Need some understanding about a hacker attack...

Hello NYPHP,

  One of my sites went down yesterday with "Out of Bandwidth". When I
  checked into it, a badguy had hijacked an application folder called
  /xml that usually contains one php file that serves the application
  menu system. I have no idea why the software developer chose this
  method. The /xml folder is read only (and has always been read only)
  Yesterday, in addition to the single php file, /xml contained a
  subfolder called odg which contained a porn distribution application
  with thousands of images that it was serving the planet though
  mediacatch.com and myhostdyn.com among others. I have no idea how
  the badguy got in and my ISP doesn't have a clue either. I got them
  to delete the junk because the badguy used a Unix system account to
  create the junk and I was unable to delete with the permissions I
  have.

  Now with that gone, I decided to add a .htaccess file to further
  restrict access to the /xml folder but when I did, the .htaccess
  file does not respond at all. Here is what I put in there:

Options -Indexes

order deny,allow

<files "*.*">
Deny from All
</files>

<files "*.*">
Allow from 127.0.0.1 localhost
</files>

I expected that if I tried to access that folder directly that I would
get a 403 but instead I got the application intro screen?

I checked my test system also and when I do a directory the /xml
folder, it shows me the content of the folder which is yet another
outcome unexpected.

The question I have is Does a folder named /xml have any special
status or significance on a linux box that would cause it to act
differently than say, an /includes folder that usually generates a
blank screen?

Any clues would be greatly appreciated. Notice that I haven't gotten
into the hack at all, no idea how it happened and the ISP is really
vague about what might have happened but is pointing the finger to my
app and, of course, his server is completely secure, btw, its a shared
server. My guess if that the bad guy ripped off the system account and
ran amok on it but nobody is even hinting that this could be a
possibility, to the contrary. Getting back to the /xml, why would I be
getting the bizarre behavior from it?

TIA

--
Best regards,
 mikesz                          mailto:mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Matt Juszczak]

Are allowoverride and options set correctly in httpd.conf for that directory?


-----Original Message-----
From: mikesz@...

Date: Sat, 11 Oct 2008 20:51:37
To: NYPHP Talk<talk@...>
Subject: [nyphp-talk] Need some understanding about a hacker attack...


Hello NYPHP,

  One of my sites went down yesterday with "Out of Bandwidth". When I
  checked into it, a badguy had hijacked an application folder called
  /xml that usually contains one php file that serves the application
  menu system. I have no idea why the software developer chose this
  method. The /xml folder is read only (and has always been read only)
  Yesterday, in addition to the single php file, /xml contained a
  subfolder called odg which contained a porn distribution application
  with thousands of images that it was serving the planet though
  mediacatch.com and myhostdyn.com among others. I have no idea how
  the badguy got in and my ISP doesn't have a clue either. I got them
  to delete the junk because the badguy used a Unix system account to
  create the junk and I was unable to delete with the permissions I
  have.

  Now with that gone, I decided to add a .htaccess file to further
  restrict access to the /xml folder but when I did, the .htaccess
  file does not respond at all. Here is what I put in there:

Options -Indexes

order deny,allow

<files "*.*">
Deny from All
</files>

<files "*.*">
Allow from 127.0.0.1 localhost
</files>

I expected that if I tried to access that folder directly that I would
get a 403 but instead I got the application intro screen?

I checked my test system also and when I do a directory the /xml
folder, it shows me the content of the folder which is yet another
outcome unexpected.

The question I have is Does a folder named /xml have any special
status or significance on a linux box that would cause it to act
differently than say, an /includes folder that usually generates a
blank screen?

Any clues would be greatly appreciated. Notice that I haven't gotten
into the hack at all, no idea how it happened and the ISP is really
vague about what might have happened but is pointing the finger to my
app and, of course, his server is completely secure, btw, its a shared
server. My guess if that the bad guy ripped off the system account and
ran amok on it but nobody is even hinting that this could be a
possibility, to the contrary. Getting back to the /xml, why would I be
getting the bizarre behavior from it?

