Hacker News

points by nubinetwork 2 days ago | 0 comments

Just last week companies were saying php2shell has been rampant for months, but if that were the case, wouldn't we all have strange errors in our logs? Something seems fishy to me.

[–] minitech 2 days ago

Which companies? The earliest claim of an exploit attempt in the wild I had heard was October 17th, and that was “extant”, not “rampant”.

I don’t suppose you’re thinking of when the issue was discovered? That was August 1st, according to https://calif.io/php2shell/#the-discovery.

[–] nubinetwork 2 days ago

Amazon said 4 days prior to patch, but I'm pretty sure the other one was cloudflare, I can't find the link in my browser history.

[–] minitech 2 days ago

So was “months” a typo for “4 days” or what?

[–] makmanalp 2 days ago

Both of those are coming from telemetry, and mainly show attempts. Those telemetry are generally heuristic based so they overcount and are most often unsuccessful - it took much layer for actual honeypots to be hit. See my timeline in my other comment if you’re interested in details and extract dates

[–] red-iron-pine 2 days ago

4 days is a month now is it?

[–] jagged-chisel 2 days ago

Should we expect logs from a compromised system to be truthful?

[–] smolder 2 days ago

No, of course not. Covering your tracks by manipulating logs and monitoring tools is stuff any sophisticated attacker would do

[–] lambdaone 2 days ago

Perhaps if those logs were streamed to a non-compromised machine and stored there

[–] jagged-chisel 2 days ago

And how do we know the logs that are emitted are trustworthy?