Printable View
i did check the ftp log right after we discovered it, but the log was clean :(
I dont think the guy who i run the site for is planning on taking some "legal" action yet, aferall all they really did was deleting the main html pages, non of the folders were touched so aside the inconvenience of re-uploading the main pages no real harm was done...
Quote:
Originally posted here by prodikal
Well if they are Brazilian i dont think there is much you can do. Correct me if i am wrong but i dont think Brazil has laws on breaking in to sytems please some one correct me if i am wrong
It doesn't really speak towards the laws, or lack of them, but is does suggest that you can get away with it fairly easily.Quote:
Brazil Becomes Cybercrime Hotbed
According to a story in The New York Times today, Brazil is becoming a laboratory for cybercrime, with hackers specializing in identity and data theft, credit card fraud and piracy, as well as online vandalism. Last year, the world's 10 most active groups of Internet vandals and criminals were Brazilian, according to mi2g, a digital risk consulting firm in London. Already overburdened in their fight to contain violent crime in cities like São Paulo, Rio de Janeiro and BrasÃ*lia, police officials are finding it difficult to keep pace with hacker syndicates, the Times reports. In addition, analysts say many businesses, including banks, have been slow to grasp, or refuse to acknowledge, how serious the problem is. Brazil's hackers are strong and resourceful in part because they have little to fear legally, and also that they are sociable and share more information than hackers in developed countries.
Cheers:
But they have comprimised your system, and might of left some bad software on it.Quote:
Originally posted here by metaliana
i did check the ftp log right after we discovered it, but the log was clean :(
I dont think the guy who i run the site for is planning on taking some "legal" action yet, aferall all they really did was deleting the main html pages, non of the folders were touched so aside the inconvenience of re-uploading the main pages no real harm was done...
ty for that DjM i thought it had no laws at all it might as-well not have :p
to CXGJarrod :
maybe, but dont you think i'd see that then? surely they couldn't have planted any files or folders that WE, as the owners of the site cant see ?
and if i understand correctly, then we've been a victim of some organised group....not really after our site nor did they get in through any door i might have left open?
They had to get in someway ;)Quote:
I'd check your site for patch levels on both Apache & Linux. They found a hole, now you have to find it and plug it up, or they will be back.
Cheers:
alright, and HOW do i do that then? .... this branch of the web is totally new to me, i've been a (webmaster) for three years now, but this is the first time we've encountered something like this :(
As i'm an autodidact on ALL i know about web authoring and design , i dont have a clue on how i handle this... i read things like "upgrade the apache..." but, it's what my server uses...how can "I" upgrade it ?
"check for patch levels on apache & linux" .... :confused: ... i'm a fast learner, but someone gotta show me first ;)
Metal:
Er.... They got to your site _and_ they got in.... This kinda proves your sentence wrong on both counts...... ;)Quote:
not really after our site nor did they get in through any door i might have left open?
You really can't afford to take that kind of attitude with security otherwise this will become a daily thing because you will be put on a list of "easy marks" that gets circulated around the skiddie realm so that they can all give their Gr33tz and Fukz to their friends...... Seen it happen.... :rolleyes:
You need to find the hole and plug it. Most probably your best option is a redo from scratch if you don't have complete logs of what they did.
Go to Apache's site and download the latest version and install it. Then, if there are any patchs they recommend for security, download them and install them. Then go to linux's site and do the same. If you have any third party software providing service on the systems go tyo each site and do the same. By the time you have done that you will pretty much have done the system from scratch. Check your firewall config to ensure that only the service ports that should be open are and you should be about set......
Quote:
Originally posted here by Tiger Shark
Metal:
Er.... They got to your site _and_ they got in.... This kinda proves your sentence wrong on both counts...... ;)
You really can't afford to take that kind of attitude with security otherwise this will become a daily thing because you will be put on a list of "easy marks" that gets circulated around the skiddie realm so that they can all give their Gr33tz and Fukz to their friends...... Seen it happen.... :rolleyes:
You need to find the hole and plug it. Most probably your best option is a redo from scratch if you don't have complete logs of what they did.
uhm....it was just a question ya know...not a statement...
i'm not taking any attitude at all, on the contrary, i'm humbly asking for some guidance on how i can avoid it from happening again.
We do have loggs on all kinda things...who uses the ftp & when ; who visits the site & when ; which pages do they look at, which browsers do they use ...
but WHICH log should i check, and WHAT should i look for then ?
Then I suggest you look into possibly bring a contractor to help you secure your systems.Quote:
We aren't suggesting you move away from apache, only that you install / upgrade to the latest version. As new versions come out, problems in the old versions are addressed & fixed.Quote:
"upgrade the apache..." but, it's what my server uses...how can "I" upgrade it ?
I think you may have mentioned it, but what version of Linux are you running?
Cheers: