The DMZ

TildalWave

01:50

Terry Chia

02:48

I see that you guys have been mocking my youth.

TildalWave

03:31

@TerryChia morning!

1

Q: WordPress Hacked - Found a suspicious "class-wp-style-table.php"

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). Suspicious files found: /host.txt - This file only had the wordpress installed domain name in text ...

Check that shell I've added a pastebin link to its code in the question... it's... well pretty darn good :)

Terry Chia

@TildalWave You want me to go through 1.5k lines of code in the morning? >.<

PHP code?!?!?!

TildalWave

@TerryChia looks like a complete framework that's been worked on for months on end and probably with tons of versions... it's still pretty readable now, but I suspect it's gonna be even more obfuscated later on... and yes, what's better in the morning? would you rather have me fetch you a cup of ~~coffee~~ Java?

Terry Chia

@TildalWave Coffee would be nice. Fuck Java.

But it's a long shell. We all know longer is better right?

TildalWave

@TerryChia There's a whole island of people (135M) you're offending there, sunny! :P :))

Terry Chia

@TildalWave Ok. Fuck Java (the programming language).

2

TildalWave

03:37

@TerryChia better!

Terry Chia

@TildalWave I just briefly glanced through the shell. Damn, that's a hell lot of functionality packed into a single shell.

TildalWave

@TerryChia at least go through my answer then and tell me what did I miss... feels like I forgot smthng, you've just gotten up I'm still from yesterday

@TerryChia that's my point... and it's actually quite compressed/optimized code ... OK, so the password to it is checked against a non-salted md5 hash that computes into 4500045 ... but the rest of it is like a small school of well written PHP (which is rare to say the least)

there you go

Terry Chia

@TildalWave It's weird that an attacker using such a sophisticated shell did not bother cleaning it up after. Maybe it's one of those "exploits for sale" thing.

TildalWave

@TerryChia OP didn't complain about any damage, so yeah it could be that

Terry Chia

Damn, can't download the shell. MSE is flagging it.

TildalWave

03:51

@TerryChia copy/paste then :P

Terry Chia

04:02

Dammit, what a time sucker. textsfromsuperheroes.com/page/2

TildalWave

04:27

@TerryChia You managed to get till page 2? If you're that bored I could find something for you to work on. How do you feel about creating web templates out of PS cutouts? :))

Terry Chia

@TildalWave See, I'm on page 7 now. I do have stuff to do but I'm procrastinating since it's a saturday.

TildalWave

@TerryChia blimey, I didn't even realize it's weekend ... I need to pull my head outta my ass

Terry Chia

@TildalWave Yeah, make room for the pineapples.

TildalWave

@TerryChia Excellent idea! I've been wondering what to eat for breakfast :)

AJ Henderson

04:53

anyone ever been to the nsa cryptography museum?

Terry Chia

@AJHenderson I think @ThomasPornin has an exhibit there.

AJ Henderson

@TerryChia no, I saw that at the Natural History Museum today

well crap, they aren't open saturday or sunday

should have checked this morning :(

guess I'll have to wait until the next next time I'm in DC :(

Ethan

What is this chat room for

AJ Henderson

what ever

occasionally security discussion, but often just joking around

it's the main chat channel for IT Security

aka Sec.SE

Ethan

Oh

TildalWave

05:02

@AJHenderson you're a long way from home

Ethan

Do you know any propositional logic?

AJ Henderson

@Ethan If she's hot ask her out?

or is that not the proposition you were talking about

Ethan

I have never been in any relationships

I don't understand

AJ Henderson

@TildalWave Yeah, went down to DC for our five month aniversary

TildalWave

@Ethan we usually just insert ~~some XSS or CSRF between~~ our sentences ;)

AJ Henderson

05:07

@Ethan never mind, I was making a joke, might have been lost in language. Propositioning someone can refer to asking them if they'd like to have sex. I was saying that propositional logic was "if they are hot, ask them out"

aka, logic about when to proposition

you'll find we are also good for really bad jokes here

Ethan

lol

AJ Henderson

err 5 year anniversary

not sure why I said month

other than it being 1 am here

and I'm exhausted

but no, I personally don't recall my propositional logic. I think I learned it in college but have since forgotten

but we do have people who know it I'm fairly certain

Ethan

Do you watch any television?

