Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Dan Horning
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 David Mintz wrote: >On Tue, Mar 27, 2012 at 12:30 PM, Matthew Kaufman >wrote: > >> Yeah SoftLayer is a good host. What was the other dedicated host >also, >> that was owned by ex-RackSpace, for dedicated? >> >> >> >you're probably thinking of Slic

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread David Mintz
On Tue, Mar 27, 2012 at 12:30 PM, Matthew Kaufman wrote: > Yeah SoftLayer is a good host. What was the other dedicated host also, > that was owned by ex-RackSpace, for dedicated? > > > you're probably thinking of Slicehost. -- David Mintz http://davidmintz.org/ It ain't over: http://www.healthc

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Daniel Convissor
Hi David: On Tue, Mar 27, 2012 at 10:47:16AM -0400, David Mintz wrote: > > Yeah, I assembled the regex based specifically on the malicious code that I > was looking at in all my files. I suppose the trick is to fashion a regex > that catches an actual eval call inside php tags -- there's always

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Matthew Kaufman
Yeah SoftLayer is a good host. What was the other dedicated host also, that was owned by ex-RackSpace, for dedicated? On Tuesday, March 27, 2012, Hans C. Kaspersetz wrote: > > > On Mar 27, 2012, at 12:19 PM, Matthew Kaufman wrote: > >> If you use RackSpace, I encourage NOT to use their cloud se

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Hans C. Kaspersetz
On Mar 27, 2012, at 12:19 PM, Matthew Kaufman wrote: > If you use RackSpace, I encourage NOT to use their cloud service. I was > billed over 4 grand in one month for minimal and hard to track usage by the > 'hour'. > > I hate to say this but I'd recommend Linode over RackSoace if you want a

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Chris Snyder
On Tue, Mar 27, 2012 at 12:21 PM, Matthew Kaufman wrote: > You can?  With root access? Of course. Tasty cloud kool-aid. http://aws.amazon.com/free/ ___ New York PHP User Group Community Talk Mailing List http://lists.nyphp.org/mailman/listinfo/talk ht

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Matthew Kaufman
You can? With root access? On Tuesday, March 27, 2012, Chris Snyder wrote: > On Tue, Mar 27, 2012 at 12:16 PM, David Mintz wrote: > >> Thanks to all. Maybe also I should consider leaving shared hosting >> altogether, and moving to Rackspace or similar. It looks like prices have >> come way down

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Chris Snyder
On Tue, Mar 27, 2012 at 12:16 PM, David Mintz wrote: > Thanks to all. Maybe also I should consider leaving shared hosting > altogether, and moving to Rackspace or similar. It looks like prices have > come way down. > DevOps for the win! On Amazon you can run an EC2 micro instance 24x7 for free.

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Matthew Kaufman
If you use RackSpace, I encourage NOT to use their cloud service. I was billed over 4 grand in one month for minimal and hard to track usage by the 'hour'. I hate to say this but I'd recommend Linode over RackSoace if you want a VPS. On Tuesday, March 27, 2012, David Mintz wrote: > > > On Tue,

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread David Mintz
On Tue, Mar 27, 2012 at 11:20 AM, Matthew Kaufman wrote: > Apache's mod_websecurity and Snort will help... > > > Thanks to all. Maybe also I should consider leaving shared hosting altogether, and moving to Rackspace or similar. It looks like prices have come way down. -- David Mintz http://david

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Matthew Kaufman
Apache's mod_websecurity and Snort will help... On Tuesday, March 27, 2012, Chris Snyder wrote: >>> Oh, and lock down your file permissions. The web server shouldn't be >>> allowed to write to any files or directories. >>> >> >> Except when it really needs to, like for writing data to a file-bas

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread Chris Snyder
>> Oh, and lock down your file permissions.  The web server shouldn't be >> allowed to write to any files or directories. >> > > Except when it really needs to, like for writing data to a file-based cache, > or accepting file uploads. How do you recommend handling those cases? On a shared host? Do

Re: [nyphp-talk] I've been hit with an eval(base64_decode("....")) injection attack

2012-03-27 Thread David Mintz
On Sun, Mar 25, 2012 at 4:07 PM, Daniel Convissor < dani...@analysisandsolutions.com> wrote: > 'd love to hear the thoughts of > the people here on it from a code level and user interface level. > > http://wordpress.org/extend/plugins/login-security-solution/ > > Dan, I haven't tried it yet but fr