Solved

Security question - php/mysql  - hack

Posted on 2011-09-22
6
457 Views
Last Modified: 2012-05-12
A chinese company has been trying to hack our site.  I have recorded all activity and would appreciate advice to ensure our security integrity is maintained.

They are trying to run the following scripts (this is just a sample, there are lots more they are trying to run).  

They started off with

/muieblackcat

then tried lots of others including
//_myadmin/scripts/setup.php
//phpmya/scripts/setup.php
//admin/my/scripts/setup.php
//mysql2/scripts/setup.php
//phpmyadm/scripts/setup.php
//php1/scripts/setup.php
//webmail2/scripts/setup.php
//pma_mydb/scripts/setup.php

Any ideas exactly what they are after, and the best way to protect ourselves.

We just want to get on with business and it's really frustrating having to deal with idiots like this.

We don't have anything in there of value, it's just a nuisance and costs time.

I would appreciate advice from people who are really strong in security (ideally reformed hackers).  It seems they are after database and trying to setup

I am just wanting to make sure we are as best protected as possible.  We have non standard naming conventions for files and path, use form validation, etc.

I am particularly interested what motivates these people and what I can do to prevent them getting access.
0
Comment
Question by:debbieau1
  • 3
  • 2
6 Comments
 
LVL 3

Accepted Solution

by:
dkellner earned 300 total points
ID: 36584540
It's a standard scan for well known administration programs and their usual names/urls, like phpMyAdmin.  Once they have a valid response for one of these requests (like something else than 404) they'll try to go for the specific thing and its weak spots.  Check all the file/directory rights and owners, make VERY sure that no one is able to write any important directory as www-data, watch out for scripts dealing with passwords (disable error messages that could possibly reveal passwords - redirect all error messages to a logfile outside the web document tree), etc.

95% of these attacks go for known open-source scripts security holes; maybe get some fresh updates for whatever you use.  AND!  If you have a chance, log all mysql queries containing comment signs, coded character strings or the UNION keyword.  Many attacks rely on these.  You can find lots of sites about "mysql injection", read them to know what's out there.

Nothing happened so far - at least I hope so -, don't panic.
0
 
LVL 110

Assisted Solution

by:Ray Paseur
Ray Paseur earned 200 total points
ID: 36590751
Probably script kiddies.  Do these attacks all come from the same IP address?  You might ask your hosting company to block that address.
0
 
LVL 1

Author Comment

by:debbieau1
ID: 36590757
Yes, they do.

Thanks to both of you for the feedback.  What is a script kiddie?  Are these just automated scripts.
0
Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

 
LVL 1

Author Closing Comment

by:debbieau1
ID: 36590764
Both feedback very useful thanks
0
 
LVL 110

Expert Comment

by:Ray Paseur
ID: 36590782
0
 
LVL 1

Author Comment

by:debbieau1
ID: 36590827
Thanks very much.  Interesting reading
0

Featured Post

Register Today - IoT Current and Future Threats

Are you prepared to protect your organization from current and future IoT Threats?  Join our Wi-Fi expert in episode three of our webinar series for a look at the current state of Wi-Fi IoT and what may lie ahead. Register for our live webinar on April 20th at 9 am PDT!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
Ransomware continues to grow in reach and sophistication, putting data everywhere at risk. Learn how to avoid being caught in its sinister clutches with these 11 key tips.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question