11

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?

Improve this question
3

8 Answers 8

Reset to default
11

The first thing I would do is to take it off the net at least till I understand what exactly is the damage. Assessing what has been compromised in a timely manner is most crucial.

Improve this answer
3

Take the site offline.

This is crucial. If the intruder is still in your system and you start poking around, they might notice that you have detected their presence and try to cover their tracks (i.e. delete things).

Improve this answer
2

Take it off-line and restore the entire machine, not just the web pages, from your backups. Then, before putting it back on-line, fix the hole they used to get in.

Improve this answer
1
  • I know this sounds like common sense, but make sure you find out how they got in before you restore the entire machine, as you will lose the logs, etc when you restore from the backup.
    – Josh Brower
    Jan 22, 2010 at 23:34
1

Hopefully your oganization has a written document that specifies the steps to be taken, who is involved, who is to be contacted. If not begin writing one up immediately. Have you reported it to police cyber-crimes unit, etc.? Don't wait until next time.

Improve this answer
0

Change your passwords, and then restore from a backup. Then check your logs, contact your host, etc.

Improve this answer
0

That depends on several factors. This includes things such as the sensitivity of your site's data and cost of losing or corrupting data hosted on your site.

I believe the first thing to do is to assess the level of threat in terms of the level of damage and cost to repair. The next thing to do is act accordingly.

Improve this answer
0
  • Understand that your web host understands how important your site is.
  • Wipe the OS and re-install from backups. Don't ask your host to have a "quick look" to see if they can clean it up (this will prolong the downtime.)
  • Learn from the experience (as it's almost guaranteed you do not have everything 100% backed up and a disaster recovery plan written)
Improve this answer
-1
  • take it offline
  • make backup
  • check / analyze (when you have time)
  • restore the last known to be good backup

You can later analyze the compromised files.

Improve this answer
2
  • Only check/analyze if you have the time? Why would you put the system back online, without fixing the vulnerability that the attacker exploited the first time?
    – Josh Brower
    Jan 22, 2010 at 23:37
  • You are right. "when" is what I meant instead of "if". Sometimes it is critical to have the service back online and in the meanwhile you can analyze the backup of the compromised machine.
    – cstamas
    Feb 2, 2010 at 8:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .