0

A windows server 2008 web edition that hosts some personal blogs of mine have been hacked with all my php files injected whereas the blog wasn't even active.

The password is very lengthy about 50 characters. So how did the hacker manage to do so. While searching on the internet I stumbled upon this:

http://www.argeniss.com/pressrel032408.html

"The problem discovered by Argeniss results from design issues that were not identified by Microsoft engineers during the Security Development Lifecycle (SDL), and allows accounts commonly used by Windows services (NETWORK SERVICE and LOCAL SERVICE) to bypass new Windows services protection mechanisms and elevate privileges to achieve complete control over the operating system.

The Argeniss discovery also affects Internet Information Services 7 in the default configuration, allowing ASP .NET applications to completely compromise operating system security. "

It mentions asp.net rather than php but maybe it uses something on IIS ?

How can I know and how to really secure my server then ?

Update: SQL Database is not touched, it's directly PHP code from Wordpress. What worries me is that SOME BLOGS HAVE BEEN HACKED WHEREAS THEY ARE NOT ACTIVE IN IIS7 so it doesn't come from Wordpress or mysql.

Improve this question
5

First of all, any serious vulnerability discovered and announced in March 2008 has been patched by now. According to Secunia, there are currently no unpatched vulnerabilities in IIS 7.x

Based on the details you've provided, it's virtually impossible to assess how "secure" your system is (though it doesn't sound very hardened). 

"my php files injected"

What do you mean precisely? If someone managed to store exploitative code in the database because you don't perform input validation, it's not a question of securing the server, as much as securing your blog application. Vulnerable code in web applications is just as bad as vulnerable server software, or server software badly configured.

If I leave my car locked, but with all windows opened, I cannot blame the car door locks when it gets stolen.

Improve this answer
  • I think that sentence is a red flag. SQL Injection is a developer security issue, not an IIS or even SQL Server issue. – Robert Kaucher Mar 10 '12 at 22:33
  • SQL Database is not touched, it's directly PHP code from Wordpress. What worries me is that SOME BLOGS HAVE BEEN HACKED WHEREAS THEY ARE NOT ACTIVE IN IIS7 so it doesn't come from Wordpress or mysql. – user46250 Mar 11 '12 at 19:47
  • the fact that "there are currently no unpatched vulnerabilities in IIS 7.x" doesn't mean that ALL are known. My question is not about known, it is about how it is possible WHEREAS THE BLOG hacked WASN'T EVEN ACTIVE ON IIS7 unless the computer has been penetrated from the system itself. – user46250 Mar 11 '12 at 19:49
  • oh like that, well then yes, it sounds like someone hacked your server. What was changed? – Mathias R. Jessen Mar 11 '12 at 19:53
  • all my wordpress php files were changed EVEN WHEN THAT WORDPRESS BLOG WASN'T ONLINE – user46250 Mar 17 '12 at 8:35
1

Update: SQL Database is not touched, it's directly PHP code from Wordpress. What worries me is that SOME BLOGS HAVE BEEN HACKED WHEREAS THEY ARE NOT ACTIVE IN IIS7 so it doesn't come from Wordpress or mysql.

Of course your database has been touched- by definition if updates have been made that could not have been made through IIS (because the sites were not active) then your database was/is compromised. The question is, was the database compromised first or was the IIS server compromised first. My guess is that it was a sql injection attack that allowed the attacker to modify files on the webserver.

Improve this answer
0

Just received alert from webhosting companies about

http://technet.microsoft.com/en-us/security/bulletin/ms12-020

Microsoft Security Bulletin MS12-020 - Critical Vulnerabilities in Remote Desktop Could Allow Remote Code Execution (2671387)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.