Gumblar Worm

[oshs]

Hi all,

Looks pretty menacing. Any line of defence we can put up against this?

http://uk.news.yahoo.com/16/20090515...w-6315470.html

Regards,
Suhail.

[eth00]

The problem is that the real issue comes from the CLIENT, not the server. They are using a legit user/pass to login to the server and upload the files.

You could use some server side security to help limit what the shells can do.

One possible solution is to setup ftp uploads to be scanned on upload, that would stop them from at least uploading the tools.

[ramprage]

Upload Guardian offers upload scanning (FTP and PHP) and integrates with your favorite antivirus products. http://www.serverprogress.com/upload_guardian.php