Website Security: Hackers, Botnets, and LIBWWW-PERL

by Scott Allen

Recently, there has been a rash of automated hacker attacks, defacing websites across the globe that don’t employ adequate security measures. Earlier this week, several friends of mine had their sites hacked and defaced. Most of these attacks don’t come from experienced hackers — they come from script kiddies employing automated scripts and a network of compromised computers (botnets). Even though these junior hackers may be inexperienced, they know enough to take down your site, and I don’t need to explain how much that can cost your business in lost revenue.

Don’t worry though, there is a simple solution that will reduce your site’s susceptibility to these attacks, and buy you some time to plug security holes. It’s relatively easy to implement, even if you’re not a security expert.

It’s amazing what a high percentage of site hacks result from random, untargeted, automated attempts to find security holes. The sad thing is, that most of these incidents could be prevented with some minor security enhancements. (Most sites don’t even employ basic security measures!) However, I’m not advocating that people stop there — I highly recommend that site owners educate themselves on website security or consult a website security expert. If you would otherwise have no security in place, at least implement this. It will buy you a little time to figure out where your potential security holes are and plug them.
 

---

Before we proceed, I need to clarify a couple of points, and these are extremely important:

• This post is for going to primarily be helpful for those who have little or no security experience, and is not intended for advanced security. I’m assuming that those reading this are do-it-yourselfers, and without these tips your site would have little or no security.
• This method is not a substitute for good security practices in the coding of scripts.
• This alone WILL NOT prevent an experienced hacker from getting into your site.

NOTES ON SECURITY:
Security is about reducing risk, and lowering the statistical probability of a successful attack. You can never eliminate risk fully, and there is no such thing as 100% impenetrable security, even with the best measures in place. By increasing the the level of security for your site or application, you are shrinking the pool of hackers that have the [skill|experience|time|resources|desire] to hack your site. In most criminal acts, it’s about following the path of least resistance — if you increase the difficulty of success (sometimes by even a small margin) then often the hacker will go somewhere else. Think of other crimes like car theft or breaking into a house. In most cases, if a thief is checking out your car, but discovers that you have a vehicle with all the top security measures, he’ll move on to an easier one. That is, unless he has a specific reason to target your car. There are very purposeful and targeted crimes, but these are much less common than the crimes of least resistance. When hackers break into banking or large corporate web sites, they have a specific target, and incredible amounts of skill and resources. Compared to typical website hacks, the overall percentage of attacks like this is extremely low, because there aren’t many out there who could carry it out. Even with the best security measures in place, any server can be hacked by someone with the right skills and resources. There are always a few people smarter than your best security measures, but luckily, not too many of them. That’s why there is no such thing as complete security, and why security deals with reducing risk. That being said, lets move on.
 

---

Start With Your Logs

By monitoring website logs, you can discover that many of these come from User-Agent libwww-perl, and try to access url’s on your site that include another off-site url in the query string:
http://www.yoursite.com/page.php?id1=http://www.othersite.net/id.txt?

You can see that in the Query String (id1=http://www.othersite.net/id.txt?), they are trying to call the external url to try and upload files or inject code into your site. This is typical of botnet scripts that automatically look for vulnerabilities in your software.

By blocking access from libwww-perl, and blocking urls that include “=http:” you will eliminate many of these attacks, and keep inexperienced hackers from owning your site and/or server.

The Solution: A Few Lines of .Htaccess Code

There is a quick solution that most website owners shouldn’t have any problem implementing.

If the following is not already in your .htaccess file, then insert it near the beginning:

RewriteEngine on

Somewhere after that, insert the following:

RewriteCond %{HTTP_USER_AGENT} libwww [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)=http: [NC]
RewriteRule ^(.*)$ - [F,L]

This won’t affect most of your other applications, because file uploads are usually done through a form with the POST method, not GET. (If they are using GET, then for security you need to take that script offline and replace it with one that uses POST instead.)

By implementing this minor security fix, you can eliminate a large number of automated botnet attacks, and prevent them from uploading files or injecting code into your site.

To be clear, this does not make your safe 100% secure, so don’t stop here. As I’ve mentioned before, this will not prevent experienced hackers from getting into your site, but it is an easy way for most site owners to increase a site’s security. (For comprehensive security measures, you may want to consult a website security expert.) The next step is to take the time to find and plug any security flaws your site may have.

UPDATE 12/20/07: When upgrading your WordPress blog to a more recent version, WordPress may ask to upgrade your database. This code will need to be temporarily removed during the databases upgrade. Then replace it afterwards.

Other Basic Security Tips:

• Research scripts before installing.
  Before you install a web application, plugin or script, research it online through Google, Yahoo, etc and see if there have been security issues. This is most applicable with open-source scripts.
• Keep your scripts up to date!
  Application developers often find security holes, patch them and release regular updates to their product. If you’re not keeping up with these, chances are high that you’ll get hacked sooner or later. As soon as holes are discovered, hackers create automated scripts that target that hole.
• Be careful with file permissions.
  Don’t set a file’s permission to 777 (Read/Write/Execute) unless you know exactly what you are doing.

More Info on Botnets and Internet Security:

• Stop the Botnets! | Emerging Technology Trends | ZDNet.com
• Computer Scientist Fights Threat of Botnets
• Understanding Hidden Threats: Rootkits and Botnets | US-CERT.gov
• FBI’s ‘Operation Bot Roast II’ Identifies and Captures Eight Individuals Responsible for Infecting over 1 Million Compromised Computers | US-CERT.gov
• Cyber Security Tips | US-CERT.gov

This post was inspired by the recent hacks, and by a post on IncrediBILL’s blog: Block LIBWWW-PERL and web addresses to protect your site from botnets.

Tags:
website security | hacking | .htaccess | botnets | WebGeek

If you enjoyed this post, make sure you subscribe to the RSS feed!

 Email This to a Friend

 Print This Post

Related Posts:

Examining Logs and Sharing Knowledge Can Help Expose Security Flaws

Improve Site Security and SEO with One Line of Code

Web Site Security - Bot Traps

Contact Form Generator

PHP-Based User Authentication