Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
    Tweeted twitter.com/#!/StackSecurity/status/432498734157791232
4 added 164 characters in body
source | link

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

edit1: Anyone got any tips on how I can find out whether or not a user got full control of my www-data account, or if it goes through HTTP calls to a PHP file?

Edit2: Found this nugget of a file when searching for PHP files modified the last 48 hours (I had personally modified zero).

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

edit1: Anyone got any tips on how I can find out whether or not a user got full control of my www-data account, or if it goes through HTTP calls to a PHP file?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

edit1: Anyone got any tips on how I can find out whether or not a user got full control of my www-data account, or if it goes through HTTP calls to a PHP file?

Edit2: Found this nugget of a file when searching for PHP files modified the last 48 hours (I had personally modified zero).

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01
3 added 168 characters in body
source | link

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

edit1: Anyone got any tips on how I can find out whether or not a user got full control of my www-data account, or if it goes through HTTP calls to a PHP file?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

edit1: Anyone got any tips on how I can find out whether or not a user got full control of my www-data account, or if it goes through HTTP calls to a PHP file?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01
2 added 9 characters in body
source | link

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account.

As of yesterday ~19:00 CET, my GMail "sent mail" folder suddenly got overwhelmed with Returned mail delivery reports from Mail Delivery Subsystem. I could see that someone is attempting to send outgoing emails (spam) from my system using the www-data. Luckily for me, they were also attempting to alter the From-field, which was denied by (AFAIK) Google. Here is a (sensored) transcript from mail.log:

Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: Authentication-Warning: ip-xxxxx.ec2.internal: www-data set sender to thelma_combs@mydomain.com using -f
Feb  4 18:58:10 ip-xxxxx sendmail[740]: s14IwAHQ000740: from=thelma_combs@mydomain.com, size=464, class=0, nrcpts=1, msgid=<201402041858.s14IwAHQ000740@ip-xxxxx.ec2.internal>, relay=www-data@localhost

I've "shut down" sendmail by chmod'ing the executable to 000.

So the thing is I'd like to get sendmail up and running again while closing the security hole. I'm a bit of a loss of where to start. I'm not a Linux expert although I've managed to set this system up.

I'm running a total of 5 web sites (Virtual hosts) on the system, and I'm pretty confident that one of them, and which one of them, is compromised. In the log above, I've swapped the real domain of one of my 5 sites with "mydomain.com". So I'm pretty sure it's that particular domain which is attacked. I can't find any suspicious activity in the apache access log though. Where do I go from here?

System:

  • Ubuntu 12.04 LTS running at Amazon EC2
  • PHP version: 5.3.10-1ubuntu3.2 with Suhosin-Patch (cli) (built: Jun 13 2012 17:19:58)
  • Apache2 version: 2.2.22
  • Website running PHP Fusion CMS system v7.01.01
1
source | link