MisterFlibble
18-03-2005, 07:31 PM
I know this is just as much my fault for leaving a world writable directory on my web server by accident, but still... goddamn fucktards! And I don't swear lightly.
While I'm pissed off at this, I'm also offering myself up as an example of what not to do if you run a server of any description. I mean lets face it, we've all made pissy little mistakes that have blown up in our faces.
Some toss-pot has managed to find a directory on my web server that was world writeable/readable. The scum bucket checked every single directory they could find on the server, and attempted to upload a file to it, eventually finding one obscure directory that was free to write too.
The file was a tar file containing a fake eBay site. Once the file was loaded up to my server (according to the log, it was hosted at http://nimeni2005.go.ro/ ip: 81.196.20.134). There is a web server hosted at that IP, but the DNS no longer works.
Anyways, the php page was then used to send out spam email to people asking them to confirm their eBay logins, which were recorded, and used to make fraudulent bids.
Top marks to iiNet who acted within a few hours of this happening. They cut off port 80 and the mail ports on my connection, and called me immediately. They also stayed on the line suggesting places on the server that might have been comprimised.
I'll be zipping up the affected files, and sending them to iiNet tonight. Also, I'll be burning all the affected files to CD, so that when eBay comes looking for them, they can have them.
So, let this be a warning to you all... check your systems for holes. You may now commence your laughing at me.... now.
While I'm pissed off at this, I'm also offering myself up as an example of what not to do if you run a server of any description. I mean lets face it, we've all made pissy little mistakes that have blown up in our faces.
Some toss-pot has managed to find a directory on my web server that was world writeable/readable. The scum bucket checked every single directory they could find on the server, and attempted to upload a file to it, eventually finding one obscure directory that was free to write too.
The file was a tar file containing a fake eBay site. Once the file was loaded up to my server (according to the log, it was hosted at http://nimeni2005.go.ro/ ip: 81.196.20.134). There is a web server hosted at that IP, but the DNS no longer works.
Anyways, the php page was then used to send out spam email to people asking them to confirm their eBay logins, which were recorded, and used to make fraudulent bids.
Top marks to iiNet who acted within a few hours of this happening. They cut off port 80 and the mail ports on my connection, and called me immediately. They also stayed on the line suggesting places on the server that might have been comprimised.
I'll be zipping up the affected files, and sending them to iiNet tonight. Also, I'll be burning all the affected files to CD, so that when eBay comes looking for them, they can have them.
So, let this be a warning to you all... check your systems for holes. You may now commence your laughing at me.... now.