Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the news in the last 2 years, Anonymous/AntiSEC/etc... has been getting a lot of press for hacking high profile websites:

  1. PlayStation Network
  2. FBI
  3. CIA
  4. Bank websites
  5. Stratfor
  6. etc....

I'd like to know what the faults were for the server admins / developers, and how they got hacked - in an effort to make sure others don't repeat their mistakes. Can anyone fill in info about any of these?

I am NOT concerned with Denial of Service attacks...

share|improve this question

closed as not constructive by Mark Henderson Dec 26 '11 at 20:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

There are quite a few methods, but the four main ones are as follows.

Open vulnerabilities are often to blame, either in the software running the website (Apache, PHP, IIS, etc) or the code (SQL Injection, buffer overflow, etc), or the operating system itself.

There's also the possibility of using an intermediary system such as an infected workstation or vulnerable firewall to access a web server that may not be as protected from threats posed by "trusted" systems.

Inside threats, from disgruntled current or prior employees, provide an attack vector that is extremely hard to defend against. This is especially true when the employee has a high level of access, such as a sysadmin.

Finally, social engineering can play a large part. Convincing someone over the phone that you need a password reset for "your" (wink, wink) account is a common one, but there are innumerable possible cons that can be run on an unsuspecting organization.

Sometimes it's a failure of the sysadmins, sometimes it's a business decision to not finance security, sometimes it's a matter of a stupid user or two. Against a determined, financed adversary, any system will eventually succumb. It's just a matter of time because there is no such thing as perfect security.

If you want a nutshell answer to how to be safer: Keep all software up to date with the latest security patches, review all in-house code, train all your employees, and limit the amount of access to what is absolutely needed by employees and systems. Hiring competent people (technical or not) and treating them well also helps immensely.

share|improve this answer
SQL injection is only made possible by negligent and infantile programming by not encapsulating parameters, and is inexcusable (IMHO). Buffer overflow exploitation ought to be impossible if code (and compilers) are properly written, but they are a statistical fact because humans are involved and can't think of everything. Defensive programming considers every line of code for exploitation as it is being written, but takes extra time and money. As there is often so much pressure to deliver something working ASAP, short cuts are inevitable and can remain unnoticed and unpatched. – Andy Lee Robinson Dec 26 '11 at 21:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.