0

I have a problem with my nginx webserver

Once a day some clients get redirected to random webpages (bad ones), I've checked for malware, virus and nothing comes up.

But I recently read about CDorked infection and I installed tools to detect it and even did it by hand... but nothing came up.

So I Scanned the server for shellshock and it was vulnerable..

my question is.. Can shellshock be redirecting my clients to other websites? or maybe the attacker infected some binaries through there?

Thanks

Diego Velez
  • 1,584
  • 1
  • 16
  • 20
  • The Shellshock vulnerability allows arbitrary code execution, so yes, it's possible, but there are no details in your question that would allow us to confirm or deny that it is involved in anway. – chepner Jun 11 '15 at 19:00
  • @chepner Yea I know, its a bit hard for me too to dig on the issue.. any recommendation? I've tried malware detection and tried to check for Cdorked symptoms (like shearch for shared memory programs), but nothing comes up – Diego Velez Jun 11 '15 at 19:02
  • 1
    Fix the shellshock vulnerability. If the problem persists, it wasn't because of it. – Barmar Jun 11 '15 at 19:23
  • @Barmar I already did that.. then I'll have to wait – Diego Velez Jun 11 '15 at 19:39
  • be sure to update your question with results of your test. Good luck. – shellter Jun 11 '15 at 22:13

0 Answers0