| ▲ | nubinetwork 10 hours ago |
| Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me. |
|
| ▲ | minitech 9 hours ago | parent | next [-] |
| Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”. I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery. |
| |
| ▲ | nubinetwork 9 hours ago | parent [-] | | Amazon said 4 days prior to patch, but I'm pretty sure the other one was cloudflare, I can't find the link in my browser history. | | |
| ▲ | minitech 9 hours ago | parent | next [-] | | So was “months” a typo for “4 days” or what? | |
| ▲ | makmanalp 6 hours ago | parent | prev | next [-] | | Both of those are coming from telemetry, and mainly show attempts. Those telemetry are generally heuristic based so they overcount and are most often unsuccessful - it took much layer for actual honeypots to be hit. See my timeline in my other comment if you’re interested in details and extract dates | |
| ▲ | red-iron-pine 6 hours ago | parent | prev [-] | | 4 days is a month now is it? |
|
|
|
| ▲ | jagged-chisel 10 hours ago | parent | prev [-] |
| Should we expect logs from a compromised system to be truthful? |
| |
| ▲ | smolder 7 hours ago | parent | next [-] | | No, of course not. Covering your tracks by manipulating logs and monitoring tools is stuff any sophisticated attacker would do | |
| ▲ | lambdaone 7 hours ago | parent | prev [-] | | Perhaps if those logs were streamed to a non-compromised machine and stored there | | |
|
