Author: Joker

Categories
blog FrontPage Security

Securing your site

Since I’ve seen so many customers getting their accounts hacked I figured I’d post the tools I have to try to deal with these types of issues.

One of them can be found here, (I removed the link because the guy removed the wiki from his site.) it was written by one of my co-workers. (His scripts should only work on Linux/Unix based OS’s, sorry no Windows support.) Basically he wrote a script that checks for some easy to discover vulnerabilities such as having register_globals enabled or world writable files among other things. He also wrote a script to fix those issues, one to tell you if any changes have occurred since the last time the script was run, & he converted my FrontPage clean up script for SSH.

I also made it so that the security scanner he wrote can work in PHP. (Once again this is only for Linux/Unix servers.) You can get it here.

Categories
blog FrontPage work

Update on the FrontPage Server Extensions cleanup script

Well as I mentioned earlier I made a script for cleaning up the Microsoft FrontPage Server Extensions. I have recently made some major overhauling of it. Now instead of running a series of searches to find the offending files & folders, only one search is done making it much less intense on the server, or at least that is the hope.

Another thing only the first few versions deleted the “.htaccess” files. I had someone help me figure out how to rename them instead. I used that command through version 3.5 after which I made 4.0 which didn’t do that.

If you want to get a copy of every version I remembered to save you can obtain it here. Of course if you want the current version you can get it here.

Now that the script is written entirely in PHP I’m going to see if I can do anything to improve the script’s performance further.

Categories
blog Evil spam

Spammers don’t ever seem to give up

I really don’t understand why people delete the account. I came up with a better solution, at least I think it is.

  1. I changed the password for that account.
  2. I made it so the user doesn’t even have read rights. Thanks Role Manager.
  3. I changed almost everything about the user to indicate it is a spam account.
  4. I disabled the forgot password feature. Thanks WP-IDS.

Yes I am talking about the account alina77vere9uk account that everyone seems to be getting on tons of blogs that has that really suspicious e-mail address of alina77vere@gmail.com.

I am also grateful to BlogSecurity for info on securing my blog.

Categories
blog

Strange Island Pic

Well I suppose this is a real change for me. A post with a picture in it, or more accurately about a picture.

small IslandWhen I first looked at this picture I figured it was likely a photo shop job. I still can’t help but think it is. I haven’t been able to find anything on this pic so I really don’t know if it is or isn’t though.

It is still interesting so I thought I would keep it & post it in hopes someone can identify it for me.

You can get a full size version from here.

Categories
blog FrontPage work

More on the Microsoft FrontPage Server Extensions

Well I figure it is about time that I make another post. Back to the subject of the Microsoft FrontPage Server Extensions. Well I’ve seen way to many customers at Bluehost using things they shouldn’t with the Microsoft FrontPage Server Extensions being used on their account. Here is a list of some of the offenders HotLink protection, Password Protect Directories, IP Deny Manager, Leech Protect, anything that uses mod_rewrite (examples would be Joomla & WordPress), & just about anything that thinks about touching the “.htaccess” file(s).

So I ended up leaning some SSH commands to do the cleanup. The only problem is that I have to jump through several hoops to run them. I then found a way to run the commands from inside a PHP file which made it even easier. So now yes I have a php script that cleans out the extensions. (Please note I only developed them to work on Linux servers & I highly doubt they will work on Windows servers.)

I know you might think it a little extreme to delete every last file & folder with the following names, but if you knew how frequently & easily they broke you might understand. The names of the files & folders that get deleted are the following .htaccess, postinfo.html, _vti*, _themes, _private, _overlay, _fpclass, _derived, & _borders. I know this means you have to republish any web, but it does cleanup the server 100% thus if the borders or themes are broken it is coming from your copy of Microsoft FrontPage which is broken, your web is broken, or the configuration file is corrupted.