2 ms·

A good reminder to run your webserver with only the privileges it needs, including read/write permissions on the filesystem outside www and shell execution of c

• acdha 8y ago
  The challenge for comparisons is doing it all offline and indistinguishable from user activity - I’ve seen cases where the attacker updated tripwire, rpm/deb sums, etc. or only presented the payload to a specific process, requesting IP not on the local network, etc. In this case I’d want something like a random process where a new EC2 instance does a install so you could make it a lot harder to cloak the attack because that’s also what many targets will do.
• _cereal 8y ago
  For "known good" folder, a git repository may help, at least to restore a clean version of the code.
  • meowface 8y ago
    Probably preaching to the choir here, but for those who are unaware, be sure that .git directories are not accessible by web clients. It will lead to source code disclosure, and if you've checked in any secrets, credential exposure as well.
    • aaronmdjones 8y ago
      That and if the webserver can write to .git it can also invisibly modify the history to ensure that you continue to check out the backdoored code no matter how far you go back.