« 素朴な疑問 「角界」 | トップページ | 文化的観点での英語と日本語の違い »

2010年7月21日 (水)

phpMyAdmin に対する攻撃について

【phpMyAdmin】

phpMyAdmin は、PHP言語による MySQL データベース操作の WEB インタフェースを提供する優れたソフトである。しかし、このソフトを安易にインストールするとインターネットに潜む邪悪な攻撃者から被害を受けることになるかもしれない。

【攻撃パターン】

下記は、先日、会社で管理している Linux サーバーに対する、WEB経由での攻撃のパターンである。

/PMA/scripts/setup.php: 3 Time(s)
/PMA2005/scripts/setup.php: 3 Time(s)
/README: 1 Time(s)
/admin/mysql/scripts/setup.php: 3 Time(s)
/admin/phpmyadmin/scripts/setup.php: 3 Time(s)
/admin/pma/scripts/setup.php: 3 Time(s)
/admin/scripts/setup.php: 3 Time(s)
/db/scripts/setup.php: 3 Time(s)
/dbadmin/scripts/setup.php: 3 Time(s)
/favicon.ico: 13 Time(s)
/myadmin/scripts/setup.php: 3 Time(s)
/mysql-admin/scripts/setup.php: 3 Time(s)
/mysql/scripts/setup.php: 3 Time(s)
/mysqladmin/scripts/setup.php: 3 Time(s)
/mysqlmanager/scripts/setup.php: 3 Time(s)
/nosuichfile.php: 2 Time(s)
/noxdir/nosuichfile.php: 2 Time(s)
/p/m/a/scripts/setup.php: 3 Time(s)
/pHpMy/scripts/setup.php: 3 Time(s)
/pHpMyAdMiN/scripts/setup.php: 3 Time(s)
/php-my-admin/scripts/setup.php: 3 Time(s)
/php-myadmin/scripts/setup.php: 3 Time(s)
/phpMyA/scripts/setup.php: 3 Time(s)
/phpMyAdmi/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.10.0/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.10/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.5/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.7/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.8/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.11.9/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.2.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.2.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.0/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.5/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.7/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.8/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.3.9/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.0/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.5/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.7/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.4.8/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.4.9/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.5.0/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.5.1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.5.2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.5.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.5-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.5-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.5-rc2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.5/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.6-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.6-rc2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.7-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.7/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.8/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.5.9/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-alpha/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-alpha2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-beta1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-beta2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-pl2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-pl3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-rc2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0-rc3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.0/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1-pl2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1-pl3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1-rc2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.2-beta1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.2-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.2-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.3-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.3-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4-pl2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4-pl3/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4-pl4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4-rc1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.4/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.5/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.6/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.7/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.8/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.6.9/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.7.0-beta1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.7.0-pl1/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.7.0-pl2/scripts/setup.php: 3 Time(s)
/phpMyAdmin-2.7.0-rc1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.0/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.3/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.4/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.5/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.6/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.7/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.8/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.7.9/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0-beta1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0-rc1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0-rc2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0.1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0.2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0.3/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0.4/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.0/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.1-rc1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.3/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.4/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.5/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.6/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.7/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.8/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.8.9/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.9.1/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2.9.2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-2/scripts/setup.php: 2 Time(s)
/phpMyAdmin-3/scripts/setup.php: 2 Time(s)
/phpMyAdmin-4/scripts/setup.php: 2 Time(s)
/phpMyAdmin/scripts/setup.php: 2 Time(s)
/phpMyAdmin1/scripts/setup.php: 2 Time(s)
/phpMyAdmin2/scripts/setup.php: 2 Time(s)
/phpMyAds/scripts/setup.php: 2 Time(s)
/phpm/scripts/setup.php: 2 Time(s)
/phpmanager/scripts/setup.php: 2 Time(s)
/phpmy-admin/scripts/setup.php: 2 Time(s)
/phpmy/scripts/setup.php: 2 Time(s)
/phpmyad-sys/scripts/setup.php: 2 Time(s)
/phpmyad/scripts/setup.php: 2 Time(s)
/phpmyadmin/scripts/setup.php: 2 Time(s)
/phpmyadmin2/scripts/setup.php: 2 Time(s)
/pma/scripts/setup.php: 2 Time(s)
/pma2005/scripts/setup.php: 2 Time(s)
/rc/README: 1 Time(s)
/roundcube/README: 1 Time(s)
/roundcubemail/README: 1 Time(s)
/scripts/setup.php: 2 Time(s)
/sqladmin/scripts/setup.php: 2 Time(s)
/sqlmanager/scripts/setup.php: 2 Time(s)
/sqlweb/scripts/setup.php: 2 Time(s)
/vhcs2/tools/pma/scripts/setup.php: 2 Time(s)
/web/phpMyAdmin/scripts/setup.php: 2 Time(s)
/webadmin/scripts/setup.php: 2 Time(s)
/webdb/scripts/setup.php: 2 Time(s)
/webmail/README: 1 Time(s)
/websql/scripts/setup.php: 2 Time(s)

phpmy-admin, PMA 等、phpMyAdmin の設置先を狙っていることがわかる。上記リストから引き出されるポイントを列挙しよう。

  • 必要でない限り phpMyAdmin はインストールしない
  • デフォルトのネーミング(phpMyAdmin等)でphpMyAdminを公開しない
  • MySQL のデータベースには必ず効果的なパスワードを施す(MySQLは、通常インストールしたての状態は root のパスワードが設定されていない)

サーバーを公開すると、相手は全世界のハッカーたちである。サーバーを乗っ取られることが無いよう十分注意したい。

|

« 素朴な疑問 「角界」 | トップページ | 文化的観点での英語と日本語の違い »

コメント

it was very interesting to read white-knight.cocolog-nifty.com
I want to quote your post in my blog. It can?
And you et an account on Twitter?

投稿: tacente | 2010年7月30日 (金) 02時10分

Dear sir:

Thank you for your comment. And yes, you can quote my post in your blog.

Regarding twitter thing, I have an account, but it is awfully inactive. Sorry for this situation.

投稿: 館長 | 2010年7月30日 (金) 08時37分

I would like to exchange links with your site white-knight.cocolog-nifty.com
Is this possible?

投稿: cincinna_c | 2010年8月 2日 (月) 23時46分

Dear sir:

Presently I don't have any personal link exchange because I am not willing to have some personal obligation.

Sorry for not admitting your request.

投稿: 館長 | 2010年8月 4日 (水) 11時40分

コメントを書く



(ウェブ上には掲載しません)




トラックバック


この記事へのトラックバック一覧です: phpMyAdmin に対する攻撃について:

« 素朴な疑問 「角界」 | トップページ | 文化的観点での英語と日本語の違い »