Last night, just before turning off the lights and harassing my wife, I received a text message from our server monitoring software saying that the mail queue on one of our shared web servers had suddenly spiked. Lots of emails being pumped out of a shared web server is almost always the sign of something bad.
10:25pm
Logged into machine and examined one of the emails in the mail queue. Because we roll our own PHP its compiled with a patch that inserts the full path to the script that sent the email. Years ago, when we didn’t have this patch installed, determining which site and/or script sent an email could have taken hours – or be nearly impossible to figure out. Here’s what the mail header looked like (note: the actual web site address has been modified to protect the client):
Continue reading Hacker extraction – New personal best: 10 minutes!