TIA

--
Best regards,
 mikesz                          mailto:mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[David Krings]

mikesz@... wrote:
> I checked my test system also and when I do a directory the /xml
> folder, it shows me the content of the folder which is yet another
> outcome unexpected.
>

There is a setting in the Apache config that prevents the listing of
directories. In a production system that should be always turned off.
Also, IIRC you can specify the name of the access file in the config as well,
so it may not always be .htaccess, but I cannot think of any plausible reason
to change that. But that may be worthwhile to check out.

Oh, and at your earliest convenience change the hosting company. If they
cannot tell you how such a takeover happened then I wonder what they charge
you money for. Anyone with a PC can do that type of hosting...


David
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

Hello David,

Saturday, October 11, 2008, 9:42:46 PM, you wrote:

> mikesz@... wrote:
>> I checked my test system also and when I do a directory the /xml
>> folder, it shows me the content of the folder which is yet another
>> outcome unexpected.
>>

> There is a setting in the Apache config that prevents the listing of
> directories. In a production system that should be always turned off.
> Also, IIRC you can specify the name of the access file in the config as well,
> so it may not always be .htaccess, but I cannot think of any plausible reason
> to change that. But that may be worthwhile to check out.

> Oh, and at your earliest convenience change the hosting company. If they
> cannot tell you how such a takeover happened then I wonder what they charge
> you money for. Anyone with a PC can do that type of hosting...


> David
> _______________________________________________
> New York PHP Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk

> NYPHPCon 2006 Presentations Online
> http://www.nyphpcon.com

> Show Your Participation in New York PHP
> http://www.nyphp.org/show_participation.php

> __________ Information from ESET Smart Security, version of virus
> signature database 3514 (20081011) __________

> The message was checked by ESET Smart Security.

> http://www.eset.com


HA! My thoughts exactly. I was blown away when they suggested my
scripts without ever checking their log files... Unbelievable! I
thought it was a nobrainer to track such a blatant intrusion
especially when the time frame of when the breach occurred is known
almost to the second.

--
Best regards,
 mikesz                            mailto:mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Dan Horning-2]

On Sat, 2008-10-11 at 09:42 -0400, David Krings wrote:

> mikesz@... wrote:
> > I checked my test system also and when I do a directory the /xml
> > folder, it shows me the content of the folder which is yet another
> > outcome unexpected.
> >
>
> There is a setting in the Apache config that prevents the listing of
> directories. In a production system that should be always turned off.
> Also, IIRC you can specify the name of the access file in the config as well,
> so it may not always be .htaccess, but I cannot think of any plausible reason
> to change that. But that may be worthwhile to check out.
>
> Oh, and at your earliest convenience change the hosting company. If they
> cannot tell you how such a takeover happened then I wonder what they charge
> you money for. Anyone with a PC can do that type of hosting...

On one hand i can understand how the host wouldn't know exactly how the
files got there - but the file ownership and logs should give much more
information away and they should know if it was a shell attack, a remote
file inclusion, or any number of common attacks.

from your side though - are you using a common code base or module that
might be vulnerable, or maybe an old version of a now patched software
setup? if you are, what i use then might be something to look for in a
web host - we use an intrusion detection system that combines
mod_security with some well written rules along with some other software
that monitors everything. With that in place although I'm sure there is
still a way for someone to find a way into your system, it's incredibly
less likely, and the automated attackers would most certainly not work.

to answer your question about the .htaccess file - there is also a
possibility that the host does not have all of the AllowOverride
directive active for your hosting account. in that case some items would
work and others wouldn't.

next up the content of your .htaccess
it's probably not what you wanted to do and i'm nearly positive that the
deny/allow isn't working
> -Indexes
- turns off directory listings
you may also need to change this to another name - thus triggering the
default not to be shown
> DirectoryIndex index.php
 - that will make the only file index.php that will show up when you did
http://host/xml/ (correct me if i'm thinking the other directive it's
early)
--------------------------------------

> Options -Indexes
>
> order deny,allow
>
> <files "*.*">
> Deny from All
> </files>
>
> <files "*.*">
> Allow from 127.0.0.1 localhost
> </files>

this is a working config for something i have running

> Options -Indexes                                                                
>                                                                                
> AuthUserFile /pathto/.htpasswd"                    
> AuthType Basic                                                                  
> AuthName "Staff Only"                                                          
> Satisfy Any                                                                    
>                                                                                
> <Limit GET POST>                                                                
> order deny,allow                                                                
> deny from all                                                                  
> allow from some.ip.add.ress                                                        
> require valid-user                                                              
> </Limit>        

