Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What would you do as first thing if your website was hacked? Taking the site from net? or rollback a backup? not realy or? Did you made any experiences in this way?

share|improve this question

migrated from stackoverflow.com Jan 22 '10 at 18:39

This question came from our site for professional and enthusiast programmers.

4  
Probably more a Server Fault question –  Joey Jan 22 '10 at 18:35
    
update your resume –  einstiien Jan 22 '10 at 18:48

8 Answers 8

The first thing I would do is to take it off the net at least till I understand what exactly is the damage. Assessing what has been compromised in a timely manner is most crucial.

share|improve this answer

Take the site offline.

This is crucial. If the intruder is still in your system and you start poking around, they might notice that you have detected their presence and try to cover their tracks (i.e. delete things).

share|improve this answer

Take it off-line and restore the entire machine, not just the web pages, from your backups. Then, before putting it back on-line, fix the hole they used to get in.

share|improve this answer
    
I know this sounds like common sense, but make sure you find out how they got in before you restore the entire machine, as you will lose the logs, etc when you restore from the backup. –  Josh Brower Jan 22 '10 at 23:34

Hopefully your oganization has a written document that specifies the steps to be taken, who is involved, who is to be contacted. If not begin writing one up immediately. Have you reported it to police cyber-crimes unit, etc.? Don't wait until next time.

share|improve this answer

Change your passwords, and then restore from a backup. Then check your logs, contact your host, etc.

share|improve this answer

That depends on several factors. This includes things such as the sensitivity of your site's data and cost of losing or corrupting data hosted on your site.

I believe the first thing to do is to assess the level of threat in terms of the level of damage and cost to repair. The next thing to do is act accordingly.

share|improve this answer
  • Understand that your web host understands how important your site is.
  • Wipe the OS and re-install from backups. Don't ask your host to have a "quick look" to see if they can clean it up (this will prolong the downtime.)
  • Learn from the experience (as it's almost guaranteed you do not have everything 100% backed up and a disaster recovery plan written)
share|improve this answer
  • take it offline
  • make backup
  • check / analyze (when you have time)
  • restore the last known to be good backup

You can later analyze the compromised files.

share|improve this answer
    
Only check/analyze if you have the time? Why would you put the system back online, without fixing the vulnerability that the attacker exploited the first time? –  Josh Brower Jan 22 '10 at 23:37
    
You are right. "when" is what I meant instead of "if". Sometimes it is critical to have the service back online and in the meanwhile you can analyze the backup of the compromised machine. –  cstamas Feb 2 '10 at 8:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.