Forum Moderators: phranque
[domain.tld...]
I checked several sites and all had the same script running...
Anyone seen it in action?
Rather than people seeing the actual home page, they are presented with a generic page of affiliate links related to the content of the site.
The strange thing was, the file was not on the webserver (at least not in the "web directory" for the domain).
Is it possible that someone compromised the server, (or the HostSave network) and redirected all traffic using PHP?
HostSave does not seem to want to discuss this. They knew it happened, fixed it, but now deny it ever happened. Seems like "ostrich style" security.
My question: Can PHP be tied to APACHE via HTTPD.CONF or other file and do something like this to all sites on the server, (in effect overriding my .htacess attempts to disable PHP)?
HostSave can't assure me an .HTACCESS solution will prevent this from happening again. Anyone familiar with the "dark side" know how to prevent this?
I beleive this is a good reason to specifically configure PHP to not be processed UNLESS you specifically want it on your site, (this is the second "PHP attack" I've seen, the first time through a "file upload" that didn't check the file type --- instead of uploading text, the hacker uploaded a PHP script and when the server displayed it, it parsed it and gave the hacker access to deface the site).
So, I found a domain in a state I considered "hijacked"... then tried a few others at same host and figured entire webservers had been hijacked ---well they were... in a sense... thanks to what I now find is internal [i]redirect from HostSave, (technically a marketing foul up expedited by IT).
We can keep it on topic -- as this may be an Apache server topic; "How to use PHP and Apache server configuration to try to sell off dormant parked domain name accounts", but most definitely subtitled; "But be careful, you don't want to send paid hosting customers' traffic to the new fangled sales tool".
When I called to report it as a "hijacking", and sent a few emails, then a screen capture, you'd think they'd have told me what happened, something along the lines of "sorry, we messed up"...
###