--
Dan Horning

American Digital Services - Where you are only limited by imagination.
direct 1-866-493-4218 . main 1-800-863-3854 . fax [phone]
dan.horning@...
http://www.americandigitalservices.com

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Dan Horning-2]

On Sat, 2008-10-11 at 21:55 +0800, mikesz@... wrote:

> Hello David,
>
> Saturday, October 11, 2008, 9:42:46 PM, you wrote:
>
> > mikesz@... wrote:
> >> I checked my test system also and when I do a directory the /xml
> >> folder, it shows me the content of the folder which is yet another
> >> outcome unexpected.
> >>
>
> > There is a setting in the Apache config that prevents the listing of
> > directories. In a production system that should be always turned off.
> > Also, IIRC you can specify the name of the access file in the config as well,
> > so it may not always be .htaccess, but I cannot think of any plausible reason
> > to change that. But that may be worthwhile to check out.
>
> > Oh, and at your earliest convenience change the hosting company. If they
> > cannot tell you how such a takeover happened then I wonder what they charge
> > you money for. Anyone with a PC can do that type of hosting...

> HA! My thoughts exactly. I was blown away when they suggested my
> scripts without ever checking their log files... Unbelievable! I
> thought it was a nobrainer to track such a blatant intrusion
> especially when the time frame of when the breach occurred is known
> almost to the second.
>

i have to also +1 the new host thing.. ASAP

--
Dan Horning

American Digital Services - Where you are only limited by imagination.
direct 1-866-493-4218 . main 1-800-863-3854 . fax [phone]
dan.horning@...
http://www.americandigitalservices.com

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Brian Williams]

this totally sucks and i'm sorry to hear this happened.  It sounds like you'll need a crash course in Apache configuration...

My advice to you is to do a couple things:

a) Most importantly, consider finding a new host, because
  1) they should have records of all connectivity to that server
  2) their system is obviously insecure and when it comes to server security i believe that hosts have a '1 strike and you are out' grace period
  3) the hacker probably got in through ssh if he was able to set permissions to the point where you were not able to delete them (they were probably under ownership of the account he used to hack the system)

b) assuming that the .htaccess is local to the /xml directory only
  1) (if you haven't done so already) create a .htaccess file in the root directory and put 'Options -Indexes in that
  2) IIRC this: "<files "*.*">Deny from All</files>" is useless because "<files "*.*">Allow from 127.0.0.1 localhost</files>" will override it WITH the following caveat: the *main* apache config has to have AllowOverride All specified

The use of .htaccess files can be disabled completely by setting the AllowOverride directive to none:

  
that means you could make changes to your .htaccess file all day long and nothing will change (which i think is the problem on both machines, but not exactly sure since I don't have specifics of file names, references to those file names, etc)

  3) if your .htaccess file is working correctly i think you want something more along the lines of

<FilesMatch "\..+$">
Order Deny,Allow
Deny from All
Allow from 127.0.0.1 localhost
</files>

Just off the top of my head though

Good luck.



On Sat, Oct 11, 2008 at 8:51 AM,  <mikesz@...> wrote:
> Hello NYPHP,
>
>  One of my sites went down yesterday with "Out of Bandwidth". When I
>  checked into it, a badguy had hijacked an application folder called
>  /xml that usually contains one php file that serves the application
>  menu system. I have no idea why the software developer chose this
>  method. The /xml folder is read only (and has always been read only)
>  Yesterday, in addition to the single php file, /xml contained a
>  subfolder called odg which contained a porn distribution application
>  with thousands of images that it was serving the planet though
>  mediacatch.com and myhostdyn.com among others. I have no idea how
>  the badguy got in and my ISP doesn't have a clue either. I got them
>  to delete the junk because the badguy used a Unix system account to
>  create the junk and I was unable to delete with the permissions I
>  have.
>
>  Now with that gone, I decided to add a .htaccess file to further
>  restrict access to the /xml folder but when I did, the .htaccess
>  file does not respond at all. Here is what I put in there:
>

