{"id":82,"date":"2012-06-08T12:10:12","date_gmt":"2012-06-08T01:10:12","guid":{"rendered":"https:\/\/mindbleach.com\/words\/?p=82"},"modified":"2012-10-25T10:26:26","modified_gmt":"2012-10-24T23:26:26","slug":"monitoring-against-website-exploits","status":"publish","type":"post","link":"https:\/\/mindbleach.com\/words\/2012\/06\/08\/monitoring-against-website-exploits\/","title":{"rendered":"Monitoring against Website Exploits"},"content":{"rendered":"

Installing ready-made web applications on your server is easy, and gets you up and running quickly. It also means you’re running the same code as thousands<\/strong> of other web servers, which presents a juicy target to malicious hackers; find one exploit and you have access to all those machines!<\/p>\n

Several times now, my server’s been broken into by some automated exploit, through versions of Gallery and Dokuwiki that were a little out-of-date. (Mea culpa, but they were used infrequently)\u00a0Each time the exploit script would modify my .htaccess or php files to direct users away to some dodgy gambling or attack-the-user website.<\/p>\n

The first option would be to defend against an exploit being able to modify any of these files. Unfortunately the hosting provider runs PHP as me, so I couldn’t figure out how to prevent those files (also owned by me) being modified. These exploits seem to know how to use chmod.<\/p>\n

A second option is to monitor for any changed files; I was only finding out about these attacks when Google added my site to their ‘naughty’ list.<\/p>\n

It’s very simple:
\nfind \/home\/mrtrick \\( -name \".htaccess\" -o -name \"*.php\" \\) -a -mmin -10 -printf \"%t %p\\n\" | mail -e -s \"Mindbleach files modified\" xxxxxx@xxxxx.com<\/code>
\nCron runs every 10 minutes. If any .htaccess or *.php file was modified since the last time it ran, send me an email with the files. The ‘-e’ option means I don’t receive blank messages.<\/p>\n

Works well! I get an email listing legitimate changes\u00a0every time I upgrade software, and if a file is modified at any other time I’ll see it immediately.<\/p>\n

If the incrond\u00a0daemon were installed on the server it’d be an even better option, as it can specifically watch for file activities.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Installing ready-made web applications on your server is easy, and gets you up and running quickly. It also means you’re running the same code as thousands of other web servers, which presents a juicy target to malicious hackers; find one … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-82","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/posts\/82"}],"collection":[{"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/comments?post=82"}],"version-history":[{"count":4,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/posts\/82\/revisions"}],"predecessor-version":[{"id":142,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/posts\/82\/revisions\/142"}],"wp:attachment":[{"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/media?parent=82"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/categories?post=82"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mindbleach.com\/words\/wp-json\/wp\/v2\/tags?post=82"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}