AJ Henderson

also, if you were wondering about the bear, it's an internal meme for IT Security on SE. Thomas Pornin's user portrait is a bear and he is VERY good

so if we make a reference to the bear, that's why

Ethan

Oh

AJ Henderson

05:12

well, I don't have cable TV, but I do watch a few shows on Amazon Instant Watch

right now, Psych and Defiance. Also been watching Fringe on NetFlix

Ethan

lol I usually just watch the dailyshow or colbert report everyonce and a while

AJ Henderson

I elected to forgo cable tv and get 50Mbit internet instead :)

Ethan

American dad or archer sometimes

AJ Henderson

though at the moment I'm stuck on a 4g connection since I'm away from home

Ethan

I am not familiar with the majority of the terminology you are using

AJ Henderson

05:15

I have really REALLY fast internet normally but am on only moderately fast internet now

Ethan

Oh

AJ Henderson

right now I get about 5Mbit down which is 1/10 what I get at home

Ethan

Your user profile is intense

AJ Henderson

in other news, how to tell you are a photographer. You go to the natural history museum and finish the day with 1795 photos taking 53 gigabytes of space

and your main thought is "I wish I could have gotten a few more"

Ethan

I got out of school today, I am now on summer break

I took a digital imaging class as an elective

Terry Chia

05:19

@AJHenderson Just 53 gigabytes? Pffft, amateur.

:P

AJ Henderson

@TerryChia try as I might, I've still been unable to ever actually get to my second card

I've got 2 64 gigabyte cards in my camera

and I've never actually managed to fill one

no matter how hard I try. I'm a bit disappointed in myself

@Ethan nice, how'd you like it. I was a Computer Science / Electronic Media Arts and Communications dual major, but I did the EMAC side pretty much because I already knew the stuff

and the required courses for one were the electives for the other

so I had 2 free electives in 4 years of school

@Ethan ouch, that's unfortunate. I had the opposite problem in my video class. The TA wanted to give me a B because you can "always learn more" but I was helping the teacher teach the class pretty much and knew more than the TA so he overrode her and gave me an A

Ethan

Lol Owned

AJ Henderson

I enjoyed my time in class, but mostly because I was playing games on my laptop instead of listening

Ethan

I usually do other stuff in class

AJ Henderson

or occasionally in addition to listening

Ethan

05:24

Hey, Aj are you married?

AJ Henderson

yeah, 5 years yesterday

Ethan

Mind if I ask how many relationships you have been in? If you know off hand

AJ Henderson

actually, only 1. I figured out fairly early on what I was looking for and was really picky in looking for it

took a bit to find it, but when I did, it was a great match

Ethan

Do you have kids?

AJ Henderson

not yet, we got married fairly young. I'm still only 28 and my wife's only 25

Ethan

05:28

You sound like you have alot going on in your life

AJ Henderson

probably in the next couple years after she has a chance to get her reputation established in her field

Ethan

What is that?

AJ Henderson

medical lab tech

Ethan

That sounds narrow

AJ Henderson

I do and I don't. I do a lot of different things, but a lot of them don't take much time

I'm actually a lot less busy now than I was in High School or college

Ethan

05:29

It sounds like a subfield of two different feilds

AJ Henderson

it's a specialization of biology

Ethan

Oh

AJ Henderson

she's a biologist but there aren't many jobs for biologists right now so she went back to school for a certification that lets her do medical lab work

you pretty much either have to do a masters or go on to be a doctor with a biology degree right now if you want to get a job (or do a cert program)

all the research jobs are going to masters people because of all the biologists looking for jobs

Ethan

Research sounds like the something enjoyable, though I don't know much about biology

Has she written anything?

AJ Henderson

no, she wasn't able to get in to research since she has a bachelors

which is why she's doing the medical lab route

Ethan

05:33

You can't just do research in biology? What sort of stuff do you need? I suppose it depends on the area of research though

AJ Henderson

doesn't end up doing research with that though, it's doing various lab tests. Like if you have bloodwork sent to the lab for example, she'd be the one to do it

Ethan

alright, I don't want to bother you lol

later aj

AJ Henderson

but yeah, my life now is actually pretty relaxed for the most part. Work during the day 40 hours, go home and spend time with the wife and the cats, occasionally do photography or other A/V work when projects present themselves every month or two

and hang out on stack exchange a lot

Ethan

lol, there are kittens in my back yard

My mom has like 4 cats as a matter of a fact

AJ Henderson

nice, we're limited to two by our appartment

Ethan

05:37

@AJHenderson I don't think we are allowed to have that many, I just live with my mom and grandma

AJ Henderson

but alas, it is probably time for me to get some sleep. was nice chatting. have a good night

or day

depending on where you are

Ethan

night, its about 10:40

good night nice talking to you too

Terry Chia

11:09

Huh. When did SE change the FAQ page?

