Tag Info

Hot answers tagged

733

It's hard to give specific advice from what you've posted here but I do have some generic advice based on a post I wrote ages ago back when I could still be bothered to blog. Don't Panic First things first, there are no "quick fixes" other than restoring your system from a backup taken prior to the intrusion, and this has at least two problems. It's ...


151

It sounds like are in slightly over your head; that's ok. Call your boss and start negotiating for an emergency security response budget. $10,000 might be a good place to start. Then you need to get somebody (a PFY, a coworker, a manager) to start calling companies that specialize in security incident response. Many can respond within 24 hours, and sometimes ...


75

CERT has a document Steps for Recovering from a UNIX or NT System Compromise that is good. The specific technical details of this document is somewhat out of date, but a lot of the general advice still directly applies. A quick summary of the basic steps is this. Consult your security policy or management. Get control (take the computer offline) Analyze ...


51

The key flaw I see in your question is that you seem to believe it is possible to correctly assess from the outside what the damage hacking will do to a given system. How do you know that flipping a given bit the wrong way isn't going to completely destroy something and cost your target thousands or millions of dollars. Since ethics are very subjective I ...


49

This will add at best a very thin layer of "security by obscurity", as 192.168.x.y is a way more commonly used network address for private networks, but in order to use the internal addresses, bad boys have to be already inside your network, and only the most stupid attack tools will be fooled by the "non standard" address scheme. It cost nearly nothing ...


47

Identify the problem. Read the logs. Contain. You've disconnected the server, so that's done. Eradicate. Reinstall the affected system, most likely. Don't erase the hard drive of the hacked one though, use a new one. It's safer, and you might need the old one to recover ugly hacks that weren't backed up, and to do forensics to find out what happened. ...


42

Take it down now and assume all data has been compromised. Restore from a known-good backup; if you have been storing sensitive/private data, assume the hacker also has them; respond accordingly. If your site was hacked through a vulnerability in your code, you may want to close that before you put it back online - else it will get hacked again and again.


39

Don't worry about it. Serving a 404 is a tiny, tiny, tiny amount of work for a web server to do. You could probably serve ten 404's a second using a 486. The bandwidth per 404 is negligible; a tiny GET request and a tiny 404 response. Seriously; don't worry about it. This is just part and parcel of running a server on the internet.


37

There should be a separate firewall somewhere in front of your web server. You want to block the requests there from ever reaching your server, such that as far his IP is concerned your server doesn't exist any more.


33

Unfortunately for You this is how Internet works. Just ignore it. Thousands of bots/trojans scan the Internet. Source IP will be always random. There is no cure. The only 100% solution for eliminating that traffic is illustrated below: An alternative is: - to move with https/http from port 80/443 to something else. Bots usually don't look for http server ...


31

Robert's "bitter pill" answer is spot-on but completely generic (well, as was your question). It does sound like you have a management problem and in dire need of a full-time sysadmin if you have one server and 600 clients but that doesn't help you now. I run a hosting company which provides a bit of hand-holding in this situation, so I deal with lots of ...


31

Pick his lock, or hire a locksmith Walk into his room and shut down his PC. Otherwise, as Vartec says, you can try to block his MAC address on the router. There is a good probability that he has not changed its router admin password. If that's the case, try this: Check the Router/Gateway address that appear in your own computers network settings. ( ...


28

Sounds like billable busywork to me. Aside from the fact that many consumer appliances use the 192.168.x.x address space (which can be exploited, like anything else), I don't feel that really changes the security landscape of a corporate network. Things inside are locked down, or they aren't. Keep your machines/devices on current software/firmware, follow ...


27

It has been shown time and time again it's not ethical. And if you discover a flaw, then they'll likely nail you to the wall if they don't mind the publicity. When you do any sort of security testing, make sure you have permission in writing from someone with the authority to give it. Why? See Randal L. Schwartz. He fought the conviction for 12 years and ...


27

Based on a post I wrote ages ago back when I could still be bothered to blog. This question keeps being asked repeatedly by the victims of hackers breaking into their web server. The answers very rarely change, but people keep asking the question. I'm not sure why. Perhaps people just don't like the answers they've seen when searching for help, or they ...


