hacked

The sites on the coloc box I share with a friend got hacked sometime in the last day or two. Fortunately they just replaced index.html. They may have looked around a bit but I don't keep anything I much care about up there.

I do need to get around to keeping rotating backups; I rsync down to a local copy nightly but don't rotate it. I knew that was not terribly smart but never got round to fixing it, since it's not like there's anything terribly critical up there. Still, it'd be a pain to deal with.

The index.html they wrote says "HACKED BY Darkdevil'Z tiM // TRGHOST"

Anyone got an idea how these guys typically get in? It's a Linux/Apache box, with PHP and MySQL. I'm a bit suspicious of PHPWiki myself; I've had trouble with it getting comment spammed before. Comment spamming is a different thing but I'm not sure how confident I am in PHPWiki's tightness anyway.

useful script

yoinked from metafilter, modified a bit, stuck into a cron on my machine:

cd /home/jrr/sites/monitor; curl -s http://www.hauntedfrog.com | md5sum | tee hfnew | diff -q - hfold || echo 'hauntedfrog.com has changed' | mail -s 'IT CHANGED!' ridley.john@gmail.com && mv hfnew hfold

MD5s the pulled webpage, sends an email if it changes. Repeat for multiple web pages. Doesn't work for one of my sites which has a homepage that changes every reload, but will wake me up if the same thing happens again.