Well, there doesn't have to be shell/ftp for the person to have access to files ;) As long as they're able to upload their own file manager through an exploit...<div><br></div><div>Anyway, I can't think of any other possibilities. But, wouldn't it be possible to change the permissions of SMF's files when an update is needed, and then changing the permissions back to read only? Granted, this could be limiting and is certainly annoying, but it's better than having the forums hacked to pieces.</div>
<div><br><div class="gmail_quote">On Wed, Jan 27, 2010 at 5:04 PM, Marc Weustink <span dir="ltr"><<a href="mailto:marc@dommelstein.net">marc@dommelstein.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Matt Shaffer wrote:<div class="im"><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Wed, Jan 27, 2010 at 10:37 AM, Marc Weustink <<a href="mailto:marc.weustink@cuperus.nl" target="_blank">marc.weustink@cuperus.nl</a> <mailto:<a href="mailto:marc.weustink@cuperus.nl" target="_blank">marc.weustink@cuperus.nl</a>>> wrote:<br>
<br>
The "infection" is removed. We're currently investigating where it<br>
came from.<br>
The smf forum was uptodate (1.1.11). Unfortunately when restoring<br>
things, a previous index.php was used, which reports the older<br>
version. (which is the only diff of the file)<br>
<br>
I fear the ease of the update process made it also possible to write<br>
new contents.<br>
<br>
Marc<br>
<br>
I don't see how the ease of the update process would give hackers an advantage... after all, you still have to have an admin account to perform that activity.<br>
</blockquote>
<br></div>
It requires the smf dir and file to be writable for the user the forum is runnng on. Which means that any leak can write to these files.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Keep in mind:<br>
1. An outdated index.php could be a possible culprit, if it had any security vulnerabilities with it (although I highly doubt this)<br>
</blockquote>
<br></div>
Is up to date<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
2. Any mods installed may have vulnerabilities<br>
</blockquote>
<br></div>
We don't have many mods<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
3. If the person updating the forum to 1.1.11 ignored warning messages about files not being writable, etc, there may still be an outdated file with a vulnerability from 1.1.10<br>
</blockquote>
<br></div>
We were up to date without any warning.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
4. SMF doesn't necessarily have to be the culprit. Exploits in other software may have given the intruder file/ftp access, allowing him to change any files anywhere.<br>
</blockquote>
<br></div>
there is no public external access to that machine. No shell, no ftp. only web.<div><div></div><div class="h5"><br>
<br>
Marc<br>
<br>
--<br>
_______________________________________________<br>
Lazarus mailing list<br>
<a href="mailto:Lazarus@lists.lazarus.freepascal.org" target="_blank">Lazarus@lists.lazarus.freepascal.org</a><br>
<a href="http://lists.lazarus.freepascal.org/mailman/listinfo/lazarus" target="_blank">http://lists.lazarus.freepascal.org/mailman/listinfo/lazarus</a><br>
</div></div></blockquote></div><br></div>