Re: Suspicious files in /tmp

["Matt D. Harris" <mdh () solitox net>]

They're being executed despite filesystem mount options because the 
script isn't being executed, the perl interpretter is.  The script is 
being read and interpretted by the perl interpretter.  Interesting - I 
hadn't thought of this before.  Some logic to check the underlying 
filesystem of a script before reading it would be a very cool addition 
to perl from a security standpoint.  Wouldn't be a big performance hit 
at all just to check once every require, etc as well.  It'd need to be 
somewhat platform specific.  Anyways, it would be neat for someone to 
bring this up within the Perl community as a possible idea, and maybe 
consider python, ruby, and others as well.  Then there're various 
shells... I tested bash and FreeBSD's /bin/sh, and neither of them 
respect the noexec mount flag on FreeBSD either.  It seems like this 
should be a relatively easy problem to correct, at least for the most 
common platforms.  It's a thought that I'm going to bring up with the 
FreeBSD guys and see what their reaction is.  Thanks for bringing this 
up here.  Take care, Matt

kladizkov.thehome wrote:
> Hi,
>
> My firewall LFD, pulled out three perl scripts from /tmp. It was found
> to be executing in my server. I have attached the scripts along with
> this mail. Is this issue familiar to anyone?
>
> How can a script uploaded to /tmp be executed when it has noexec privilege?
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This list sponsored by: SPI Dynamics
>
> ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper 
> It's as simple as placing additional SQL commands into a Web Form input box 
> giving hackers complete access to all your backend systems! Firewalls and IDS 
> will not stop such attacks because SQL Injections are NOT seen as intruders. 
> Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! 
>
> https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
> --------------------------------------------------------------------------

-------------------------------------------------------------------------
This list sponsored by: SPI Dynamics

ALERT: .How a Hacker Launches a SQL Injection Attack!.- White Paper 
It's as simple as placing additional SQL commands into a Web Form input box 
giving hackers complete access to all your backend systems! Firewalls and IDS 
will not stop such attacks because SQL Injections are NOT seen as intruders. 
Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! 

https://download.spidynamics.com/1/ad/sql.asp?Campaign_ID=70160000000Cn8E
--------------------------------------------------------------------------