> Options -Indexes
>
> order deny,allow
>
> <files "*.*">
> Deny from All
> </files>
>
> <files "*.*">
> Allow from 127.0.0.1 localhost

> </files>
>
> I expected that if I tried to access that folder directly that I would
> get a 403 but instead I got the application intro screen?
>
> I checked my test system also and when I do a directory the /xml
> folder, it shows me the content of the folder which is yet another
> outcome unexpected.
>
> The question I have is Does a folder named /xml have any special
> status or significance on a linux box that would cause it to act
> differently than say, an /includes folder that usually generates a
> blank screen?
>
> Any clues would be greatly appreciated. Notice that I haven't gotten
> into the hack at all, no idea how it happened and the ISP is really
> vague about what might have happened but is pointing the finger to my
> app and, of course, his server is completely secure, btw, its a shared
> server. My guess if that the bad guy ripped off the system account and
> ran amok on it but nobody is even hinting that this could be a
> possibility, to the contrary. Getting back to the /xml, why would I be
> getting the bizarre behavior from it?
>
> TIA
>
> --
> Best regards,
>  mikesz                          mailto:mikesz@...
>
> _______________________________________________
> New York PHP Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> NYPHPCon 2006 Presentations Online
> http://www.nyphpcon.com
>
> Show Your Participation in New York PHP
> http://www.nyphp.org/show_participation.php
>

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hello Brian,

Saturday, October 11, 2008, 10:03:37 PM, you wrote:

Thanks very much for the feedback. I have been thinking since I moved to this server in May that something wasn't quite right. All of my administrative email accounts have been hijacked and forged headers have been used to execute major spam attacks. I got thousands of email rejections from all over the planet. The IP address of the mailserver has been perpetually flagged as a spammer so that my member notification almost never get delivered and a series of things have happened to make me think that there is a loose cannon on that server that pretty much runs amok any time he wants to. Only a gut feeling on my side but THEY should know if someone is compromising their server. I DO know that I have never had any kind of problems like this on any Host Provider I have ever had in the past and they have ALL been shared server reseller accounts, even the bad ones didn't give me security headaches. I am very much aware of the vulnerabilities in the software I am using and have added code to prevent the hackers from accessing my include file which is one of the known exploits that have plagued this software in the past. The don't know, of forgot that I do development work on this stuff and told me that my software was "out of rev" and that I should upgrade it. In fact I forgot more about this software than they know but it was a laughable suggestion anyway (I run a technical support site for this software and have installed versions of every thing that has ever been released that I use to support the products). I used to do stuff like that when I did technical support on VMS/Pathworks too many years ago, LOL some things never change!

Actually, its not the first time I have been attacked using this software but it is the first time I have seen a hack on any of my sites, but I think your possible explanation makes me feel a little less anxious about it. I hadn't thought about that SSH access but that very definitely is a candidate.

Thanks to every body who responded I have a good deal of info now that didn't have a couple of hours ago.

Thanks very much.

-- 

Best regards,

 mikesz                            mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Michael Southwell-2]

mikesz@... wrote:
> Hello Brian,
>
>
> Saturday, October 11, 2008, 10:03:37 PM, you wrote:
>
>
>
> Thanks very much for the feedback. I have been thinking since I moved to
> this server in May that something wasn't quite right.

and just who is this host?


--
=================
Michael Southwell
Vice President, Education
NYPHP TRAINING:  http://nyphp.com/Training/Indepth
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hello Brian,

I checked all the points you made and thanks for taking the time.

"It sounds like you'll need a crash course in Apache configuration..." 

That works for me here on my development system that is an XP pro Box running WAMPSERVER but unfortunately my host has all the marbles and seems now to be less than enthusiastic about learning Apache than I would expect. When I got the equivalent of "we are bulletproof" and you are not, I pretty much got the idea that they either don't know what they are doing or the "status quo" is a bigger priority than doing it right.

I have seen this before, though not to this extent, where a tech will say "but they are configured identically" and when you do a phpinfo.php on each of them, its like they are on different planet and clearly configured by different people with totally different compile instructions. 

I think your first point, and the one made by a few other people who replied to me is the most relevant now, need to go hunting for a host again clearly.

Thanks again.

