Busy Evening



I’ve got all traces of the old cms system off of the server now. (Well there might be a README here or there, but all php scripts from the old CMS are now gone.) At this point I can disclose a bit about the sudden move.

Well, for starters, any web scripting is just like your computer software. It needs to be kept up to date, there are people out there that are continually looking for unpatched software that can be exploited. There were a couple of vulnerabilities in the old CMS system which had been fixed sometime back but I had not updated the software install. There are a couple reasons why and I’m sure they remind me of the reasons not to update desktop software.

1) The fixed version was a big change and I didn’t know how much work it might make for me in fixing things.
2) The license of the software had changed at one point and there was a good deal of ambiguity just how pricey the new version was going to be. (By the way they’ve recently returned it to a GPL licence)
3) I didn’t have much time.

OK, no really good excuses on there, but….

I was checking for email Thursday afternoon and noticed that things had “dried up”. No messages had come in after 3PM, so I start nosing around and find the site has been “disabled for security”. This of course had me very interested. I inquired with my host and heard nothing. After waiting several hours, I re-enabled the site and started nosing through log files and looking for anything out of the ordinary. I did find the file that had been compromised. At this point, the site was up, but MySQL, which the CMS relied on was down, so things were relatively safe. After talking with tech support, they disabled the site because it (along with a number of others at my provider) was being used to mount a DoS attack against their DNS servers. Things were “neutralized” now and it’s time to look at updating your CMS. Well, it just so happens that the website for the CMS I was using was unresponsive, which had me look around and find wordpress. (Which I’m quite glad I did BTW.)

I think what compounded the problem is there were several installs (and versions) of the CMS in my site. I had done a minor update to the one in my main site, but an older testing version had been neglected and was discovered by the hackers that were using it. (Another reminder that a test folder on a webserver isn’t private.)

If there’s enough time tomorrow I’ll try to give a few more details on the exploit that was.

Related Posts

Blog Traffic Exchange Related Posts
  • RSS feed to spread the word of software updates The computer security landscape today is such that pretty much ALL software, whether it's Operating System, Office Suite, Web browser or device driver is at any given time "the weakest link". One of my dreams as someone that does IT is "what IF there were an easy way to keep......
  • Apple Security Update 13 Seperate vulnerabilities are addressed by the latest Apple security updates. 9 vulnerabilites exist in network facing services like the web server, a couple in the web browser, another couple in SSL (secure socket layer) handling. In other words, get updating. I haven't used the Apple OS much in a......
  • How to Remove SoftStronghold | Soft Stronghold Removal Guide SoftStronghold is the latest rogue antivirus application in the LONG line of Wini rogues... Softveteran was the most recent (see the softveteran removal guide) but.... SoftCop (see the SoftCop removal guide.) But, the line goes much further back.... Softsoldier (How to remove SoftSoldier), ( TrustFighter TrustFighter Removal Guide, TrustSoldier removal......
Blog Traffic Exchange Related Websites
  • Navigating Hunting Sites There are thousands and thousands of hunting sites online. Someone who enjoys hunting and surfing the Internet could spend weeks just discovering new sites and evaluating them. Because so many new sites go up each day, it would be a never ending pursuit. But because there are so many, that......
  • Google Web Page Rank Drop Off Several webmasters have been reporting a Google Page Rank drop in latest weeks which has had blended outcomes on the search positions of numerous millions of web internet sites. Whilst numerous marketplace insiders were bemoaning drops in search consequence positions, many internet sites appeared to come by means of Google's......
  • Free Spyware Removal Software I do not recommend using free spyware removal software for many reason but if your going to you might as well use the best free spyware products out there. In the end of this article we will tell you why not to use these programs as your main source of......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site