4

Recently, a website I hosted (a wordpress site) for a friend got hacked and all php pages had added code at the bottom in the form of echo base64_encode(...);. Thus there were unwanted ads on very page.

The webserver is apache2 running suphp.

I imagine a recursive chattr +i on all php files that don't need to be modified/upload by a website would protect against such an attack. Am I right to believe this and would there be any good reason not to do this?

1
  • are you sure the actual php files were edited instead of this unwanted code being injected in some other way (like a problem with the footer)?
    – mcgyver5
    Jan 13 '15 at 17:38
2

The only reason I can think of is that it makes applying updates painful. However of the server is not running suphp and you apply correct file permission the apache user should not be able to overwrite these files. I've seen attacks like this using stolen ftp credentials so make sure you change those too.

2
  • There is no ftp access available. Also, by running suphp, apache runs the file as the same user group as the owner of the php files, so do you mean that permissions 444 would be sufficient to avoid "chattr". Isn't there a hack that could enable hacker to change permissions?
    – BlakBat
    Jan 13 '15 at 11:37
  • Under suphp chmod would not work, whereas if the file owner and apache operated as different users it would.
    – wireghoul
    Jan 13 '15 at 11:54
2

At the risk of hijacking this into a rant about why you shouldn't run suphp...

Since the suphp user is the file owner, malicious code running in the context of apache has the right to modify all the files owned by this user.

Running suphp is effectively the same as a recursive chmod 777 on your webroot if your website has a vulnerability. While it may offer minimal benefits in a multi user environments I've never found the trade off to be worthwhile.

2
  • Only root (or a process possessing the CAP_LINUX_IMMUTABLE capability) can "chattr (+/-)i"; so the suphp user can't remove the i flag.
    – BlakBat
    Jan 28 '15 at 10:45
  • Doh, I failed hard on that one. However, now both the user and root are slaves to the need to change files. You must have some crazy incentives to run suphp to put up with that.
    – wireghoul
    Jan 28 '15 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.