Tuesday, September 9, 2008

A Russian Security Hole In My Website

Well, I heard from the Ukrainians regarding the problem I blogged about earlier today regarding Russian websites targeting my Eyes on Texas website.

After the scary Ukrainian response I called the U.S. phone line support and had no wait and quickly figured out the Ukrainian was feeding me misinformation.

Below is the technical support I got from Jenny the Ukrainian.....

I'm afraid there is a security hole in your web site that was used by hackers for sending spam through your site. The reason is that durangotexas.com/awstats/data/ folder has 777 permissions, it means that it is writable for anyone in the web. It is not secure to have permission for the folders set to 777 as it allows everybody to do everything to this file. Having files/folders with such permissions anyone can write to it. This means a security hole since everybody on the server can overwrite these files or can write, remove or overwrite files in the directories. You need to chmod your folder/files to permission mask 755 to prevent hacker's attacks in future. You can do it via Webshell or any standalone ftp client. 755 is a read permissions for owner, group and others; write permissions for owner ONLY; execute permissions for owner, group and others.

If you have any further questions, please feel free to contact us at anytime, we are available 24/7.

Kind regards,
Jenny Danilenko
Technical Support

2 comments:

Gar said...

I can't believe you'd trust US Phone Support more than you would Jenny the Ukrainian. Are you nuts?

Wouldn't it have been faster just to follow her instructions? It only takes 1 minute to do what she said and it wouldn't hurt anything. How many minutes did you spend on the phone with the misinformed egotistical American who was probably tired of talking to you and therefore tried to simplify your life so they could leave the office at 4?

Now that I know about the 777 thing, I'm going to go redirect your home page. I'll be back in a minute.

Durango said...

I didn't understand Jenny the Ukrainians instructions. You forget, you are much brighter than me. These things are confusing for me. As for the phone support, I didn't have any wait, the guy walked me through checking on my settings. They were already correct. So, Jenny the Ukrainian was pretty much worthless, while the phone guy wasn't. Now if something happens to my home page I'll hunt you down and beat you up. Or something like that.