Tag Info

Hot answers tagged

760

It's hard to give specific advice from what you've posted here but I do have some generic advice based on a post I wrote ages ago back when I could still be bothered to blog. Don't Panic First things first, there are no "quick fixes" other than restoring your system from a backup taken prior to the intrusion, and this has at least two problems. It's ...


156

It sounds like are in slightly over your head; that's ok. Call your boss and start negotiating for an emergency security response budget. $10,000 might be a good place to start. Then you need to get somebody (a PFY, a coworker, a manager) to start calling companies that specialize in security incident response. Many can respond within 24 hours, and sometimes ...


80

CERT has a document Steps for Recovering from a UNIX or NT System Compromise that is good. The specific technical details of this document is somewhat out of date, but a lot of the general advice still directly applies. A quick summary of the basic steps is this. Consult your security policy or management. Get control (take the computer offline) Analyze ...


55

This will add at best a very thin layer of "security by obscurity", as 192.168.x.y is a way more commonly used network address for private networks, but in order to use the internal addresses, bad boys have to be already inside your network, and only the most stupid attack tools will be fooled by the "non standard" address scheme. It cost nearly nothing ...


51

The key flaw I see in your question is that you seem to believe it is possible to correctly assess from the outside what the damage hacking will do to a given system. How do you know that flipping a given bit the wrong way isn't going to completely destroy something and cost your target thousands or millions of dollars. Since ethics are very subjective I ...


50

Identify the problem. Read the logs. Contain. You've disconnected the server, so that's done. Eradicate. Reinstall the affected system, most likely. Don't erase the hard drive of the hacked one though, use a new one. It's safer, and you might need the old one to recover ugly hacks that weren't backed up, and to do forensics to find out what happened. ...


42

Take it down now and assume all data has been compromised. Restore from a known-good backup; if you have been storing sensitive/private data, assume the hacker also has them; respond accordingly. If your site was hacked through a vulnerability in your code, you may want to close that before you put it back online - else it will get hacked again and again.


41

Don't worry about it. Serving a 404 is a tiny, tiny, tiny amount of work for a web server to do. You could probably serve ten 404's a second using a 486. The bandwidth per 404 is negligible; a tiny GET request and a tiny 404 response. Seriously; don't worry about it. This is just part and parcel of running a server on the internet.


37

There should be a separate firewall somewhere in front of your web server. You want to block the requests there from ever reaching your server, such that as far his IP is concerned your server doesn't exist any more.


34

Robert's "bitter pill" answer is spot-on but completely generic (well, as was your question). It does sound like you have a management problem and in dire need of a full-time sysadmin if you have one server and 600 clients but that doesn't help you now. I run a hosting company which provides a bit of hand-holding in this situation, so I deal with lots of ...


34

Unfortunately for You this is how Internet works. Just ignore it. Thousands of bots/trojans scan the Internet. Source IP will be always random. There is no cure. The only 100% solution for eliminating that traffic is illustrated below: An alternative is: - to move with https/http from port 80/443 to something else. Bots usually don't look for http server ...


30

Sounds like billable busywork to me. Aside from the fact that many consumer appliances use the 192.168.x.x address space (which can be exploited, like anything else), I don't feel that really changes the security landscape of a corporate network. Things inside are locked down, or they aren't. Keep your machines/devices on current software/firmware, follow ...


27

Based on a post I wrote ages ago back when I could still be bothered to blog. This question keeps being asked repeatedly by the victims of hackers breaking into their web server. The answers very rarely change, but people keep asking the question. I'm not sure why. Perhaps people just don't like the answers they've seen when searching for help, or they ...


27

It has been shown time and time again it's not ethical. And if you discover a flaw, then they'll likely nail you to the wall if they don't mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why? See Randal L. Schwartz. He fought the conviction for 12 years and ...


27

You need to re-install. Save what you really need. But keep in mind that all your runnable files might be infected and tampered with. I wrote the following in python: http://frw.se/monty.py which creates MD5-sumbs of all your files in a given directory and the next time you run it, it checks if anything has been changed and then output what files changed and ...


