radioclub server hacked
Posted in Technicalon Dec 5, 2004
The webserver for radioclub.byu.edu recently got hacked through a php exploit in urldecode. I’m not exactly sure how this all worked, but I found that an irc bot was running on my server, and looking through the apache logs, I found that the exploit recently described as the howdark exploit. What is left to be determined is if the hacker got root access. In which case, I would have to reinstall the entire system and examine any migrated files. If I can determine that he did not get root access, then I can simply delete the files and fix the whole and hope other things like it don’t happen again.
I’ve also made sure that any other installations of phpBB2 hanging around on my other servers are either upgraded or deleted.
If anyone is running phpBB2 with a version less than 2.0.11, you really should upgrade immediately.
Related posts
Comment Form
Status Updates
- appspot.com domain) for free.
