So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host.  I'm not a big security buff -- frankly I'm just a dev currently responsible for S/A duties due to a loss of personnel.  Accordingly, I'd love any help you server-faulters could provide in assessing the damage from the exploit.  To give you a bit of information:  The file was uploaded into a directory within the webroot, "/_img/fck_uploads/File/".   The Apache user and group are restricted such that they can't log in and don't have permissions outside of the directory from which we serve sites.  All the files had 770 permissions (user rwx, group rwx, other none) -- something I wanted to fix but was told to hold off on as it wasn't "high priority" (hopefully this changes that).  So it seems the hackers could've easily executed the script.  Now I wasn't able to actually locate c99madshell.php itself -- only a bunch of other HTML files containing russian text and a few .xl and .html files with inline PHP that were renditions of the madshell hack.  Upon doing a bit of research, though, it looks like the hack destroys itself after execution -- great.  Anyway, my initial assessment would be this:   Not necessary to rebuild the entire host, as given the isolation of the apache user / group, they shouldn't have been able to get system level passwords. It is necessary to fix this vulnerability by restricting uploads to not have the execute permission, updating the FCKEditor version to correct the original exploit target, and add server-level configuration that denies execution of PHP script within the uploads directory. I should change the DB passwords for the app -- given the configuration file for the database connection lies within the web-root, the hacker most likely could've grabbed it and with it the DB password.   Anyway, please provide any input you guys have regarding what I should tell the bossman.  Obviously it'd be ideal to avoid rebuilding the whole host -- but if thats what we have to take to ensure we're not running a hacked machine, then thats what its going to take.  I really appreciate your guys help.  Also don't hesitate to ask for more information (I'd be happy to run commands / work with you guys to assess the damage).  God damn hackers :(.
281
This is a  about Server Security - Responding to Breach Events (Hacking)   See Also:                  Canonical Version I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:   What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are there other initial considerations? How do I go about getting services back online? How do I prevent the same thing from happening immediately again? Are there best practices or methodologies for learning from this incident? If I wanted to put a Incident Response Plan together, where would I start? Should this be part of my Disaster Recovery or Business Continuity Planning?   Original Version       2011.01.02 - I'm on my way into work at 9.30 p.m. on a Sunday because our server has been compromised somehow and was resulting in a    attack on our provider. The servers access to the Internet   has been shut down which means over 5-600 of our clients sites are now   down. Now this could be an FTP hack, or some weakness in code   somewhere. I'm not sure till I get there.      How can I track this down quickly? We're in for a whole lot of   litigation if I don't get the server back up ASAP. Any help is   appreciated. We are running Open SUSE 11.0.            2011.01.03 - Thanks to everyone for your help. Luckily I WASN'T the only person responsible for this server, just the nearest. We managed   to resolve this problem, although it may not apply to many others in a   different situation. I'll detail what we did.      We unplugged the server from the net. It was performing (attempting to   perform) a Denial Of Service attack on another server in Indonesia,   and the guilty party was also based there.      We firstly tried to identify where on the server this was coming from,   considering we have over 500 sites on the server, we expected to be   moonlighting for some time. However, with SSH access still, we ran a   command to find all files edited or created in the time the attacks   started. Luckily, the offending file was created over the winter   holidays which meant that not many other files were created on the   server at that time.      We were then able to identify the offending file which was inside the   uploaded images folder within a  website.      After a short cigarette break we concluded that, due to the files   location, it must have been uploaded via a file upload facility that   was inadequetly secured. After some googling, we found that there was   a security vulnerability that allowed files to be uploaded, within the   ZenCart admin panel, for a picture for a record company. (The section   that it never really even used), posting this form just uploaded any   file, it did not check the extension of the file, and didn't even   check to see if the user was logged in.      This meant that any files could be uploaded, including a PHP file for   the attack. We secured the vulnerability with ZenCart on the infected   site, and removed the offending files.      The job was done, and I was home for 2 a.m.            The Moral   - Always apply security patches for ZenCart, or any other CMS system for that matter. As when security updates are released, the whole   world is made aware of the vulnerability.   - Always do backups, and backup your backups.   - Employ or arrange for someone that will be there in times like these. To prevent anyone from relying on a panicy post on Server   Fault.
74096
I got the trusted host settings error.      The trusted_host_patterns setting is not configured in settings.php. This can lead to security vulnerabilities. It is highly recommended that you configure this. See Protecting against HTTP HOST Header attacks for more information.    I read the  but I'm not understanding some of the basic context.   Are the "trusted hosts" me and other administrators who want to be able to administer the site remotely?  If so, would I add my PC's domain to the trusted host list?
15265
A high-reputation, highly-active user has already been dinged once for a sockpuppet, and I just dinged him again. He probably has another sockpuppet as well.   What are the guidelines for handling users who game the system in this fashion? Specifically,   How can I be sure I'm looking at a sockpuppet? When should sockpuppets be considered a problem? How should moderators handle problematic sockpuppets once they've been identified? I was suspended for sockpuppetting and feel this is unfair
55136
First of all, I'm not looking for miracle... I know how PHP works and that there's not really way to hide my code from the clients without using encryption. But that comes with the cost of an extension to be installed on the running server.  I'm looking for something different though... I'm not looking to encrypt my code or even obfuscate it. There are many PHP scripts without encrypted/obfuscated code but they are commercial applications. For instance, vBulletin and/or IP.Board forum applications.  I just want to know what approach do these guys use for their applications...  I'm also open to any other suggestions.  Please note that I'm a single person and not working for a company. My product is also very specific, it won't sell that much. I just want you guys to know that I can't afford to consult a legal professional either to sue someone or prepare a commercial license. I'm just looking for a simple way to protect my simple product, if it's indeed possible, somehow...
