Printable View
No what I was saying is I dont understand how you think they are a similar concept. People who get their credit card stolen don't have to pay the bill. The government does that. People who get their website defaced get no retribution and the cheapest webdesigner I've seen lately is $15/hr.
If someone defaces your site, you obviously have a security vulnerability - you should proceed based on the assumption that they have admin/root access on your server and act accordingly unless you definitely know otherwise.
This is typically very expensive, requiring considerable downtime while you reinstall the OS, restore everything from backups, reinstall the security patches, and audit any data you had to take from the compromised system (for example database data which could have been subtly modified).
Then there's the annoying task of reissuing all your legit users with new passwords, re-establishing any trusts you have set up to allow external programs in.
If you're running a web application which uses its own authentication, you have to re-issue all the passwords for that system, as the attacker could have compromised those too.
I'd say that's pretty much a pain in the arse, and far more annoying than "un-defacing". That's pretty much totally useless, as they could have installed a zillion backdoors etc. Even on a relatively simple system (say a static web site with a small number of legit users), it's going to cost you many man-hours in repair work.
Slarty
im not saying defacing is a good thing, im saying its not as bad as we traditionally think. They may be the scum of the earth, and may destroy our reputation and stuff, but its not that difficult to undo. When most peoples sites get defaced they are like:
OMG, my sites defaced, the world is going to end, im screwed, im gonna kill them, where are the feds?
and hings orf that matter. If your not running a high profit site, like me its not really a problem, you can email the members and politely ask them to change pwds etc, not a hard/end of the world thing. Now if microsoft got defaced as you suggested that would be a bigger problem, im not supporting defacers/ments im just saying its not as bad as we usually say it is. It doesnt cost "many hours in repair work" unless your american express of something, and EVEN then you should be worried more about a black hat that crashes the server than a black cap defacer that changes your homepage! If they are crashing the server they obviously have bad intentions so trhey will probably steal pwds etc. The defacer usually defaces and thats all. See how this isnt such a big deal as we as a community normally percieve?Again, im not saying this is a good thing, im just saying its not as good as we thought.
Hint Hint... When you are posting on an IT security forum, you have to accept that most ASSUME you are talking about corporate websites, that run their own servers. Not some puny little website on 50megs.com....
unit321 - I don't think you're taking security seriously at all.
If there's even a *slight* chance that a blackhat has put backdoors in a machine, it MUST be reformatted. Potentially compromised data MUST be audited. This all takes a long time. It needs to be avoided.
So what if in 90% of the cases, the skiddie who defaced the site wouldn't know a backdoor if it slammed in their face? It's a chance that you can't take.
Changing passwords might sound easy, but even with a small site, there can be hundreds.
Couple that with the effort to discover the source of the breach and attempt to rectify it - could be a very expensive process indeed.
It's not a can of spray-paint, you can't just whitewash over it and hope it fades away.
Slarty
Yo creo que no entiendes lo que estoy diciendo, Sr. Muert0.... When I mentioned that, I was referring to Unit's post - "just changing the index page" - surely it wouldn't take a webdesigner an hour to fix that.Quote:
Originally posted here by muert0
No what I was saying is I dont understand how you think they are a similar concept. People who get their credit card stolen don't have to pay the bill. The government does that. People who get their website defaced get no retribution and the cheapest webdesigner I've seen lately is $15/hr.
And surely - most corporations have their own designers...so they wouldn't have to pay any more than what they already pay them. But as I said before, that still doesn't MAKE IT RIGHT. ¿Comprendes?
Ahora, pon atención, and stop nitpicking my posts.
Whilst website defacement might seem childish, trivial or a "prank", I think that Soda~ and Slarty are both right on target here............what are the underlying security implications?
Yes you do need to format, re-install etc, just like you would if your desktop PC became "owned".............it is the only secure practice?
The only positive thing I can say is that it has shown you that you have a problem. Unfortunately, just because it was done in such an obvious way does not mean that you can assume that it is harmless................you have to assume the worst?
Remember, it is not like a virus attack that you can "repair".............you have been owned by alien life-forms :eek:
Just my thoughts.......
For the most part it isn't all that difficult to undo. The biggest problems you'll have will most likely be figuring out how they broke in, and the public image hit you'll take for having a security problem thrown in the faces your users. Pretty much everyone who has anything to with this kind of work knows and accepts this.
The incident handling aspects of this can go well beyond what is mentioned in many posts of this thread. If you are a bigger site doing something like e-commerce or online banking there is a very good chance you will end up taking down your entire site to verify the extent of the break in. Then you will be pulling machines out of comission to get backups, or put them on a shelf for later forensic analysis. You'll have to do a good bit of analysis before the wipe and reinstall so that you aren't putting out a box with the exact same vulnerability that got you hit in the first place or at least some more logging and such to collect more data when they make their second attempt. The actual restore process usually will just involve a ghosting of the machine and an install of your web site/web application. Getting your machines back into production is trivial if you have your act together. Doing it right can be a lil more difficult at times.
Next you have your legal problems....If you deal with peoples personal or financial information you will have to do a good bit of work to prove that you did your 'due dilligence'. The proper authorities have to be notified, the data has to be passed between internal and external parties with the appropriate safeguards in place, your legal team notified, etc. If you operate in certain areas (such as california) you may have to send out a mass notification to all of your users to inform them of the security breach. This will further tarnish your image and cost you money.
This whole exercise can cost your dept, company, self, whatever quite a bit of money and time.
If it is your personal site hosted by your isp, you probably won't care as much and will just re-prop or re-write your content. It all depends on your situation.
Judging by your site... are you a web host?
I would think that the reputation of a webhost would be hurt more than the reputation of any other company? Who would use a web host that didn't offer secure servers? Thats horrible...
Our premium plan offers 3 defacements a year?
:confused:
Like nihil said... :borg:
Most sites are also moving away from the old style static pages to dynamic content which normally involves some sort of Database. Now changing your hompeage back aint gonna be that hard as long as you make a backup everytime you update - just load up the backup
but what about i they drop the table your using in your database? Even if your doing daily backups of the database your stil going to lose what ever information has been entered into that database since the last backup - which would be a pain.
Also as alot of people have said already - ok it might increase your hits....but for all the wrong reasons. More people may see your site but less will trust it. Would you write all your credit card information down on a piece of paper and leave it lying in a busy street?
Well thats what you would be asking your visitors to do with any details you collect from them. The fact that someone accessed your site shows that any information you collect from visitors is not secure - and if your visitors know this do you think they will ever trust your site enough to give over sensitive information?
As for your site itself - I really hope you aren't offering webhosting as for you its just a pipe dream and i would give it up now. Its not that you dont have the knowledge to run one (which I dont think you do) - knowledge can be gained.....its your whole attitude...who would want to have hosting with you? what so that they are constantly being asked to fix their sites as you've allowed some defacer to ruin it.
"I'm sorry Mr X that your site has been defaced and you've lost $700 that you paid the designer for it, as well as the $300 your going to lose while your site is down due to lost business....oh and the $350 your going to have to pay the designer to fix it for you.....and not forgetting the damage to your companies reputation which will cost you new customers and repeat purchases from people who did use your site. But hey its not that big a deal - think of the extra traffic you'll get!!" ¬_¬
Of course it isn't going to worry you - your site is just a place to put up ads
the only _content_ on the site the rest is ads - thats just taking the piss!! and a whole 100 visitors....no wonder your soo keen on doing anything to drive up traffic OoQuote:
Website Offline
Due to a recent catastrophy our website is currently offline. We will have it back up asap.
We DO NOT offer free hosting
v_Ln