Securing PHP against r57shell and the like

This is a common problem around the web on PHP servers so I’m making a note here for my own reference as I recently had to deal with some people that find it ‘funny’ to script kiddy hack servers:

  1. Make sure that all web directories are only writeable if they absolutely need to be (obvious, but you’d be surprised)
  2. Change php.ini to add the following:
disable_functions = exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source

What option 2 will do is stop PHP scripts from executing any commands under any user context at all. This will ensure that even IF something did get installed, it would be quite hard for it to do very much.

I’m sure there are many other PHP commands that are worth disabling – I’d be interested to learn of them.

0 Comments

AVG, Windows 7 and a Netbook

How do you take a fast operating system and make it impossibly slow to use? That’s easy, install AVG.

Last night, I installed AVG on my Samsung NC-10 thinking that would be good and useful to have some protection. How wrong could I be? Upon reboot the Resident Shield took 100% CPU on the Intel Atom 1.6GHz chip that the NC-10 has and consequently making the entire machine unusable.

Time to try another anti-virus I think. To think that Windows recommended AVG as well…

0 Comments

Badly scripted customer service is bad

I am a customer of Virgin Media and have been since January of this year. Let me be clear, they are generally very good. The fault number (151) is served by English people during the week if the call volume is low, and Indian people if the call volume is high or at the weekend. The English customer service is fantastic and cannot be faulted. The Indian… well…

Yesterday my cable broadband died. Being an IT guy I did some self-diagnosis before calling. I checked the light on the Cable TV box and made sure that was flashing and looked at the error there of No Return Path. OK, now I know that means the UBR (Universal Broadband Router) is having some trouble. The Virgin Media engineer I spoke to told me so. I logged into the modem itself on 192.168.100.1 and noticed that:

MAP w/initial maintenance region received
No Ranging Response received – T3 time-out
MAP w/initial maintenance region received
No Ranging Response received – T3 time-out

Again, that’s excellent. It just means the upstream is all dead but downstream is fine. This usually ends up being an area fault, and area faults are usually raised out of volume of calls. The more people that call in with the same fault in an area alerts the relevant area of engineers. So, I make the call:

Me: Hi, my broadband isn’t working

CS: OK, what is your name please?

Me: Packham

CS: OK Mr Packham that is a problem I can help you with.

(How does he know that, he has no idea he can help or not… so why say he can?)

CS: Could you tell me what lights are flashing on the modem Mr. Packham

(This drives me crazy, stop repeating my name on the end of every sentence… please!)

Me: The sync light is fully on and the ready light is flashing. The modem pages are telling me that it is failing to lock an upstream link and the TV box is also flashing indicating the same.

CS: I have no knowledge of TV problems Mr Packham. Let me take a look at the modem

CS: Are you running Windows Vista or Windows XP?

Me: What relevance has that got to diagnosing a cable modem fault? I’m running a Mac

… silence …

CS: Ok this is odd Mr. Packham. It looks like there’s no modem activated on your account. Let me send a reset code to your modem.

… pause …

CS: The modem should now reset

Me: It hasn’t

CS: Let’s wait a little amount of time

… pause …

CS: Now?

Me: No

(clearly a communication fault and this guy is following an awful script)

CS: Let me try again

… sigh …

CS: It should reset now

Me: No

CS: Ok remove all cables from the back of the modem, wait 30 seconds and plug them back in.

… I remove the power cable knowing full well that the other cables make no odds at all …

… pause …

Me: I’ll plug them all back in now

CS: Yes please Mr. Packham

Me: Ok it’s booting

Me: And the same problem

CS: Ok let’s book an engineer

Most of that could be skipped. Whenever I have called and had the English call center, we tend to get to the book an engineer point a lot quicker. Mainly because they understand me. I can reel off what I have checked. I usually do things like remove the splitter etc. and try different cables to make sure. I can tell them that, they’ll listen and they will get it sorted a lot quicker.

It just sums up why Indian Call Centers are bad. It’s not their English, nor their intelligence. The issue is they don’t live here. They’ll never have had Virgin Media cable either. They’ll of seen pictures of the equipment involved but no idea really how it all hangs together. They don’t know how to tell the difference between an IT professional calling vs. a mother with 4 screaming brats. They just follow a script. A poorly written one at that. I can imagine that if they deviate from the script they get scalded for it. It’s a crying shame.

