Comments on: Server hacked (again)

By: steogede

steogede — Fri, 10 Oct 2008 17:02:50 +0000

Clem, do you use any sort of application level firewall – mod_security can be very useful for protecting against this sort of thing. Obviously in addition to a regular firewall. Obviously if you are sure your PHP is now secure, then you can do with out ModSec, but it is a very useful extra layer of protection.

By: Please

Please — Fri, 05 Sep 2008 22:49:25 +0000

I like mintupload. don’t take it away please.

By: Husse

Husse — Sat, 30 Aug 2008 22:47:33 +0000

It’s not the database, but the code used to “manipulate” it that is the cause here – and Oracle – well they are definitely not in a hurry to patch….

By: Chris

Chris — Sat, 30 Aug 2008 16:59:38 +0000

Clem, thanks for the update. I for one will continue to use and endorse Mint for my windows customers making the switch. I’m no expert on SQL, but what SQl database are you using? Would switching to something like Oracle 11g prevent this? I’m sure it’s expensive as all get out. But, might be a worth while investment.

By: Clem

Clem — Fri, 29 Aug 2008 22:57:14 +0000

Yes. We’ve audited all our code after the first attack. And we’ve upgraded all the PHP software we use to their latest versions after the second one 🙂

I don’t think the second attack came from outside though.. I think the first one left a backdoor. Also, we’ve identified vulnerabilities with mintUpload.

By: Will

Will — Fri, 29 Aug 2008 14:42:52 +0000

Can’t you prevent SQL injection?? It’s a relatively simple matter once you identify query string concatenations and entry points. In fact you could skip that and just use the PHP function for filtering SQL escape characters on all input.

By: Husse

Husse — Fri, 29 Aug 2008 09:22:39 +0000

It’s not a quite simple matter. The safety for a system running Mint is in no way compromised by this. Unless you run Wine nothing has happened, Wine as well as Windows can get hit.
And the server was not hit, no security hole in it was used.
It is an SQL injection, meaning that commands where sent that tricked the server to execute “dangerous” commands, and the server “believed” they were issued by the right people. Somehow we had not secured ourselves completely against that. Unfortunately it is possible to do just about anything in this situation and a trojan was left behind that was not detected.
The origin is a bot that “trawls” the net looking for vulnerabilities – any server can get hit by this (Linux, Mac, Windows)
But of course our credibility is hit by this, marginally I’d say as we share what happened with the community.

By: Matt Anderson

Matt Anderson — Fri, 29 Aug 2008 03:57:06 +0000

I don’t understand, if the site is hosted on a gentoo box and not a windows server, then why would it be a problem?

Also, why not run on Mint?

I’m new to Mint but I sure do love it so far!

By: Mathieu

Mathieu — Thu, 28 Aug 2008 22:34:27 +0000

Your honesty in the matter is greatly refreshing. Still, it is troubling that they were able to do this two times in a row. Hopefully up to date servers will solve the problem and it wasn’t an underlying vulnerability in apache, PHP or mySQL.

By: Acid_1

Acid_1 — Thu, 28 Aug 2008 21:35:09 +0000

hehe. windows…