-1
votes
1answer
35 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
-2
votes
1answer
91 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
0
votes
2answers
95 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
0
votes
1answer
139 views

I think my server was hacked - how do i know what has been changed? [duplicate]

I have read the following posts which didn't answered my questions: - My linux server was hacked. How do I find out how and when it was done? - How do I know if my Linux server has been hacked? - and ...
2
votes
1answer
382 views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
2
votes
3answers
263 views

Blocking IP addresses of obvious hack attempts [duplicate]

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this: [Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client ...
1
vote
1answer
452 views

Can I clean these two hacked servers withour reinstalling? [duplicate]

I've got two dedicated servers that some days ago started to send me notifications about unknown cron jobs running. On both servers I've got secondary accounts for my websites and the hacker has ...
1
vote
1answer
87 views

Someone tried to access a list of hundreds of standard website urls in a go, is it a cause of concern [duplicate]

I was just checking my website logs today and found that someone accessed my website for a list of hundreds of standard urls that almost every 3rd or 4th website developed on a standard platform ...
1
vote
0answers
89 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
2
votes
0answers
92 views

What kind of hacking attempt is this? [closed]

This past week, my traffic logs are showing many hits (usually with repeated tries) for a url from perhaps 30+ different ip addresses all over the world. This is not a url that should garner more than ...
1
vote
3answers
347 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
-1
votes
1answer
202 views

My URL has been identified as a phishing site [duplicate]

Some months before ordered VPS at Ramnode According to tutorial (ZPanelCP on CentOS 6.4) http://www.zvps.co.uk/zpanelcp/centos-6 Installed CentOS and ZPanel) Today received email We are requesting ...
0
votes
2answers
69 views

How can i make my all webistes only accessible by browsers and not auto scripts

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101 Is there any way that my all websites are only avaiable to genuine browsers and not ...
0
votes
2answers
96 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
1
vote
1answer
216 views

How to lockdown a Ubuntu 12.04 web server [duplicate]

All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with nginx 1.27 php5-fpm php 5.4.14 mysql 5.5 postgresql 9.1 ...
11
votes
4answers
2k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
0
votes
1answer
144 views

Many of joomla websites on my server have been hacked; no other kind of website [duplicate]

Today I got that many of Joomla websites on my server are hacked. Some of the hacked joomlas were updated (the last version from 2.5 series) with the last version. In many cases, the main index.php ...
-2
votes
1answer
51 views

Read a file created by root user on unix system [closed]

I have a file created by root user on unix system and the file is assigned to a particular group.All I want to do is read that file by logging in as user which is not root and not a part that ...
1
vote
0answers
28 views

What is a logical approach to tracking IPv6 connections for abuse? [duplicate]

I have a web server that issues AAAA records and I want to understand how I should monitor that interface for abuse. Specifically, how should I dice up that address to determine hacking or brute ...
-2
votes
1answer
56 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
4
votes
3answers
119 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
0
votes
2answers
250 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
1
vote
0answers
41 views

When a possible hacker logs into my server, how can I see what they're doing? [duplicate]

Possible Duplicate: Monitor an incoming SSH session in real time I have a CentOS VPS running lfd, and occasionally I see someone logging into my server from an unexpected location. I'm ...
0
votes
0answers
76 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
3
votes
5answers
2k views

How to analyse logs after the site was hacked

One of our web-projects was hacked. Malefactor changed some template files in project and 1 core file of the web-framework (it's one of the famous php-frameworks). We found all corrupted files by git ...
-1
votes
1answer
79 views

Is it more secure to spoof addresses using the HOSTS file?

If I have a Windows service with a config file that points to web services it needs to call, is it more secure to put a fake DNS name for the server being connected to, then update the HOSTS file to ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
8
votes
3answers
962 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
2
votes
1answer
133 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
1
vote
1answer
199 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
3
votes
2answers
571 views

Apache server redirecting requests from Google, compromised?

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
0
votes
4answers
733 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
1
vote
5answers
651 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
791 views

Backdoor and zmeu process on a Linux system [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY First some background info. The server we're talking about is running CentOS 5.6, SSH on port 22 which can be accessed over the ...
0
votes
1answer
67 views

Common ways of spam files ending up in a web directory

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either. What are common security breaches ...
2
votes
3answers
125 views

Securing a LAMP host from physical data extraction

This is more of a theoretical question and request for advice and pointers than a question about specific software. I have a distro-agnostic Linux machine (meaning I don't really care what to put in ...
-2
votes
1answer
83 views

Good tutorial for security on a server [closed]

I previously have had trouble with hackers hacking into servers I was using for web hosting. Does anyone know any good tutorials to prevent it, or perhaps give me some tips on how to increase ...
2
votes
1answer
266 views

Hacking attempt - my server has recently had a hacking attempt. I have the ip address of the attacker

Can I report them to the police ? I am in the UK - is there any type of authority that investigates such matters ?
0
votes
1answer
260 views

mod_proxy security issues

A friend is asking me about mod_proxy modules , They have a server that was recently attacked using mod_proxy and after checking his logs he said he wasn't vulnerable to those attacks since they have ...
5
votes
3answers
862 views

Hacked? How does appending a filename allow access to data on site… see example

Visiting all of the following sends you to the login screen: http://mysite.com/admin/configuration.php http://mysite.com/admin/login.php However if you visit (note the last two portions of the url ...
1
vote
2answers
379 views

How to ban potential hacker IP Addresses from Port 80?

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an ...
1
vote
1answer
720 views

Examining PHP hack script [closed]

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a ...
3
votes
1answer
322 views

How did a phisher upload to my server?

My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
3
votes
3answers
396 views

Anti-DDoS Question [duplicate]

Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
1
vote
2answers
588 views

How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?

To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration: IIS Directory Listing Disabled Anonymous Access is Enabled Site ...
4
votes
2answers
230 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
-1
votes
3answers
311 views

To what extent can you secure a system? [closed]

To what extent can you filter/firewall for suspicious traffic or lock down a system? If you have everything up to date and secure, what can you do to protect against a 0 day? I assume an IDS might ...