13840
I read these two threads:         And I got a little bit worried, is my Ubuntu machine safe? Or am I vulnerable to this vulnerability?  The second article mentioned that:     The flaw actually resided in the way Samba handled shared libraries.   The other thing that they say is all versions from versions 3.5.0 onwards since 2010 are vulnerable.     At that time, nearly 485,000 Samba-enabled computers were found to be exposed on the Internet, and researchers predicted that the SambaCry-based attacks also have potential to spread just like WannaCry ransomware widely.   .   I don't have a samba server however I've got samba-libs package installed.  What, if anything, should I do?  I'm running Ubuntu 16.04.
97385
Given that the WannaCry ransomware exploit is going around I wanted to check if my computer has the specific security update that should stop the vulnerability - apparently, MS17-010, assuming I'm understanding the vulnerability and that is indeed the right patch. How would one check that detail?   tries to give some detail but it's gibberish to someone who's not well versed with registry keys (I think I touched them once before to dig out a stubborn virus back when XP was still a thing - that's it.)  searches give some clues regard command line options but they're not all that clear and I don't like running commands I don't understand.
19951
My for-fun WordPress blog at  (running WordPress 3.1.1) got hacked -- it was showing an &lt;iframe&gt; on every page like so:  &lt;iframe src="http://evilsite.com/go/1"&gt;&lt;/iframe&gt; &lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;  &lt;html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"&gt;    I did the following   Upgraded to 3.1.3 via the built-in WordPress upgrade system Installed the  (lots of critical warnings on unusual files) and  (this showed all green and clean, so I uninstalled and removed it after running) Changed MySQL password. Changed all WordPress user passwords. Connected via FTP and downloaded the whole filesystem (not large, this is a WordPress-only Linux shared host) Diffed the filesystem against an official ZIP of WordPress 3.1.3 and removed or overwrote anything that did not match.   I am quite sure that    all the files on disk are official WordPress 3.1.3 files there are no "extra" files on disk other than my one /theme, the Exploit Scanner plugin (which I just downloaded), the /uploads folder, and a tiny handful of other expected files. My other plugin, wp-recaptcha, matches the current official downloaded version. I also checked the .htaccess file and nothing looks wrong there     I did not touch the database, but I am struggling to think how anything in the database could be malicious without special PHP code to make it work?  My WordPress blog appears OK and hack-free now (I think), but is there anything else I should check?
64798
When writing answers on here, it's often necessary to create a new script and chmod +x it to make it executable. I won't go into whether this is a good thing or not, but explaining to people that they need to fire in three separate command (and teaching them to use nano!) is a bit of a waffle.  Is there anything easier?
63741
Concrete issue: The  is at version 1.0.5-1, released in July 2011 according to the .  The recent memory-disclosure vulnerability (, , ) isn't fixed in 1.0.5-1. If I'm not misreading the Ubuntu CVE page, all Ubuntu versions seem to ship a vulnerable nginx.   Is this true?  If so: I thought there was a security team at Canonical that's actively working on issues like this, so I expected to get a security update within a short timeframe (hours or days) through apt-get update. Is this expectation -- that keeping my packages up-to-date is enough to stop my server from having known vulnerabilities -- generally wrong? If so: What should I do to keep it secure? Reading the  wouldn't have helped in this case, as the nginx vulnerability was never posted there.
821
So it looks like Stack Exchange now supports HTTPS (to some extent). Which is awesome! But there are a few problems, the main one being that some content is delivered over the CDN, which is plain HTTP. This causes browsers to complain about "unsecured content":
109076
I've been getting some bots trying to get hold of my database by mass attacking /sertup/scripts.php of various database program. I wanna ban such activities.  The closest I found was this:   What is the best way, or is there any scripts to ban bots from attacking?  Thanks.
64580
I found some articles related to this, but they were not sufficient for me. I want to know how the localhost works and why is it the same on many different machines?   How does the localhost block the access to the website when we use it in the host file to block the website?
117907
Got an apache log entry that looks like this, actually I have a bunch of them spread out over time.  XXX.XXX.XXX.XXX - - [27/Apr/2012:14:39:52 -0500] "-" 408 - "-" "-"   It wasn't a GET or POST, the method was "-".   Anyone else seen requests like this?  It wasn't from the penetration tester, but I have it from LOTS of other IPs from Apr of 2012 up until and including today.  We failed it with a 408, just wondering what someone might be trying and googling for minus sign does NOT work.
7387
Can someone explain SQL injection?  How does it cause vulnerabilities?  Where exactly is the point where SQL is injected?
66811
I've just heard of this bug "Dirty COW" that allows any user with read access to files to also write to them and gain administrative access. How do I protect against this bug?
112106
I accidentally executed  chmod 755 -R $HOME   For now everything works fine, but I haven't rebooted my laptop yet.   I wanted to know what are the consequences of my actions? I'm especially concerned about configuration files. Could something break?  The only important thing I can think of is to set back correct permissions on ssh keys. Is there anything else I should take care of?  I'm aware of exising question: , but it seems to address bigger issue which is running chmod on system directories.
107224
Im having issues as to which user should own my www directory - ftp or apache? When set to the ftp user, the user can add, remoe and easily modify files but php file system actions generate permission denied errors (ofcourse because they require the user to be apache). If however, the www directory is chown to apache, the ftpuser wont be able to perform some actions like file modification and deletion. Any one ever encountered similar issue? What's the fix? Thanks