Sorry to be the prophet of doom in the list - but this is starting to
worry me.
I found an interesting post at
http://www.ossec.net/wiki/index.php/WebAttacks_links that describes some
of the attacks that are being attempted against hosts that run PHP. Note
particularly the links in section 1.2, that show the actual code that
has been found "in the wild" on compromised systems.
The attacks of course are dependent on one or more of your clients
having some braindead php code in their web space .... It only takes one
client to forget to upgrade an open source application to fix a
vulnerability, and you will have people getting all sorts of information
from your server
This information can in turn help them to know how to do a full
compromise and take control of your host.
How can we protect ourselves? What is the common pattern here? It seems
that any occurrence of "://" in a http query string is required for all
of these attacks. What I would like to do (if it is possible) is to
block this from being passed to ANY php script in the query string or
POST variables etc.
Does anyone have any ideas on how to block this? I was thinking of
something at the apache level - any ideas?
Regards,
Greg.
--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.