Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was hacked recently. The hack seems to redirect any site on my server to a fake virus site. So I deleted all my website files and the hack seemed to go away. About a week later, it's back -- the same one. I never deleted my databases, but also never uploaded the websites that used them. Is it possible for the databases alone, without any website linked to them, to be somehow supporting the hack?

share|improve this question
add comment

7 Answers

up vote 4 down vote accepted

A database SERVER can host a hack, or a database can too, if the database server is set to execute something (like a procedure/script in the DB).

In truth, anything that can execute code and has some (tiny) memory space can host a hack. There have been cases of people hacking networks via a postscript printer, since postscript is a turing-complete language.

In your case though, it sounds to me like something much more commonplace is going on than a database hack. Don't just delete files on your site -- that's just deleting evidence of the crime. It's like sweeping away the bodies of friends when someone shoots them, and expecting no more freinds to get shot. What you have to do is look at the bodies, question who they are, how where they killed, who would want to kill them, how did they do it, and how you can stop them.

You'll need to examine any web scripts you're using. Learn about web security and check any code you wrote is secure; learn about the webapps you've installed, and check you have the latest versions, and that new versions come out whenever security problems are reported. If new versions don't come out to fix problems, then delete the app and NEVER install it again; find a better alternative.

Also, make sure your operating system is up to date (windows update etc.), that you have antivirus installed and up to date, a working, properly configured, secure, up to date firewall, etc.

share|improve this answer
add comment

did you actually found and protected yourself against cause of the attack [ eg hole in cms / forum / whatever other webapp you had ]?

probably hacker left backdoor on your system for her/him-self and it's on lower level then web application.

regarding your question - yes and no - it all depends what kind of information is kept in the DB. if you have some scripted webapp that stores [ for some reason ] executable code [ eg plugins code ] in the database - then surly some backdoor could be left there. even if that is not the case - mabye you have templates stored in db - then for instance xss attack could be repeated against you even if you restored everything else.

share|improve this answer
add comment

To add to what others have said already. The DB can 'host' an hack but it's probably more likely that the OS is infected and not your DB.

Generally speaking however, once your host is infected, it's best to remove the server from the internet, forensically investigate the incident and rebuild the server, not just remove files and hope you got them all.

share|improve this answer
add comment

I think in order for anyone to answer your question accurately more information is needed. Specifically, if one assumes you removed ALL websites from your server, the first question that springs to mind based on your database fears is: can your database server be reached over the Internet?

i.e. is it listening on a public IP? A quick netstat -nuptl should give you this info.

Further, just taking your website content offline does not mean your webserver isn't still available, nor for that matter a host of other networked applications. You need to be aware of everything your system is exposing on the network.

Also, as others have said, when you do not know where the intrusion came from, your best bet is to re-install from the bare metal up: OS, libraries, applications, services, etc. Otherwise you'll spend valuable time running around looking for any possible exploit.

Once you've rebuilt using the latest patches for as much as is possible without causing dependency issues, strip out services not needed, or have them plugged into a Unix socket where possible, instead of a TCP one. And seriously consider some form of IDS. There are many available, but a simple one is AIDE, which works in the same manner as Tripwire - checking for file system changes against a database it compiles.

PS: Backup, backup, backup, and good luck.

share|improve this answer
    
Is Sucuri similar to IDS? Is it a substitute? I use shared hosting, so I'm not sure I can use AIDE. –  Pup Oct 19 '09 at 14:56
    
No, Sucuri is a service monitoring tool -- it tries to check that your public services are up and running correctly, to serve users. It doesn't check whether your server has also been hacked and is doing other things, or is being prepared to do other things. Nor will it catch all hacks of your public services, since it's checking for specific problems rather than checking for security compromises that can lead to any kind of problem. –  Lee B Oct 19 '09 at 21:11
add comment

In addition to pQd's answer:

Some database products allow to execute any system command using SQL functions (e. g. "system") if the user has sufficient privileges.

share|improve this answer
add comment

Is your only step to clean up your compromised system deleting the site files? You should change all passwords and restore from a known good backup.

share|improve this answer
add comment

You are talking about a crack as if it was a virus, than works from inside the system on it's own. There is a possibility that a virus was used to crack your site, but most likely it was cracked from the outside.

Restoring your website files only removed the result of the crack, not the security hole that allowed it to be done. That's why it could be repeated the next week, and that's why it will continue to happen until you fix it.

Two common ways of gaining access is through cross site scripting (XSS) and SQL injection. Both are possible when you don't encode text properly for where it's used.

If you don't HTML encode text that you write to the web page, a client script can be executed and gather information, like for example a cooke value authenticating your administrative login.

If you don't encode string values correctly when you create SQL queries, a value can alter your query to return a different result, or it can contain another query that can change data in your database.

share|improve this answer
3  
-1 For Inaccuracy- "Two common ways of gaining access is through cross site scripting (XXS)" First off, it is XSS, not XXS. XSS is not a common way to gain access to a webserver--In fact, the three examples of XSS that is in the wikipedia article you linked to have nothing to do with gaining access to the server. It is all about the client side-Yes, you could redirect a user to another site through XSS, but that is not the same as "gaining access to the webserver." –  Josh Brower Oct 18 '09 at 1:52
    
@Josh: I corrected the spelling error. I'm not sure what examples you are talking about, but obviously they are not represenatative to what's possible to do. You can read under "Exploit scenarios" for examples of information theft and hijacking. –  Guffa Oct 18 '09 at 2:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.