I don’t have specifics about the holes we patched (it was done a while ago and I didn’t keep notes) but the basic idea was to validate any incoming variables in PHP. Using the example log above, our scripts now check to make sure thread_id is a number. This can be done using the following:

if(!is_numeric($thread_id)) {
exit_error(“Invalid thread id”, “The thread id you sent was invalid. Please try again with a valid thread id.”);
}

Another thing to do would be to make sure you don’t use the PHP inclusion mechanism for any variables taken in from the user. For example, don’t do something like this:

require($thread_id);

Otherwise, good luck. These script-kiddies are really annoying.

Who knows? maybe they tried to “huff and puff until they blow your house in”

It appears that you do have readers. And from Israel, nonetheless.

We have had the same attempts, but not by “dumb” script kiddies. They actually know several access points on our domain, which means that they have managed to squeeze some information out of the server.

Could you post a reference of the hole that you fixed? Knowing our sys admins, it is already fixed, but I wouldn’t want to crash down because of such an assumption.

And thank you for your sarcastic article. As they say: some kiddies never die – they just smell that way…

Dotan