3 ms·
In case this may save anyone some time, this aspect has not changed: "As has been the case with previous investigations, researchers still don't know how the D
by ds9 13y ago
In case this may save anyone some time, this aspect has not changed:
"As has been the case with previous investigations, researchers still don't know how the Darkleech module takes initial hold of the sites it infects. Speculation has surfaced that the servers are compromised by exploiting undocumented vulnerabilities in the CPanel or Plesk tools administrators used to remotely manage sites, but there's no hard evidence to back up that theory. Researchers also reckon sites may be taken over by cracking administrative passwords or by exploiting security flaws in Linux, Apache, or another piece of commonly used software."
- micah94 13y agoTo install a module that easily, there's got to be some commonality on the level of a CPanel which dynamically builds config files... I can't see how a standard Apache install with proper permissions on directories would allow such a thing (save a root compromise, of course).
- moepstar 13y agoThis is pretty saddening, to say the least. You'd think that it, if their account of Darkleech being first detected in February (?) 2011, has been trapped by a honeypot somewhere by someone. But no, 2 and a half year later still no one seems to know the point of entry :(