Re: Tenon iTools 8 Server Hacked

[Ex Machina <exmachina@xxxxxxxxx>]

Right, this is exactly what happend. I restored all index files by now. 
I do not run phpBB2 but a version is embedded in one of my phpNuke websites. 
I will have a look at mod_security. Thanks for this useful advice.

Brice

On 7/25/05, Joe Savelberg <joe@xxxxxxxxxxx> wrote:
> Brice,
> 
> This happened to us in February... the hackers used a security hole
> in phpBB2. I had to replace the index files for 120 sites from our
> nightly backup. After updating to the latest PHP and additional
> packages, the server is safe again.
> 
> You should have a look through your Apache log files. Search for
> "system(chr(101)" or "echr". Usually these kind of requests indicate
> an attack.
> 
> You might want to secure your server using something like
> mod_security: http://www.modsecurity.org
---------
Tenon Intersystems' iTools Mailing List
To unsubscribe: send mail to
itools-request@xxxxxxxxxxxxxxx
with the body only containing:
unsubscribe
Find the searchable mailing list archives
at:
http://www.tenon.com/lists/html/iTools/