4 ms·
>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendat
by ryanlol 10y ago
>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website.
https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068
Look again, they handed you more than enough information.
>The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions.
root@:~/super_secret_govt_malware_samples# grep * -e bas|tail -n2
D285115E97C02063836F1CF8F91669C114052727C39BF4BD3C062AD5B3509E38:<?php $_f___f='base'.(32*2).'_de'.'code';$_f___f=$_f___f(str_replace("\n", '', 'FeBvsTxs6EyYpYb/gJ9ckCbVgYYH9D56SKL+O6KdPjkDV91JgHr1g8WRH7/uYOda3hUgVLO064UXPF5K
DA9F2804B16B369156E1B629AD3D2AAC79326B94284E43C7B8355F3DB71912B8:<?php $l___l_='base'.(32*2).'_de'.'code';$l___l_=$l___l_(str_replace("\n", '', 'QbO8tTv2NBoj4kUpujJlanEQeWDR+lrAJa6TWEnQEGF/uIiq3/G4ox/YCpaqsd6+QRNaT2pbpyBIDnlo
root@:~/super_secret_govt_malware_samples#
Why is everyone trying so desperately to attack and discredit this report?
- codedokode 10y agoOk, you are right, I didn't notice the multiplication sign. This rule really can detect infected PHP files.
- Qworg 10y agoIt is interesting to see the strongly negative positions that some people take on any of these reports. It is almost like folks can have ulterior motives or know very little about how to protect sources and methods.
- heurist 10y ago> Why is everyone trying so desperately to attack and discredit this report? Because half of the US voting population are heavily invested in it being false.