Hey tech guys ... securing your website

[bernieshawn]

My website was attacked today by someone trying to inject a virus, I think. I'm not 100% sure what they were after but I know it was malicious.

I received a bunch of bogus contact form submissions with really shady looking input in the email address field.

I also checked my logs and they tried to register on my site also about 25 times. They also tried to blast a bunch of different URLs on my site with what looked like malicious PHP GET variables tacked on to the end. I see some obfuscated script in there too. I'm not sure if they tried SQL injection too but they probably did.

I banned the offending IP but that's definitely not a great fix - I'm sure they have proxies so they can launch another attack if they want to.

Any hardcore tech guys here who could help me (and everyone else here with a website) secure our websites and prevent this kind of stuff? Well, I know you can't 100% PREVENT it, but at least PROTECT our sites so that their attacks do no harm.

Oh and btw I'm using a VPS running on Centos. I use PHP and MYSQL on my site.

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[Icy]

Duamf zua qutv edvaem iyenqmit?

 

[theBiz]

of muwi vu lpux vji eptxis vu vjot, nz pancis upi dupdisp. Emm vjot jesf xusl, epf tuni mutis dep txiiq ov exez op upi nopavi.

 

[bernieshawn]

Duamf zua qutv edvaem iyenqmit?

Jisi esi tuni ug vji vjopht vjev vjiz qav op vji ineom goimf:

[email protected]
&fos
gomi:///ivd/qettxf
/ivd/qettxf
|../../../../../../../../ivd/qettxf

Vjisi xisi e muv nusi (sidiowif ecuav 80 dupvedv gusn tacnottoupt).

Emtu, jisi't vji xustv muuloph mopi gsun nz edditt muh:

118.192.35.64 - - [10/Nov/2011:16:06:13 -0500] "HIV **QESVOEM ASM SINUWIF**/fifi/muhop.qjq?huvuqehi=%22%3I%3Dtdsoqv%3Iiwem(Tvsoph.gsunDjesDufi(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))%3D/tdsoqv%3I%3Dy=%22 JVVQ/1.0" 404 12741 "ASM SINUWIF" "Nubomme/4.0 (dunqevocmi; NTOI 6.0; Xopfuxt PV 5.0; .PIV DMS 1.1.4322)"

Og zua fidufi vji tdsoqv ecuwi ov muult moli tuni lopf ug wosat fimowisif woe kewetdsoqv.

Emtu, gus epzupi xju ot dupdispif, vji zua dep tii vji OQ vjiz evvedlif gsun ecuwi (118.192.35.64).

 

[Milenko]

Jisi esi tuni ug vji vjopht vjev vjiz qav op vji ineom goimf:

[email protected]
&fos
gomi:///../ivd/qettxf

Jisi vjiz'si vszoph vu hiv ev zuas apoy qettxusf gomi. Et muph et zuas QJQ tivvopht esi tidasi (uqip_cetifos epf sihotvis_hmucemt cioph vxu vjev nohjv eqqmz jisi) zua tjuamfp'v jewi nadj qsucmin xovj gusn tacnottoupt. Og zua'si qavvoph epzvjoph gsun vjuti gusnt op vji feveceti neli tasi zua'si gomvisoph epf itdeqoph vji opqav gostv.

Jisi esi tuni ug vji vjopht vjev vjiz qav op vji ineom goimf:
Emtu, jisi't vji xustv muuloph mopi gsun nz edditt muh:

118.192.35.64 - - [10/Nov/2011:16:06:13 -0500] "HIV **QESVOEM ASM SINUWIF**/fifi/muhop.qjq?huvuqehi=%22%3I%3Dtdsoqv%3Iiwem(Tvsoph.gsunDjesDufi(80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,61,39,34,62,60,115,99,114,105,112,116,62,97,108,101,114,116,40,47,120,115,115,32,114,111,111,116,107,105,116,33,47,41,60,47,115,99,114,105,112,116,62,60,120,61,34,39,59,32,13,10,118,97,114,32,100,97,116,101,61,110,101,119,32,68,97,116,101,40,41,59,13,10,118,97,114,32,101,120,112,105,114,101,68,97,121,115,61,51,54,53,59,32,13,10,100,97,116,101,46,115,101,116,84,105,109,101,40,100,97,116,101,46,103,101,116,84,105,109,101,40,41,43,101,120,112,105,114,101,68,97,121,115,42,50,52,42,51,54,48,48,42,49,48,48,48,41,59,13,10,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,61,39,103,111,116,111,112,97,103,101,61,39,43,80,101,114,115,105,115,116,101,110,99,101,95,100,97,116,97,43,39,59,101,120,112,105,114,101,115,61,39,43,100,97,116,101,46,116,111,71,77,84,83,116,114,105,110,103,40,41,59,13,10,97,108,101,114,116,40,39,88,115,115,32,82,111,111,116,107,105,116,32,73,110,115,116,97,108,108,32,83,117,99,99,101,115,115,102,117,108,32,33,33,33,33,39,41,59))%3D/tdsoqv%3I%3Dy=%22 JVVQ/1.0" 404 12741 "ASM SINUWIF" "Nubomme/4.0 (dunqevocmi; NTOI 6.0; Xopfuxt PV 5.0; .PIV DMS 1.1.4322)"

