Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message:

Hacked by Z4i0n - Fatal Error - 2009
[Fatal Error Group Br]
Site desfigurado por Z4i0n
Somos: Elemento_pcx - s4r4d0 - Z4i0n - Belive
Gr33tz: W4n73d - M4v3rick - Observing - MLK - l3nd4 - Soul_Fly
2009

My domain has many subdomains, but only the subdomains that can be accessed with an specific user were hacked, the rest weren't affected.

I assumed that someone entered through SSH, because some of these subdomains are empty and Google doesn't know about them. But I checked the access log using the last command, but this didn't show any activity through SSH or FTP the day of the attack, neither seven days before.

I already changed my passwords. What do you recommend me to do?

UPDATE

My website is hosted at Dreamhost. I suppose they have the latest patches installed. But, while I was looking how they entered to my server, I found weird things. In one of my subdomains, there were many scripts for execute commands on the server, upload files, send mass emails and display compromising information. These files had been created since last December!!

I have deleted those files and I'm looking for more malicious files.

Maybe the security hold is an old and forgotten PHP application. This application has a file upload form protected by a password system based on sessions. One of the malicious scripts was in the uploads directory. This doesn't seem like an SQL injection attack.

share|improve this question
5  
Need more information relating to OS type, type of website you were running. It is possible to remove 'last' logs too as well as uploading pages via unsecured/badly written webpages. –  Ryaner Aug 29 '09 at 23:00
1  
regarding the fact that there were no logs showing activity: if they can get on to your server, they can edit the logs... you've got no choice here - you have to wipe the server and start again –  Antony Aug 29 '09 at 23:29
    
As already pointed out: the logs on that machine can not be trusted as that machine can not longer be trusted. The only was to have logs with any degree of forensic usefulness in this type of situation is to have some sort of remote logging setup that the attackers didn't get into as well. –  David Spillett Aug 30 '09 at 0:34
    
1  
@kiewic - you have no idea if the hackers got superuser permissions. removing a malicious file is akin to deleting an install file after you've done the installation. if they have read/execute permission on your machine - they could have done just about anything. there are ways to run services/daemons that do not show up on the list of services/daemons... the only thing for certain from this post, is that you are inexperienced (like almost everyone else - i do not mean to pick on you) in security and you should get help (not from a message board...). –  mson Aug 31 '09 at 12:27

7 Answers 7

up vote 20 down vote accepted

Restore from known-good backups. Otherwise, you may have to wipe and reinstall. A good rule of thumb is to NEVER trust a system once it's been compromised. There's too much chance that binaries have been replaced to hide a payload or backdoor.

As for the how, it may have been an SQL injection attack. Or some other way in. You were running everything with the latest patches?

This link is from a cache of an apparent hack into twit.tv (I think it's This Week In Tech). If you google the phrase you'll get a bunch of hits. Any time there's a scripted mass attack out there you're going to find chatter on different forums discussing it.

Again...DON'T TRUST THE SYSTEM. You probably should wipe and reinstall then restore database information from a previous backup...that's the safest route.

share|improve this answer

It's fairly likely that this was an automated attack against some third-party script or module you're using that has a vulnerability. The same thing has happened to friends of mine using poorly-written third-party uploader scripts.

share|improve this answer
    
I found that they were playing with my server, hum! –  kiewic Aug 30 '09 at 19:57

It's quite easy to get hacked. Were you doing all of the following:

  • kept systems patched
  • had complex passwords for all accounts (8+ characters including Unicode)
  • had all ports locked down on network
  • hardened servers
  • disabled unnecessary/unused accounts
  • not downloaded updates/patches for anything other than from official vendor?
  • ensured all applications are script/SQL injection proof

If you haven't been doing at least all the above, you are asking to be hacked - it's just a matter of time.

Also, if you were running Apache... I just read an article about an Apache server being hacked. The implication is that all downloads from Apache could have been compromised. I just skimmed the article as I don't use Apache, but still the potential implication is HUGE... Just in case you didn't believe me - here is the link.

And, as a final note, I would assume your entire network is compromised. Not only is the machine compromised, any machines that the compromised machine had access to are compromised. I would wipe and reinstall everything that has been compromised or touched by the compromised machine...

share|improve this answer
2  
You should read the link before you go talking about it. None of the source was compromised. And most users download it from downstream anyway. Also the idea of wiping and reinstalling everything on the same network seems insane. Maybe things that this machine had the ability to run root commands on, or write to partitions not mounted no-exec and no-suid on. Those should be minimal in a sensible network though. –  Cian Aug 30 '09 at 2:11
    
1) at the time i read the apache hack, they had done little disclosure. all i know is that their customer facing server was hacked. 2) if a single server is hackable from outside the network, it is not too big a stretch to hack the entire internal network from the compromised machine. the hackers are very bright - they will leave back door accounts, back door scripts, and registry entries that you will not discover. if the server that was hacked was public facing, they can use that trust to install things on client systems. –  mson Aug 30 '09 at 3:01
    
That second paragraph (of the answer) isn't something specific to Apache - in principle, if your server is hacked in such a way that the hackers are able to modify files, then all downloads are compromised, no matter what server software you're running. –  David Z Aug 30 '09 at 4:28
    
@david - the second paragraph only mentions apache because there is a very recent issue (only a few days old) with their security. and the user happened to mention that they just got hacked... the time frames of the two events may or may not be coincidental. i do agree that the same principal applies for whatever you are running, but the only serious security issues i've read about in the last few weeks have been apache and iphone related (and the op didn't say his iphone got hacked)... –  mson Aug 30 '09 at 4:47
    
What do you mean with 'hardened server'? –  Saif Bechan Apr 18 '10 at 7:54

If you google "Hacked by Z4i0n" you will see a lot of sites that have been hacked by these people (perhaps one of them is yours...). In any event, it's very likely that your network has been converted into zombie machines. This guy has a lot of machines converted. At some point in the future, either based on time or based on signal, your servers will be used to attack other systems and machines.

Congratulations - your post is on the first page of Google results!

This is not a SQL injection attack. The hacker has a script to sniff your setup (OS and web server) and is attacking sites that have a vulernability that he is able to take advantage of. Most likely this vulnerability exists because you have not followed standard procedures for hardening an externally facing server.

My recommendation to you is to have your sites hosted by a group that is security conscious. If you do want to be self-sufficient, learn about security measures and hardening, and try again after you feel you are better equipped (at least 2-3 months of learning ahead of you). BTW - even after you learn about security and do follow all the suggested guidelines, you will still be vulnerable - it will just take a lot more effort on the hackers part...

share|improve this answer

Search for hits to _vti_bin/_vti_aut/author.dll in your logfile. Then disable FrontPage Server Extensions on your IIS server. The core-project/1.0 user agent seems to be a defacement tool that uses FPSE, likely with default credentials.

share|improve this answer

You should perform a vulnerability scan on your server - this will help you identify the potential holes that you have exposed. There are some online scanners out there that offer free credits and you can do one free security scan, try link text

share|improve this answer

There are so many ways to attack a website, it's just not possible to cater for them all on a constant basis if you're a small company, so the next best thing is to try and cover the most commonly found holes like the ones described in this article, and hope that puts off the intended attacker.

We use an automated file system scanner called Eyefile. It's good for detecting any kind of backdoor injection - like the one that was executed on your server - and works for any kind of website.

It can be found here: http://www.website-security-tools.com/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.