[nycbug-talk] Searching for suspect PHP files...

[Matt Juszczak]

>> Those kind of attacks are real easy to deploy by automated bots that
>> scan large number of ip's.  They are non-targeted, but could be deadly
>> as well.  Most of them just use perl(1) (run as www user) to launch a
>> remote shell and then execute some rootkit.  By disabling execution of
>> programs like perl(1) for the world, you definetly can stop those basic
>> type of attacks.  Even the simple changing of the default application
>> path can help, as most of them use a simple http://host/application/
>> scheme.

perl run as the www user... well, if its being run as the www user, not 
much they can do right?  Not with the permissions of the www user, anyway.