-- 

Best regards,

 mikesz                            mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Dan Horning-2]

Mike,

Please let us know if we can help - we do host sites in a more secure
fashion and monitor all the servers at a high level

rates are on planetnoc.com (we are small but very high powered)

-Dan Horning


On Sun, 2008-10-12 at 10:43 +0800, mikesz@... wrote:
>
> Thanks again.
>
>
> --
>
> Best regards,
>
>  mikesz  
--
Dan Horning

American Digital Services - Where you are only limited by imagination.
direct 1-866-493-4218 . main 1-800-863-3854 . fax [phone]
dan.horning@...
http://www.americandigitalservices.com

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[Brian Williams]

Mike,

Yeah, I've ran into hosts like that before.  As soon as they refuse to accept even the remote possibility that they are at fault it's time to move on, especially when it comes to a hack to that extent.

Did they even offer any logs that you could review so you could "fix your software" (since they say that's at fault) ?

If you are ok with being a sys admin and ~25$ a month isn't too much, I recommend getting a VPS through knownhost.com  I've been dealing with them for about 2 years now and have never had a problem last longer than an hour, and that was only one time.

You'll have dedicated IP addresses, dedicated mail server, dedicated DNS, and just about anything else you want to install.  The biggest up side is no chance of getting labeled as spam, or being at the mercy of someone elses whims, you'll have complete control over php settings and apache configs, and you'll be able to host however many domains,subdomains, etc you want.

No, I'm not affiliated with them, nor employed by them, I just a *very* satisfied customer.  I originally started at the $20/month plan and have since then upgraded twice.

Good luck

On Sat, Oct 11, 2008 at 10:43 PM, <mikesz@...> wrote:

Hello Brian,

I checked all the points you made and thanks for taking the time.

"It sounds like you'll need a crash course in Apache configuration..." 

That works for me here on my development system that is an XP pro Box running WAMPSERVER but unfortunately my host has all the marbles and seems now to be less than enthusiastic about learning Apache than I would expect. When I got the equivalent of "we are bulletproof" and you are not, I pretty much got the idea that they either don't know what they are doing or the "status quo" is a bigger priority than doing it right.

I have seen this before, though not to this extent, where a tech will say "but they are configured identically" and when you do a phpinfo.php on each of them, its like they are on different planet and clearly configured by different people with totally different compile instructions. 

I think your first point, and the one made by a few other people who replied to me is the most relevant now, need to go hunting for a host again clearly.

Thanks again.

-- 

Best regards,

 mikesz                            mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

Some parts of this message have been removed. Learn more about Nabble's security policy.

Hello Brian,

Sunday, October 12, 2008, 11:13:01 AM, you wrote:

>	Did they even offer any logs that you could review so you could "fix your software" (since they say that's at fault) ?

That was the part that floored me. They threw it out there with NO other justification or ANY evidence to support their assumption, nothing and in a really, really nonchalant tone which bugged me even more. Actually, they did refer to the folders in the product that require write access to do things like realtime image conversions and uploads, but definitely NO, "we found a hacker using such and such folder" nothing like that and as I mentioned the exploited folder was and is read only so that was another red herring they threw at me.

Thanks for the tip. I haven't had the best luck with Hosting, clearly. I wouldn't be with these guys but for the ISP that I was with decided that reseller accounts were not profitable so the dumped their service offering but would continue if I wanted to pay three times more $$$ for a smaller package... the one before that, went belly up and disappeared... oh, forgot the one in between, they had offshore support that decided I didn't need write access to anything, unbelievable!

LOL ... its been an adventure, that's for sure... 

Thanks again.

-- 

Best regards,

 mikesz                            mikesz@...

_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

[David Krings]

mikesz@... wrote:
> That was the part that floored me. They threw it out there with NO other
> justification or ANY evidence to support their assumption, nothing and
> in a really, really nonchalant tone which bugged me even more. Actually,
> they did refer to the folders in the product that require write access
> to do things like realtime image conversions and uploads, but definitely
> NO, "we found a hacker using such and such folder" nothing like that and
> as I mentioned the exploited folder was and is read only so that was
> another red herring they threw at me.

Maybe it was not a hack, but the hoster who rededicated your server space to
someone else to rake in some more dough (pure speculation). Can you let us
know who that hosting company is?

David
_______________________________________________
New York PHP Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php