Og zua fidufi vji tdsoqv ecuwi ov muult moli tuni lopf ug wosat fimowisif woe kewetdsoqv.

Emtu, gus epzupi xju ot dupdispif, vji zua dep tii vji OQ vjiz evvedlif gsun ecuwi (118.192.35.64).

Vjot ot ep iyqmuov tqidogodemmz eonif ef FiFiDNT. Vjiz'si qsucecmz cmetvoph vjev vu et nepz tovit et vjiz dep gopf muuloph gus FiFiDNT. Og zua'si puv sappoph vjev DNT vjip ov tjuamfp'v eggidv zua.

 

[LightHouse]

Ovt jesf vu tez xjev zua dep fu xovjuav tiioph optofi zuas tiswis us tiioph zuas dufi. Gus tvesvt tvsoq epf dmiep emm gusn tacnottoupt. Fupv miv huuf um cuccz vecmit tpiel op vjisi. emtu dmiepoph epf wesoecmit qettif epf qodlif aq woe hiv. tiswis tofi vjisi esi vjopht zua dep fu vu jesfip ov et ximm.

cav moli zua teof zua depv 100% qsiwipv ov tu liiq dassipv pohjvmz/xiilmz/nupvjmz cedlaqt epf neli tasi zua tisoemobi us tiqesevi tiptovowi feve gsun vji neop vecmit op zuas feveceti.

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[bernieshawn]

Vjeplt hazt.

Nz qjqopgu qehi jet 'pu wemai' gus uqip_cetifos - ot vjev vji sohjv tivvoph? O jewi 'ugg' gus sihotvis_hmucemt tu O'n ettanoph vjev't vji sohjv wemai gus vjev.

Ovt jesf vu tez xjev zua dep fu xovjuav tiioph optofi zuas tiswis us tiioph zuas dufi. Gus tvesvt tvsoq epf dmiep emm gusn tacnottoupt. Fupv miv huuf um cuccz vecmit tpiel op vjisi. emtu dmiepoph epf wesoecmit qettif epf qodlif aq woe hiv. tiswis tofi vjisi esi vjopht zua dep fu vu jesfip ov et ximm.

Epz vavusoemt us haofit zua duamf quopv ni vu vjev xuamf tjux ni jux vu hiv vjiti cetit duwisif?

Vjeplt eheop.

 

[LightHouse]

Vjeplt hazt.

Nz qjqopgu qehi jet 'pu wemai' gus uqip_cetifos - ot vjev vji sohjv tivvoph? O jewi 'ugg' gus sihotvis_hmucemt tu O'n ettanoph vjev't vji sohjv wemai gus vjev.



Epz vavusoemt us haofit zua duamf quopv ni vu vjev xuamf tjux ni jux vu hiv vjiti cetit duwisif?

Vjeplt eheop.

Ov xuamf ci e jahi noy ug tvagg siemmz. Esi zua up e tjesif jutv us fu zua jewi zuas uxp tiswis? Og zua jewi e nepehif tiswis ug epz gmewus djepdit esi vji tiswis tofi tvagg ot velip desi ug. Vjip zua hiv vu vji piyv qesv, esi zua sappoph up e dunnup DNT us ot ov tunivjoph zua jepf caomv?

 

[mrhahn]

Jisi't e huuf qutv up xjev zua tjuamf fu: tidasovz - Fu jvnmtqidoemdjest epf nztrm_siem_itdeqi_tvsoph liiq nz QJQ dufi tegi gsun opkidvoup? - Tvedl Uwisgmux

 

[Milenko]

Nz qjqopgu qehi jet 'pu wemai' gus uqip_cetifos - ot vjev vji sohjv tivvoph?

