0

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either.

What are common security breaches that would allow this sort of thing to happen?

Mostly what I can think of is if someone has figured out the FTP password somehow, or if there is a form where you can upload files and this can be exploited somehow. Anyways, would appreciate some pointers on what to look for and ways to prevent this from happening.

They are using Surftown as a webhost. Think it is a shared webhost, and they seem to be running PHP 5.2 from what I can read. The site is pretty much just DreamWeaver generated HTML though, so there is no CMS like Drupal or WordPress installed. Don't know much more at the moment, but I'm mostly looking for general clues about this sort of security breach.

list of spam files

Improve this question
3
  • is there a form that allows images/files to be uploaded? Also, what Content Management are they using, if any (Wordpress, Drupal, etc)
    – tombull89
    Jan 20, 2012 at 12:09
  • @tombull89 Not that I know of. And there is no CMS. Think they use DreamWeaver with its crazy templating stuff.
    – Svish
    Jan 20, 2012 at 12:24
  • 1
    Easy. 3 letters. F.T.P. Kill It Dead With Fire.
    – Tom O'Connor
    Jan 20, 2012 at 12:25

1 Answer 1

Reset to default
3

Couple of ways:

  • (s)ftp/shell account compromised.
  • a web form which allows file uploads (and possibly even executing them afterwards...).
  • a vulnerability in CMS such as Drupal or Wordpress.
  • a PHP script which allows to run arbitrary PHP embedded in GET request parameters.
  • a rootkit.
Improve this answer
4
  • How can you run PHP embedded in GET request parameters? Or rather, how do you secure yourself against that?
    – Svish
    Jan 20, 2012 at 12:50
  • Lack of GET request parameter input validation can lead to interesting results, anything from SQL injection to PHP code execution. So, validate the input and make sure (for example) a text field meant for e-mail does contain a well-formed e-mail address and nothing else. PEAR has Validate module available: pear.php.net/package/Validate/redirected and probably there are numerous other ways to do this. :)
    – Janne Pikkarainen
    Jan 20, 2012 at 13:02
  • Yeah, I knew about SQL injection, but not heard of PHP code execution. Unless you use eval or something, but I've never used that before...
    – Svish
    Jan 20, 2012 at 13:59
  • 1
    I'll add this for completeness - it's possible that the hosting provider has it's permissions incorrectly set, allowing others who use the same shared hosting environment to place files in your data area.
    – malcolmpdx
    Jan 20, 2012 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .