Comments on: Apache.org defaced – Security archive case study http://blog.sucuri.net/2010/03/apache-org-defaced-security-archive-case-study.html Protect Your Interwebs Tue, 07 Feb 2012 14:40:59 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Anonymous http://blog.sucuri.net/2010/03/apache-org-defaced-security-archive-case-study.html/comment-page-1#comment-649 Anonymous Tue, 09 Mar 2010 12:27:43 +0000 http://blog.sucuri.net/?p=56#comment-649 In May 2000, how many PHP shells existed? In March 2010, I believe that number is a bit higher. In May 2000, how many PHP shells existed? In March 2010, I believe that number is a bit higher.

]]> By: http://sucuri.net http://blog.sucuri.net/2010/03/apache-org-defaced-security-archive-case-study.html/comment-page-1#comment-650 http://sucuri.net Mon, 08 Mar 2010 06:16:53 +0000 http://blog.sucuri.net/?p=56#comment-650 Joachim: I agree, it doesn't have to be root, but any user other then the apache one.<br /><br />As far as a php shell, they can be useful yes, but that doesn't take from the fact that you should have a deny all policy. If you see what they did in the text, they opened two different ports in LISTEN mode to do what they wanted.<br /><br />Plus, if you have a restricted php configuration, even a php shell can be hard to pull it off. Joachim: I agree, it doesn't have to be root, but any user other then the apache one.

As far as a php shell, they can be useful yes, but that doesn't take from the fact that you should have a deny all policy. If you see what they did in the text, they opened two different ports in LISTEN mode to do what they wanted.

Plus, if you have a restricted php configuration, even a php shell can be hard to pull it off.

]]> By: Joachim Schipper http://blog.sucuri.net/2010/03/apache-org-defaced-security-archive-case-study.html/comment-page-1#comment-651 Joachim Schipper Mon, 08 Mar 2010 06:12:02 +0000 http://blog.sucuri.net/?p=56#comment-651 Actually, there are plenty of ways to control a computer over port 80 - search for "php shell". One could also argue that updating the web site shouldn't need root. Actually, there are plenty of ways to control a computer over port 80 – search for "php shell". One could also argue that updating the web site shouldn't need root.

]]>