TL & DR
How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php works? Or is it a problem of preinstalled configs which need to be changed to secure a system1?
I have read many times here about people complaining about some files on their system they don't know what they do, where they come from nor how they got there.
I actually can't understand it either, so how can this be? Is this constituted to the mechanics of PHP2?
I for example set up my webserver as fcgi-app, written in plain C which is communicating over CGI with nginx.
The FCGI daemon (under which the webhost is invoked) is in a user group that has special permissions for reading/writing to the paths where files are stored. So first of all, when a user is uploading something, my app is exactly parsing the whole HTTP package. So I can't really get how there could get something stored I don't want to be stored there. But ok, chances are high I don't know everything (of course I don't) so let us assume some one made a HTTP packet with malicious body content get through the nginx so its the input of my app. This app now doesn't notice it isn't a
$WhatEverUsersAreSupposedToUpLoad$ and even puts this malicious file now to the place where all the other files are. With the same restricted access all other files have (named just this daemons group can read/write the file).
So all I can imagine how one can use such a file now to exploit my system requires a major bug in my FCGI-app resulting in
- 1: Some how lets an web-user change the access rights of the app it self to the files to executable AND somehow executes it
- 2: Lets my web app just access the file as it is supposed and then somehow uses the content to exploit the app itself
- 3: somehow makes my app which parses its input data, make execute the parsed file in the app itself. (Since the C executable code has to be compiled I can't imagine any scenario where this could happen as long I ensure no buffers will flow over)
as I have written out all 3 points now I have to admit they sound nonesense... But what else?
Are those concerns not about their applications itself, but about the configurations of an naked OS and the apps they installed making just bypass any meassurments made to the stuff beeing worked with but some default main features of the OS are exploitable if not disabled those configurations?!
If so should I be concerned as well?
All I ever configured is disabling remote root login and restricted SSH access to key authentification only.
- postgresql (restricted it to local acess by the web-daemons usergroup only)
- nginx (configured it to allow fcgi with my app as execution path)
- installed the latest fcgi for freeBSD supported by nginx.
I actually don't even have php on my system.
But since I'm not a security person (otherwise I would probably not ask this),
I dont know if that's the source, and it's the last thing remaining I could imagine to be causing this threat. Are there other preconfigured files in a naked install that are causing this kind of securitythreat by itself?
1This would let me assume a naked latest OS install is to be considered exploitable?!
2My assumption comes from the fact that this complaint everytime is related to php