At least I can understand why the Status page lacks updates. English engineers are, by their very nature, lazy. They get the job done, and are super efficient, but they never update tickets. The Twitter guys appears to be on the ball though. It pleases me that they are responding to my Tweets and are at least saying they’ll find out why things like the Status page isn’t getting updated.

Thankfully, my 3G dongle is plugged into my FreeBSD  server and providing me with some sort of Internet access.

The other thing worth adding about this is that at least it is getting looked at. BT are awful by comparison. Is Virgin Media therefore just the best of a bad bunch? I’ll let you know when the service comes back. I’m just looking forward to upgrading to 50Mbps at the new lower price next month.

2 Comments

Is Pirate Bay the new Napster?

The smells of “crap we’ve been sued, better do something”. Isn’t this deja vu?

Global Gaming Factory X: Acquisitions of The Pirate Bay and New File – Sharing Technology, p2p 2.0 – MarketWatch.

0 Comments

The mix up with tickets and Joyent

I think the first thing to say is this post is not a slating of Joyent. They are an amazing company and I have never had a problem beyond little things like back end network routing and the like.

So, about two weeks ago, I raised a ticket:

We would like to shut down the accelerator mentioned above as it is surplus to our requirements.

So. The ticket referenced an accelerator with an ‘i’ in it. We got a nice reply that confirmed the request:

I’ve just set xxxxi to be closed on the 17th.

So that’s all good. I verify against my spreadsheets and ensure that it’s all correct. It is, so I think nothing of it. Until this morning! This morning xxxxl (obviously the x’s are censoring the exact numbers/letters) was turned off! Obviously, as we have a large amount of accelerators with Joyent, I picked up the Batphone and gave them a call.

The reply was:

xxxxi was shut down as requested in ticket xxxxx

But xxxxi was up. xxxxl was down. Nope they’d shut the wrong one down. I can imagine what happened. The ticket system is disjointed with the system that manages the accelerators. Somebody typo’d the entry of which one to shut down.

I guess I’ll find out more when it’s not 3am in the morning. Easier to discuss this stuff when people have had a good night’s sleep! Now to try and explain it all to the big boss man!

0 Comments

First UK swine flu patient death

Stories like this enrage me. Why? Let’s take a look at the story’s strapline on the front page as of right now:

A patient with swine flu and other health problems has died, a Scottish government spokesman has confirmed.

Right, so a patient, who has flu… you with me so far? Died. Ok, that’s fine. The important detail is also included near the top of the story:

The patient, who had underlying health problems, is understood to have died while being treated at the Royal Alexandra Hospital in Paisley.

Of course, the general public will ignore the bits I have bolded here. It’s written as a scare story with the facts only mentioned in passing. The media, already known for blowing things out of proportion, are just at it again. It’s a well known fact, even with normal Flu variants, that if you have underlying health problems, the risk of complications is high. Nice one BBC News, I notice you failed to mention that little detail.

BBC NEWS | UK | First UK swine flu patient death.

0 Comments

Playmobil Security Check Point

This is just great! I think the title says it all.

Amazon.com: Playmobil Security Check Point: Toys & Games.

0 Comments

Is it any wonder the world is infested with spam?

If you Google for ‘iTunes’, you get a nice sponsored link at the top that looks like it goes to the official Apple iTunes page. In fact, it does not. It takes you to http://www.itunesgu.info/uk.html (probably best not to go there!). It forces you to sign up to download iTunes. At the very least, it means they captcher your e-mail address/name details. You can even PAY! Yes really. You can pay $11.67 per year for a 3 year membership!?

I dread to think what’s actually in the download.

Google and Apple should really stop this sort of thing – don’t you think? Way to spread the badness around the Internet.

Google offering spam/adware above official downloads

Google offering spam/adware above official downloads

0 Comments

CRY vs. DRY

A work colleague coined a fantastic term for code that just isn’t DRY:

Constantly Repeating Yourself – CRY

Not only does it describe one’s reaction to amazingly shoddy code, that just oozes of a developer spending all day using Copy and Paste, but seems an appropriate opposite.

Back to refactoring CRY code with me!

0 Comments

The blog – It’s moved! Again!

I decided to come back to a WordPress based blog – hosted at Joyent. The reasons were pretty simple. I wasn’t overly happy with the way that Typepad‘s pricing model worked. It’s ok for people wanting a pretty basic blog, but if you actually used it and want to customise it, I think WordPress is better.

I could have done the whole free hosting on WordPress.com thing – but I prefer hosting myself.

Hope the few readers I do have like the theme!

0 Comments