications are fully updated.

2)Stop using FTP. There are worms that spread by sniffing for FTP Logins.

  1. Run PHPSecInfo

4)Consider using a Web Application Firewall like mod_security.

  1. If you don't have a WAF you might not have logs of this incident. If by chance you can get an IP address of the attacker or someone accessing the backdoor. REPORT THEM TO THE FBI.

(Bonus points: replace the backdoor with a simple .php script that logs the ip address. If anyone hits it you'll have an ip for the fbi)

1)Make sure all libraries, modules and applications are fully updated.

2)Stop using FTP. There are worms that spread by sniffing for FTP Logins.

  1. Run PHPSecInfo

4)Consider using a Web Application Firewall (WAF) like mod_security.

  1. If by chance you can get an IP address of the attacker or someone accessing the backdoor. REPORT THEM TO THE FBI. (A WAF helps with this)

(Bonus points: replace the backdoor with a simple .php script that logs the ip address. If anyone hits it you'll have an ip for the fbi)

Source Link
rook
rook
  • 47.3k
  • 10
  • 97
  • 183

1)Make sure all libraries, modules and applications are fully updated.

2)Stop using FTP. There are worms that spread by sniffing for FTP Logins.

  1. Run PHPSecInfo

4)Consider using a Web Application Firewall like mod_security.

  1. If you don't have a WAF you might not have logs of this incident. If by chance you can get an IP address of the attacker or someone accessing the backdoor. REPORT THEM TO THE FBI.

(Bonus points: replace the backdoor with a simple .php script that logs the ip address. If anyone hits it you'll have an ip for the fbi)