trojans

by unforgiven • 2 Apr 2011, 13:49 • Journals
Let s assume u have a site hosted on a free domain.One day u find that a prick infected your site with a trojan/worm virus ,and some content and scripts on site are damaged.How can u protect your site against this kind of attacks?
Comments
20
▼
mamouth 2 Apr 2011, 14:58
get non-free hosting :)
▼
unforgiven 2 Apr 2011, 15:01
and u never heard about payed sites being infected?so this makes no difference.
Parent
▼
mamouth 2 Apr 2011, 15:03
well, the non -free hosting auto provides protection (sometimes)
Parent
▼
unforgiven 2 Apr 2011, 15:06
seems like not since some1 with proxy managed to put a trojan in one of my sub menus on site
Parent
▼
beAsty 2 Apr 2011, 15:00
stop downloading trojans/pw-stealer
use a secure forum/cms script
▼
unforgiven 2 Apr 2011, 15:02
pw stealer rofl.what would i do with other ppl paswords:S?

tell me more about this secure forum/cms script?

define pls secure forum(let s assume the site in question is hosted by ucoz.)what is cms script?
Parent
▼
beAsty 2 Apr 2011, 15:04
rofl.. stop download pw-stealers and executing them (like a fucking crack.exe which steals all your passwords.. including the ones of your domain/ftp)

dont use shit scripts.. use the newest versions of them.. e.g. phpbb, vbulletin,...
Parent
▼
unforgiven 2 Apr 2011, 15:05
dude i m not using any pw stealer,why i would fuck up my own thing?.u already talking stuff which i dont understand.i can barely remember my email pw...more details about the scripts pls.does ucoz support what u said?
Parent
▼
unblind 2 Apr 2011, 15:36
Quote.u already talking stuff which i dont understand.i can barely remember my email pw

you probably can't make your stuff more secure at this point then

paid hosting would actually allow you to secure stuff yourself but you would need TECHNICAL KNOWLEDGE you should go read some basic web security articles i guess :/

anyway if you're using a CMS you can usually get updates and patches to protect against exploits as they are discovered
Parent
▼
unforgiven 2 Apr 2011, 16:08
i m using ucoz free webdomain host.what is CMS?
Parent
▼
dignitasSui 2 Apr 2011, 15:27
either the site code is not secured against sql injections or maybe some option on your site allows php upload of some sort which is how they get in.

the actual "free host" shouldnt matter for hackers since they still need an admin passw to control ur site content.

I guess the code is just not secured, if its free coding like webspell then its definitely not secure
▼
unforgiven 2 Apr 2011, 15:32
well something match with what u say.u see we have a demos sub menu on main page where we upload the demos of those banned for hacking.and we found that the trojan was there,and that guest was able to watch this section and upload files as well

and we talking about ucoz.com here .is this good?
Parent
▼
dignitasSui 2 Apr 2011, 15:58
dont know ucoz.com. When you upload a file to that section, does it allow all file extensions or anything else besides demo extensions? Cos if it does then any1 could just upload a hacker script via there, it would be stored on your server and create a backdoor for that hacker into your system
Parent
▼
unforgiven 2 Apr 2011, 16:22
yes any kind of file type.as much as i know ucoz don t have option "don t put hacks there".how can u prevent a mad member for example ,to upload a hack,since thereis no option to tell him u can t upload but demos?
Parent
▼
dignitasSui 2 Apr 2011, 16:25
well u put a validator on page when pressing submit to check the extension or you just create a filechooser with only *.dm as file filter, its easy if you know a thing or two of coding but if you use a free tool to build your site then i dont know ^^

If the page is accessable to guests then I'm pretty sure thats how he got in
Parent
▼
unforgiven 2 Apr 2011, 17:57
well only thing i understand from what u say is what i already did.i restricted uploading just for users.at least this way i can see who register on site.the rest i have to show to the administrator and ask for his help :D
Parent
▼
dignitasSui 2 Apr 2011, 18:22
its a start, now he needs to register an acc before he can hack u ahaha :D
Parent
▼
unforgiven 2 Apr 2011, 18:51
i hope i can stop him before do it twice
Parent
▼
LeFrancis 2 Apr 2011, 15:42
pm Kamz m8
▼
unforgiven 2 Apr 2011, 16:09
don t think he would help me...
Parent
Back to top