25

You need to re-install. Save what you really need. But keep in mind that all your runnable files might be infected and tampered with. I wrote the following in python: http://frw.se/monty.py which creates MD5-sumbs of all your files in a given directory and the next time you run it, it checks if anything has been changed and then output what files changed and ...


24

What you want is Fail2ban (assuming this is a linux machine, you didn't say...) What is Fail2ban? Fail2ban will parse system logs, looking for particular regular expressions to block. When it finds a match (or several matches from the same IP, depending on how you configure it), it will block, typically through IPTables. Typically this is used to block ...


23

Keep a pristine copy of critical system files (such as ls, ps, netstat, md5sum) somewhere, with an md5sum of them, and compare them to the live versions regularly. Rootkits will invariably modify these files. Use these copies if you suspect the originals have been compromised. aide or tripwire will tell you of any files that have been modified - assuming ...


22

A security decision is ultimately a business decision about risk, just as is a decision about what product to take to market. When you frame it in that context, the decision to not level and reinstall makes sense. When you consider it strictly from a technical perspective, it does not. Here's what typically goes into that business decision: How much will ...


22

An operating system is not "stable and secure". A properly configured and well-administered infrastructure can be made more secure than one that isn't, but security isn't a boolean. You can't "buy security" or "install security" by using a particular product / technology. You're not a "Linux expert", so it makes sense that you need to hire / contract with ...


22

The first thing to do is not panic. But I see you've skipped that and have decided to The second thing is to take the site down and make sure it's not accessible from the outside until you can figure out what's broke. Start looking at access logs and try to find out what the main problem is. The third thing to do is see if you backup your DB regularly ...


20

NOTE: This is not a recommendation. My specific Incident Response protocol probably would not does not apply unmodified to Grant unwin's case. In our academic facilities we have about 300 researchers who only do computation. You have 600 clients with websites so your protocol will probably be different. The first steps in our When a Server Gets Compromised ...


19

0) Yes. At the very least, it's a systematic probe against your site trying to discover if it's vulnerable. 1) Other than making sure that your code is clean, there's not a lot you can do but run your own tests against your host to make sure it's safe. Google Skipfish is one of the many tools to help you there. 2) I would.


19

It seems we had weak passwords... ...we switched from Windows to Linux recently because it was supposed to be more stable and secure. Go figure. Weak passwords are platform independent. Linux is more flexible than Windows in many scenarios, and thus can be made more secure when those certain situations arise. Switching from Windows to Linux for no real ...


19

Restore from known-good backups. Otherwise, you may have to wipe and reinstall. A good rule of thumb is to NEVER trust a system once it's been compromised. There's too much chance that binaries have been replaced to hide a payload or backdoor. As for the how, it may have been an SQL injection attack. Or some other way in. You were running everything with ...


18

This assumes your roomate is gone and you arn't able to contact him since talking with him is the best option. Keep the power off for three or four hours so his laptop battary dies or at least goes to sleep, then when you turn the power back on his laptop shouldn't start.


17

If you just want to improve you security knowledge, there is a linux distribution called Damn Vulnerable Linux. It is used as a teaching aid in university security classes and includes many security vulnerabilities on purpose. Just install that on a spare computer, much more ethical and you can learn just as much.


17

Re-installation is the appropriate action in this case. Once a box has been compromised like that it's no longer a trustworthy installation. Even if you "think" you have it cleaned up. I would make a copy of the disk using dd or one of the many free disk imaging options out there so that you can do some forensics on it and retrieve any data that you need. ...


17

compare grep usr/sbin/sshd /var/lib/dpkg/info/openssh-server.md5sums to md5sum /usr/sbin/sshd. When they come up with different md5sums, you are no longer using the packaged version. If they are the same, it doesn't mean anything definitive, since anyone who is able to modify your sshd binary obviously has privileges to alter the md5sum recorded in ...


16

In the includes/application_top which gets included by all the scripts in /admin you'll find this little gem (I have thrown some uninteresting parts out): // redirect to login page if administrator is not yet logged in if (!tep_session_is_registered('admin')) { $redirect = false; $current_page = basename($PHP_SELF); if ($current_page != ...



Only top voted, non community-wiki answers of a minimum length are eligible