"Jakość" amerykańskiego hostingu

Ujęcie w uszy słowa "jakość" jest nieprzypadkowa. Jak już gdzieś na tej stronie wspomniałem ja jestem takim dziwnym adminem, który ogląda swoje logi. Ostatnio bardzo interesujące dla mnie są próby PHP injection. Czyli po prostu wiem, który serwer został zhackowany i przez kogo.

21 grudnia 2006 pojawiła się w moich logach pierwsza próba PHP injection skryptu http://artechinstruments.com/tool20.dat

10 stycznia http://addictivebehavior.net/tool25.dat
20 stycznia http://artechinstruments.com/tool20.dat
21 stycznia http://artechinstruments.com/tool20.dat
31 stycznia http://addictivebehavior.net/tool20.dat
4 lutego http://addictivebehavior.net/tool20.dat
5 lutego http://addictivebehavior.net/tool20.dat
6 lutego http://addictivebehavior.net/tool25.dat
6 lutego http://addictivebehavior.net/tool20.dat
9 lutego http://addictivebehavior.net/tool20.dat
10 lutego http://artechinstruments.com/tool20.dat
24 lutego http://artechinstruments.com/tool20.dat

Witryny te leżą na 65.254.250.101, skontaktowałem się kilka razy - pierwszy raz w 6 lutego (było naprawdę zabawnie z każdym następnym razem) z hostingiem yourhostingaccount.com / bizland-inc.com / bizland.com, za każdym razem plik był usuwany. Moja sugestia, że mają zhackowany serwer była jak widać olewana.

10 marca zaobserwowałem http://hbags.com/tool20.dat czyli 65.254.250.102

5 maja zaobserwowałem http://www.targetkits.com/cgi-bin/echo czyli 65.254.250.104

W sumie kontaktowałem się z nimi 8 razy, za każdym razem plik był usuwany po czym magicznie się pojawiał.

Poniżej przedstawiam zapis czata z 5 maja (poprawiłem w nim swoje literówki aby sobie siary nie robić):

Steve Taylor: Hi Lemat. My name is Steve, how are you today?
Lemat: Hi, I'm pleased to report that your servers are hacked for the 8 time since February
Lemat: I'm sure there is a logical explanation for that, but... currently I cannot find one...
Steve Taylor: I apologize for any inconvenience this has caused you.
Steve Taylor: Could you please provide me with your account username?
Lemat: I'm not your customer
Lemat: And it didn't do any harm to me. It's funny - you are not able to maintain security at your own servers. I have notified you 8 times and even proposed neccesary changes.
Lemat: (well this is 8th time)
Steve Taylor: Could you please let me know what do you mean by our servers are hacked?
Lemat: http://www.targetkits.com/cgi-bin/echo
Steve Taylor: In fact, our servers are up and working fine.
Lemat: take a look
Lemat: are you familiar with term "PHP injection" ?
Steve Taylor: As far as the security is concerned, there are two types of hacks. One is network hack and another is script hack. We ensure that our network is not susceptible to any kind of attack way our architecture and security policies are setup. But we can not guarantee any unauthorized access made to your site due to your programs.
Lemat: Could you review the start of conversation and recall who's server is hacked?
Steve Taylor: Unfortunately, we cannot assist unless you provide us the authentication.
Lemat: I told you: I'm not your customer. Why should I need to auth?
Steve Taylor: Unfortunately, we cannot assist you regarding this issue.
Lemat: Sir, Is there an administrator, who is able to talk about security of your servers nearby?
Steve Taylor: No, Lemat.
Lemat: ok then. As soon as your administrators came up to work they should get this conversation.
Steve Taylor: Is there anything else I can assist you with today?
Lemat: I'm afraid not. Thank you. Good bye

17 maja 2007 http://templarifa.org/modules/PNphpBB2/includes/Welcome.To.PisankStyle

info: You are now chatting with 'Samson Brown'
Lemat: your server has been hacked: http://templarifa.org/modules/PNphpBB2/includes/Welcome.To.PisankStyle
Samson Brown: Hi Lemat. My name is Samson Brown, how are you today?
Lemat: fine. thx
Samson Brown: I apologize for any inconvenience this has caused you.
Samson Brown: Could you please provide me your hosting account username or the domain name associated with your account?
Lemat: I am NOT your customer
Samson Brown: Could you please elaborate the issue?
Lemat: your server has been hacked for the 9th time since February 2007. The above URL is a PHP injection script meaning, that a hacker now is using your server to store his tools.
Lemat: it seems to me that your administrator does not have enough knowledge to properly secure your servers
Lemat: if he worked for me he would be fired immediatelly
Samson Brown: Our servers are secure and not possible to hack. If the user has used the unsecure or the open source script, it can be hacked easily.
Lemat: yeah, and my name is Elvis...
Lemat: the server can be set up to prevent even vulnerable open source scripts to be hacked
Samson Brown: Could you please hold while I ask one of our Security Experts for this?
Lemat: ok
Samson Brown: Thank you for your patience, Lemat.
Samson Brown: Most of the users do not use the hacker protection software's and this Web site should be one among those cases. However, I will intimate the owner of the account and let them know about installation of hack protection software's in their Web site.
Lemat: hmm, then I think I will open this chat dialog for the 10th time SOON...
Lemat: as I said - your admins do not have a clue how to secure in easy way your servers...
Samson Brown: As I mentioned earlier, our servers are secure. I will forward your suggestion to our Server Administrator.
Lemat: my suggestion is: allow_url_fopen in php.ini - there will be no 10th time if you setup this. That option is not required for 99,9% websites to work
Samson Brown: Thank you for your suggestion. I will surely forward this to the concerned person.
Lemat: but as I remind - I have told this earlier...
Lemat: ok, that would be all, thank you, see you SOON ;)
Samson Brown: Is there anything else I can assist you with today?
Lemat: bye

Komentarze: