4 ms·
GoDaddy shared servers compromised – .htaccess redirection to sokoloperkovuskeci
- RandallBrown 15y agoI've been getting a ton of people signing up for my GoDaddy hosted WordPress blog the last couple of days. All the email addresses were things like adfa@gmail.com. Usually I get 2 or 3 signups a month. The last 2 days I've gotten 10 to 15 a day. I've kept my WordPress install up to date though and I don't appear to be compromised. I wonder if that was part of the attack.
- bobbywilson0 15y agoThis was probably not part of the attack. The attack simply redirects incoming requests to another site. If your site was affected, you wouldn't have had any sign ups because your site would have been redirecting to the bogus site before it even reaches your page.
- RandallBrown 15y agoI was thinking more of something like someone was attempting to exploit a vulnerability in the signup form.
- alnayyir 15y agoI just saw this exact conversation a month ago. Serious Deja Vu.
- gbrindisi 15y agoConsidering the dramatic number of vulnerabilities discovered on Wordpress plugins recently I'd double check everything. http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=&filter_exploit_text=wordpress&filter_author=&filter_platform=0&filter_type=0&filter_lang_id=0&filter_port=&filter_osvdb=&filter_cve= http://www.exploit-db.com/search/?action=search&filter_p... And an useful tool to fingerprint a wordpress isntallation: http://code.google.com/p/wpscan/ http://code.google.com/p/wpscan/
- sev 15y agoSomeone commented on the posted article that the compromise seems to be from Godaddy itself. What I'm thinking is someone used a vulnerable 3rd party script hosted on a shared server, then somehow got root or escalated privileges and compromised all or most of the sites hosted on the shared server. If the issue was Godaddy itself being hacked, I would assume it would affect all servers, not just the shared one(s).
- soult 15y agoIf somebody managed to compromise other customer's accounts via one shared hosting account, even if it is limited to a single server, then I would consider this as Godaddy being hacked.
- dibarra 15y agoYou can do this fairly easily with Apache and symlinks, there's an issue with SymlinksIfOwnerMatch that people can circumvent if they're clever...
- dibarra 15y agoDoes GoDaddy use Fantastico? I know we recently patched our servers for http://www.1337day.com/exploits/16512 http://www.1337day.com/exploits/16512 Not sure if GoDaddy did (or needs to) do the same.
- libraryatnight 15y agoI don't think so, they use their own system branded the "hosting connection." It could just be fantastico with their own skin thrown on, I suppose, but it looks like their own thing to me.
- drivebyacct2 15y agoGood thing we have these stories once a week to remind us not to use GoDaddy. Maybe people will start listening.
- AzAngel 15y agoI thought GoDaddy commercials were enough to make people not want to use GoDaddy.