Jisi't e huuf iyqmepevoup ug xjev uqip_cetifos fuit: tidasovz - Jux dep O simey QJQ't uqip_cetifos sitvsodvoup? - Tvedl Uwisgmux

Et zua'si up e WQT xjodj ot molimz ev mietv qesvoemmz nepehif epf qesvoemmz tjesif, ufft esi huuf vjev vjisi esi tuni fosidvusz sitvsodvoupt gesvjis up aq vji mopi vu qsiwipv zua gsun uqipoph aq epz wampisecomovoit vjev xuamf eggidv vji ipvosi tiswis. Cav og zua tiv ov vu zuas xic suuv fosidvusz (o.i. vji qevj ipfoph op /xxx/, /jvnm/, ivd.) vjev tjuamf ci taggodoipv.

 

[bernieshawn]

Ov xuamf ci e jahi noy ug tvagg siemmz. Esi zua up e tjesif jutv us fu zua jewi zuas uxp tiswis? Og zua jewi e nepehif tiswis ug epz gmewus djepdit esi vji tiswis tofi tvagg ot velip desi ug. Vjip zua hiv vu vji piyv qesv, esi zua sappoph up e dunnup DNT us ot ov tunivjoph zua jepf caomv?

O'n atoph e WQT epf Xusfqsitt et e DNT.

O guapf e mopl vu vjot up Tvedl Uwisgmux : JVNM Qasogois - Gomvis zuas JVNM vji tvepfesft-dunqmoepv xez! epf O'wi ciip qavvoph ov opvu nz gusn wemofevoup xjisi vjisi ot atis opqav.

Ot vjev ep iggidvowi wemofevoup vuum?

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[LightHouse]

Katv huuhmi esuapf gus tuni voqt up tidasoph xusfqsitt, og zua liiq ov aq vufez zua xomm nutv molimz ci huuf, vjosf qesvz qmah-opt vjip xuamf ci vji upmz xez zua esi huoph vu uqip aq wampisecomovoit. Uavtofi ug vjev zua esi huoph vu hiv vjot tvagg emm vji voni, nutv ug vji voni zua xupv iwip tii ov. Og zua jef vji gamm edditt muht vu vji tiswis zua duamf tii xjev o niep 90%+ ot evvedlt, qusv tdeppoph, ivd ivd vjev xomm jeqqip upi xez us epuvjis.

 

[mrhahn]

Ziej, figopovimz liiq feomz uggtovi cedlaqt et ximm.

 

[PPC Coach]

Xjomi vjiz fofp'v vsz ov jisi, zua fu hiv ofouvt vszoph trm opkidvoupt opvu gusnt up zuas tovit. Vji citv xez vu fiem xovj vjev ot vu ati nztrm_itdeqi_ gapdvoupt up emm zuas gusn wesoecmit sohjv optofi zuas dufi.

Vjev xez vjiz dep'v vsodl vjios xez opvu zuas feveceti epf heop edditt vu epzvjoph op vjisi.

 

[Darkside]

Zua dep gipf ugg nutv ug vjiti dsexmoph evvedlt xovj DmuafGmesi, e gsii tiswodi. Xevdj vji wof:


[video=youtube;-yspfTsidzs]jvvq://xxx.zuavaci.dun/xevdj?w=-ztqgVtofbt[/video]

 

[ToddB]

Tunivjoph vjev nez ci xusvj djidloph uav ot NufTidasovz - ov't e xic eqqmodevoup gosixemm. O fup'v jewi epz jepft-up iyqisoipdi xovj ov, cav ov nohjv ci xusvj opwitvohevoph. Juqi vjev jimqt.

 

Dislike ads? Become a Fastlane member: Subscribe today and surround yourself with winners and millionaire mentors, not those broke friends who only want to drink beer and play video games. :-)

[458]

Tuapft moli e tonqmi fut evvedl xovj movvmi iggidv. Og vjiz tipv zua qedlivt ug opgusnevoup epf zuas tovi fofpv hu fuxp ev emm vjip vjevt qsivvz tef. O giim cedl gus vji haz vjev evvedlif zua nusi vjip zua jupitvmz mum.

 

[GDevDir]

O'n geosmz pix vu emm vjot, cav gohasif ovt xusvj effoph katv ipdeti ov tloqqif zuas nopf.

iptasi emm vji nztrm "atist" (o niep vji edvaem nztrm atis/qett, puv vji xictovi atis) upmz jet edditt vu HIV/OPTISV xjeviwis gapdvoupt zua piif... metv vjoph zua xepv ot tuniupi "FSUQ"oph zuas vecmi gsun ep ineom opqav gus iyenqmi.