Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

329
votes
13answers
57k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
44
votes
6answers
4k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
22
votes
10answers
18k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
0
votes
0answers
3k views

Aftermath of Hack

We recently faced a full scale attack on one of our servers running Open SUSE 11.0; the intruder deleted a lot of files necessary for day to day operation. Although the backups came in handy but for a ...
14
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
13
votes
3answers
6k views

How can I detect unwanted intrusions on my servers?

How are other admins monitoring their servers to detect any unauthorized access and/or hacking attempts? In a larger organization it's easier to throw people at the problem but in a smaller shop how ...
15
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
13
votes
9answers
6k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
14
votes
6answers
3k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
5
votes
1answer
3k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
4
votes
3answers
2k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT ...
3
votes
4answers
597 views

Strange stuff in apache log

I'm building some kind of webapp, and currently the whole thing runs on my machine. I was combing down my logs, and found several "strange" log entries that made me a bit paranoid. Here goes: ...
3
votes
5answers
513 views

php site defacing [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY someone is intruding in our site and putting following line in our main page (index.php):: In the following code bottom.php is our ...
7
votes
7answers
1k views

Website hacked again

Final Update: Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story - I was using an older version of wordpress and ...
0
votes
2answers
199 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = ...
0
votes
2answers
212 views

Site compromised, has anyone seen this hack before? - googleanalyticsresearchengine.eu

One of our sites has been compromised and we have had a warning email from google. The site has been blocked by Google in Firefox, has anyone seen this type of attack before? Of the 1 pages we tested ...
12
votes
8answers
2k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
21
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
14
votes
11answers
853 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
6
votes
4answers
1k views

My linux box has been hacked. Some files are undeletable even by root. How can I replace them?

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not ...
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
3
votes
4answers
779 views

How to clean up hacked user account (not root)?

So I setup a linux server and forgot to disable clear text ssh password or install denyhosts or enable any kind of password policy. Usually I have deny hosts and it works well. As a result of missing ...
2
votes
5answers
1k views

How can I learn Linux from hacking or security point of view [closed]

I was interested in entering the security Field and then I studied various posts about that. Someone told that I had to first know the unix system inside out form security perspective and then I can ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
3
votes
6answers
2k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
2
votes
1answer
1k views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
1
vote
5answers
677 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
1
vote
1answer
1k views

I've been hacked, and now I'm a bit confused about some things

I noticed yesterday that my site has been hacked, and I'm really confused about some things at this point. All of the files - as far as I can tell - that were edited or added were done so with a ...
1
vote
2answers
1k views

rkhunter reports change in file properties, but I don't see that they've been updated by yum

Maybe I'm being overcautious, but I recently received the following warnings from rkhunter: Warning: The file properties have changed: File: /bin/dmesg Current hash: ...
0
votes
1answer
982 views

Do cPHulk Brute Force Protection Settings Effect Hosts?

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
-1
votes
3answers
431 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something ...
-1
votes
2answers
227 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...