0

We have a tomcat server running on window 2012 server which seems to be constantly being attached by Sage 2.0 ransomeware. Some details of the sever,

1) Tomcat is running on port 80 and 8080. 2) Cygwin is also running. 3) There is no other ports open externally.

We are not sure how the infection is reaching the server in the first place. We formatted our server and re-installed everything, but it go infected again, this is when no files were copied from anywhere.

Any pointers to how we being to solve this problem would be really helpful.

Improve this question
9
  • The problem might be in your app. Check every place where it would accept any incoming data from anywhere...
    – Anubioz
    Mar 25, 2017 at 3:57
  • The app accept files only after authorisation and with a valid session. Also, we noticed the suspicious JSP file in webapps/ROOT, how can anyone get access to that location when PUT method is prevented
    – Cool Techie
    Mar 25, 2017 at 6:18
  • By uploading a file with a specialy crafted name (like "../../../file%2Ejsp") with a bruteforced,or leaked credentials? There are lots of ways to do that if your code doesn't do input validation
    – Anubioz
    Mar 25, 2017 at 6:37
  • @Anubioz How to protect? Do I place a filter which blocks all? or any other standard way
    – Cool Techie
    Mar 25, 2017 at 8:41
  • or could you point me to how ../../../file%2Ejsp this is done and I can check how to actually block it.
    – Cool Techie
    Mar 25, 2017 at 8:43

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .