Does using API Gateway protect you from the early PHP2Shell attacks?

Does using API Gateway protect you from the early PHP2Shell attacks?

There is a small possibility it did at least move your infrastructure down in priority on the list.

We know the first attacks were observed by AWS 4 days before the disclosure.

If I was an attacker, I would have had to know the clock was ticking on the attack, so I have 2 options if I want to move fast.

I could go for the highest-profile websites that I know use PHP, but those would likely get patched quickly.

What if you wanted to covertly create a bot net? Then you would want to find as many poorly maintained WordPress sites as possible.

Not to pick on WP, there are plenty of other PHP frameworks out there to pick on; several of which I have personally authored.

To do this, a malicious party might crawl every IP address to find its targets.

Now it’s estimated it only takes about 90 minutes to crawl every IPv4 IP address on the internet.

You might think that since roughly 70% of the websites on the internet run PHP, then likely 70% of the IP addresses would have PHP running but we need to remember to discount for residential IPs, which are less likely to be hosting websites.

Crawl through as many of these as possible, and it gives the attacker their initial list of websites to attack.

It’s not incredibly difficult to get a list of domain names either, I suppose, but if I was going for efficiency, I would try to capitalize on the fact that oftentimes easy targets like virtual dedicated servers with a single IP often host multiple domains on the same box.

Where does API Gateway come into play?

API Gateway uses the host name to route traffic not the IP address sense API Gateway has many many hosts living in edge networks all over.

So they would have to hit your specific domain, not just a random IP address.

How much protection does just using API Gateway(or any proxy) provide?

Not much… not much at all.

I deal in probabilities, and the decrease in risk is not nearly enough for me to just make the blanket assumption that just because your website was behind a proxy it didn’t get “pwned”.

I recommend you do your homework: patch your system, rebuild the box if you are still on a VPS, and cycle your creds.

I am getting a lot of content out of this PHP2Shell thing lol. Funny how disasters can be inspiring…