Solved

Security question - php/mysql  - hack

Posted on 2011-09-22
6
448 Views
Last Modified: 2012-05-12
A chinese company has been trying to hack our site.  I have recorded all activity and would appreciate advice to ensure our security integrity is maintained.

They are trying to run the following scripts (this is just a sample, there are lots more they are trying to run).  

They started off with

/muieblackcat

then tried lots of others including
//_myadmin/scripts/setup.php
//phpmya/scripts/setup.php
//admin/my/scripts/setup.php
//mysql2/scripts/setup.php
//phpmyadm/scripts/setup.php
//php1/scripts/setup.php
//webmail2/scripts/setup.php
//pma_mydb/scripts/setup.php

Any ideas exactly what they are after, and the best way to protect ourselves.

We just want to get on with business and it's really frustrating having to deal with idiots like this.

We don't have anything in there of value, it's just a nuisance and costs time.

I would appreciate advice from people who are really strong in security (ideally reformed hackers).  It seems they are after database and trying to setup

I am just wanting to make sure we are as best protected as possible.  We have non standard naming conventions for files and path, use form validation, etc.

I am particularly interested what motivates these people and what I can do to prevent them getting access.
0
Comment
Question by:debbieau1
  • 3
  • 2
6 Comments
 
LVL 3

Accepted Solution

by:
dkellner earned 300 total points
Comment Utility
It's a standard scan for well known administration programs and their usual names/urls, like phpMyAdmin.  Once they have a valid response for one of these requests (like something else than 404) they'll try to go for the specific thing and its weak spots.  Check all the file/directory rights and owners, make VERY sure that no one is able to write any important directory as www-data, watch out for scripts dealing with passwords (disable error messages that could possibly reveal passwords - redirect all error messages to a logfile outside the web document tree), etc.

95% of these attacks go for known open-source scripts security holes; maybe get some fresh updates for whatever you use.  AND!  If you have a chance, log all mysql queries containing comment signs, coded character strings or the UNION keyword.  Many attacks rely on these.  You can find lots of sites about "mysql injection", read them to know what's out there.

Nothing happened so far - at least I hope so -, don't panic.
0
 
LVL 108

Assisted Solution

by:Ray Paseur
Ray Paseur earned 200 total points
Comment Utility
Probably script kiddies.  Do these attacks all come from the same IP address?  You might ask your hosting company to block that address.
0
 
LVL 1

Author Comment

by:debbieau1
Comment Utility
Yes, they do.

Thanks to both of you for the feedback.  What is a script kiddie?  Are these just automated scripts.
0
Free Gift Card with Acronis Backup Purchase!

Backup any data in any location: local and remote systems, physical and virtual servers, private and public clouds, Macs and PCs, tablets and mobile devices, & more! For limited time only, buy any Acronis backup products and get a FREE Amazon/Best Buy gift card worth up to $200!

 
LVL 1

Author Closing Comment

by:debbieau1
Comment Utility
Both feedback very useful thanks
0
 
LVL 108

Expert Comment

by:Ray Paseur
Comment Utility
0
 
LVL 1

Author Comment

by:debbieau1
Comment Utility
Thanks very much.  Interesting reading
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to dynamically set the form action using jQuery.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now