Eskimo North

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Security Warning.

     We had a customer who recently had his website defaced by a hacker.

     The customer had an uploader cgi program allowing someone to upload files
to his website with no restrictions.

     The hacker uploaded a php program called php shell which basically allows
them to assume shell functions with a browser.

     Due to the way we have PHP programs execute with the user that owns them's
permissions, this caused this program to execute with the web site owners
permissions so damage was limited to his site.

     However, please be very aware of this type of situation and avoid allowing
any sort of code that can be executed to be directly uploaded to your site.  
If you want to allow people to actually upload php code; have it go to a
non-viewable directory that can't be accessed until you've had a chance to
review it.

     Remember, your PHP and CGI programs execute with YOUR permissions and any
bad behavior can expose your files to theft, damage, or deletion.

 Eskimo North Linux Friendly Internet Access, Shell Accounts, and Hosting.
   Knowledgable human assistance, not telephone trees or script readers.
 See our web site: (206) 812-0051 or (800) 246-6874.