Gilles

11:33

0

Q: Side Channel Attack Queries

People Generally spoof their IP address by using any other device's ip address such as printer, scanner. My question is in this kind of particular attack why we are using these devices rather than traditional ones such as desktop computers, laptops. I predicted that It is because generally scan...

security spoofing

what a wall of questions. I'm not feeling up to recommending sec.se to him

@TerryChia a few days ago. meta.stackoverflow.com/questions/tagged/help-center

Adnan

12:19

@Gilles I have no idea what he's talking about.

November

13:08

Nor I

Terry Chia

15:39

@RoryMcCune Wrt to the Google Reader replacement issue, I migrated to Feedly. Pretty nice interface and doesn't cost a cent. Not too bad.

Xander

16:36

@TerryChia @RoryMcCune I'm trying Feedly right now. Haven't been thrilled with it, since I have 100+ new posts a day in my feeds, and it seems a bit slower to get through them than Reader was. Maybe I just don't know the tricks yet.

Terry Chia

@Xander Ahh, yes that might be a bit of an issue. I only have at most 10-15 per day so it's not that big a deal. I can see the hassle of going through 100+ post a day with that interface.

Adnan

@Terry You know what I find annoying? When somebody gets downvoted, a complaint comment is immediately posted, demanding an explanation and criticizing the whole act of 'commentless downvoting'. At the same time, when somebody does not downvote, and rather leaves a comment about what is wrong with answer, the comment is ignored.

Terry Chia

@Adnan huh?

Adnan

@TerryChia On several occasions, when you get downvoted you complain about the downvoter not leaving a comment. Today, on your index.html answer, I commented about why your answer isn't good

Terry Chia

@Adnan Eh, I have not looked at the main site for a bit. Just my chat tab opened.

Adnan

16:42

@TerryChia No judgement here, but security.stackexchange.com/users/10211/…

I'm disappointed.

Terry Chia

I don't really see your point.. I told him the proper way of blocking directory listing. I don't know why you are nitpicking here...

If you dislike my answer, downvote it.

Rory McCune

21:07

@Xander @TerryChia I'm trying newsblur, quite liking it so far. He had some problems scaling at first but it seems reasonably nippy now and the mobile apps are quite good...

Scott Pack

21:18

@Xander I think I probably go through a couple of hundred posts a day as well. It's definitely slower than Google Reader, but it's been getting faster. They've sped up both the backend and the web app since the Google Reader shutdown was announced.

TildalWave

21:55

what the bleep? I'm reviewing a suggested edit by an anonymous user on one of the bear's answers and it looks to me like PR trolling, inserted stuff like "unsubstantiated claims", "rumours", "no evidence presented",... and tries to edit it like RSA is an organisation... it isn't, EMC is.

Xander

22:22

@RoryMcCune Ah! Good to know. That was another one I was thinking about checking out.

@ScottPack Good to hear....And I'm sure a good bit is just my lack of familiarity with it at this point as well.

Adnan

@TerryChia I don't dislike your answer. I never downvote because I dislike an answer. The OP asked if adding index.html is secure, you didn't answer that. It's not nitpicking, I'm not saying that there's anything wrong with the answer. It would be a good answer if the question is only "Tell me better ways to prevent directory listing"

Rory Alsop

@TildalWave odd

TildalWave

@RoryAlsop it's out of review queue now, @AntonyVennard seems to have rejected the edit as well

Adnan

I don't really see why it is difficult to admit that your answer didn't actually answer the OP's question. We all do that sometimes, there's nothing wrong with it. It's fixable.

TildalWave

@Adnan You're starting to worry me a little ... it's Saturday night, you're young and you're supposed to be trying to blow your brains out with whatever is hip these days to do that with... instead, you're here being all grumpy on a question and its answers that's hardly gonna change much anything. Just saying ;)

Adnan

22:34

@TildalWave I've been taking it easy the past few weeks, I'm saving for a new gun and a hunting club membership.

TildalWave

@Adnan is that expensive? the membership?

Adnan

@TildalWave Yup. Hunting clubs memberships here are mostly restricted to land owners, and I'm not a land owner. So I've recently started to work on an exception by our local club. Purchasing some tools and making them available to club, befriending some members, taking the board members to bars, etc.

If I get some members to share their hunting rights with me, I could get a membership.

TildalWave

@Adnan wouldn't it be cheaper to simply buy some land? :)

Adnan

@TildalWave I wish.

TildalWave

@Adnan sorry, it was the hacker in me talking :))

Adnan

22:41

@TildalWave Oookay, we really don't need to know about your sex life.

TildalWave

@Adnan hehe didn't see this one coming (although I can anticipate the next one, I'm so easy) :))

Transcript for