25

What you want is Fail2ban (assuming this is a linux machine, you didn't say...) What is Fail2ban? Fail2ban will parse system logs, looking for particular regular expressions to block. When it finds a match (or several matches from the same IP, depending on how you configure it), it will block, typically through IPTables. Typically this is used to block ...


23

Keep a pristine copy of critical system files (such as ls, ps, netstat, md5sum) somewhere, with an md5sum of them, and compare them to the live versions regularly. Rootkits will invariably modify these files. Use these copies if you suspect the originals have been compromised. aide or tripwire will tell you of any files that have been modified - assuming ...


23

A security decision is ultimately a business decision about risk, just as is a decision about what product to take to market. When you frame it in that context, the decision to not level and reinstall makes sense. When you consider it strictly from a technical perspective, it does not. Here's what typically goes into that business decision: How much will ...


22

An operating system is not "stable and secure". A properly configured and well-administered infrastructure can be made more secure than one that isn't, but security isn't a boolean. You can't "buy security" or "install security" by using a particular product / technology. You're not a "Linux expert", so it makes sense that you need to hire / contract with ...


22

The first thing to do is not panic. But I see you've skipped that and have decided to The second thing is to take the site down and make sure it's not accessible from the outside until you can figure out what's broke. Start looking at access logs and try to find out what the main problem is. The third thing to do is see if you backup your DB regularly ...


22

NOTE: This is not a recommendation. My specific Incident Response protocol probably would not does not apply unmodified to Grant unwin's case. In our academic facilities we have about 300 researchers who only do computation. You have 600 clients with websites so your protocol will probably be different. The first steps in our When a Server Gets Compromised ...


20

Restore from known-good backups. Otherwise, you may have to wipe and reinstall. A good rule of thumb is to NEVER trust a system once it's been compromised. There's too much chance that binaries have been replaced to hide a payload or backdoor. As for the how, it may have been an SQL injection attack. Or some other way in. You were running everything with ...


19

It seems we had weak passwords... ...we switched from Windows to Linux recently because it was supposed to be more stable and secure. Go figure. Weak passwords are platform independent. Linux is more flexible than Windows in many scenarios, and thus can be made more secure when those certain situations arise. Switching from Windows to Linux for no real ...


19

0) Yes. At the very least, it's a systematic probe against your site trying to discover if it's vulnerable. 1) Other than making sure that your code is clean, there's not a lot you can do but run your own tests against your host to make sure it's safe. Google Skipfish is one of the many tools to help you there. 2) I would.


18

In my limited experience, system compromises on Linux tend to be more 'comprehensive' than they are on Windows. The root kits are much more likely to include replacing system binaries with customized code to hide the malware, and the barrier to hot-patching the kernel is a bit lower. Plus, it's the home OS for a lot of malware authors. The general guidance ...


17

If you just want to improve you security knowledge, there is a linux distribution called Damn Vulnerable Linux. It is used as a teaching aid in university security classes and includes many security vulnerabilities on purpose. Just install that on a spare computer, much more ethical and you can learn just as much.


17

Re-installation is the appropriate action in this case. Once a box has been compromised like that it's no longer a trustworthy installation. Even if you "think" you have it cleaned up. I would make a copy of the disk using dd or one of the many free disk imaging options out there so that you can do some forensics on it and retrieve any data that you need. ...


17

I'd say @Robert Moir, @Aleksandr Levchuk, @blueben and @Matthew Bloch are all pretty much spot-on in their responses. However, the answers of different posters differ - some are more on a high-level and talk about what procedures you should have in place (in general). I'd prefer to separate this out into several separate parts 1) Triage, AKA How to deal ...


17

compare grep usr/sbin/sshd /var/lib/dpkg/info/openssh-server.md5sums to md5sum /usr/sbin/sshd. When they come up with different md5sums, you are no longer using the packaged version. If they are the same, it doesn't mean anything definitive, since anyone who is able to modify your sshd binary obviously has privileges to alter the md5sum recorded in ...


16

Always nuke it from orbit. It's the only way to be sure. Most systems are holistic entities that have an inner, implicit trust. Trusting a compromised system is an implicit statement that you trust whomever did the breach of your system to begin with. In other words: You can't trust it. Don't bother with cleaning. Disconnect and isolate the machine ...



Only top voted, non community-wiki answers of a minimum length are eligible