Protect Yourself From Hackers, php hacks. Options

[reverendspam]

There has been a lot of talk lately of people's TNG sites being hacked and files deleted. A couple of folks had their index.php file deleted.

It Just happened to me a couple of days ago. My surnames.php file was deleted and I did not think anything of it until others on the TNG mail list started reporting issues as well as those on this forum. A wonderful group (tongue in cheek) called "Angels of Death" hacked me. They left their tell tale sign in my errors.log. They were pure amateurs as the pros will typically redirect you or add a page to your file with thier calling card stating their name.

Apparently the script kiddies are at the end of a school year and are bored between studying for their exams (IMG:style_emoticons/default/icon_smile.gif)

Anyways, the theme of those that are being hacked has to do with their php.ini files having rester globals set to On.


Per Darrin:

Go to your admin backend -->Setup-->Diagnostics and see if your register_globals is turned off.

If not then edit your php.ini file and turn it off. You may have php.ini in numerous directories as I do. I would advise to changing every file.

Per Darrin again:

Also, I noticed another vulnerability that affects people with
register_globals turned OFF. If you think that's you, you should edit your globallib.php file and replace this code:

if( $_GET && is_array( $_GET ) ) {
foreach( $_GET as $key=>$value ) {
${$key} = $value;
}
}
if( $_POST && is_array( $_POST ) ) {
foreach( $_POST as $key=>$value ) {
${$key} = $value;
}
}

with this:

if( $_GET && is_array( $_GET ) ) {
foreach( $_GET as $key=>$value ) {
if($key == 'cms' || $key == 'lang' || $key == 'mylanguage') die("sorry!");
${$key} = $value;
}
}
if( $_POST && is_array( $_POST ) ) {
foreach( $_POST as $key=>$value ) {
if($key == 'cms' || $key == 'lang' || $key == 'mylanguage') die("sorry!");
${$key} = $value;
}
}

(two lines added).

I believe Darrin will fix this in the next upgrade.

You may also want to check your directories to make sure there are no strange files that you do not recognize. You may want to delete them.


Check your directory permissions as well. If you have TNG in its own directory try setting the permission to 750 making sure to check your program still runs effectively.

Joe