-1

just detected some .htaccess malware on one of my servers (shared hosting). The provider (1and1) doesn't seem to care (we take a look into this on monday).

Is there any good place to report this attack? It seems to be a pretty new one, since Google only has a few hits on it.

I noticed it, since i was seeing this in Chrome when browsing my site:

Error 324 (net::ERR_EMPTY_RESPONSE): The server closed the connection without sending any data.

Don't want to post the "source" htaccess here, but it's listed on this pastebin:

http://pastebin.com/jWnknb1s

1
  • This isn't really anything particularly new.
    – ceejayoz
    Feb 12, 2012 at 18:13

1 Answer 1

5

What are you going to report? Do you know who did it? If it's typical of other attacks, you had a hole that was exploited (wordpress, SQL injection, ...) by any of the thousands of script kiddies out there. Most providers don't care in that there's no practical way to arrest anyone for it.

Your best bet is to get it restored from a backup from before the attack. You detected one file breached. Unless you have file checksums and monitoring in place, you don't know what else changed, so there could be a rootkit in there somewhere or it may be running scripts to do other damage.

Nuke the server, rebuild is the best way to do it.

Reporting it...post what you learn to a blog post, see if others can learn from what you find. There are no Internet police. Your provider will most likely not care because it's your problem unless it affects their network or other customers.

2
  • Just checking logs and backups right now to see where i came from. It actually created a htaccess file on all virtual hosts. I'm aware of script kiddies and co. but since i did not find anything on Google about this specific one, i thought it might be a good idea to post it somewhere else to let people know that there's something to watch out for. Strange thing is it also created an rewrite htaccess even on directories that do not include a Wordpress install or something. I will dig into it and post about it, once i found out how it managed to do so. Thanks
    – bitrocker
    Feb 12, 2012 at 18:42
  • There's no central repo of this information although you can check with sites like CERT. Malware companies treat their information and samples as proprietary (except for ClamAV). You can blog about it and that will get indexed by Google. That's really about it for getting the word out. Feb 12, 2012 at 18:51

Not the answer you're looking for? Browse other questions tagged .