Printable View
My site recently got defaced, I had the front page and basic site backed up, but the forums were totally deleted. How did this happen? They cracked the password for the ftp I'm guessing. But how did they do that? And what can I do to prevent that?
Thanks.
I'm sorry, just realized I posted this in the wrong place.
They could've used any number of tools to figure out your OS (nmap comes to mind), then grabbed a bunch of exploits for that OS, then got in through any number of methods and went from there. Once they get in as root, they can su to any user that has db access (like postgres which is the default created user for PostgreSQL databases) and from there it's simply easy to dropdb the databases, exit out, delete the user (userdel/etc), then as root, delete the files in any number of filesystems and then worse, remove the filesystems, then reboot the box.
But that's if someone's out for total system destruction. Doesn't sound like that's the case here. Sounds like they wanted to get in and muck with your web servers although I think they did get root because your webserver surely wouldn't be in control of your databases as well. Most defacers are out for public awareness (see www.thesmathers.com for where HIS site went, rofl) and not system destruction.
EDIT: hey man, who negged you? Check your AP center and find out why...you simply did nothing but apologize for an incorrectly-placed post of which didn't bother me that much...
For the Skiddie's benefit, I believe the proper thing to do if you have posted in an inappropriate forum is to PM a mod and ask them to move it for you.
Don't worry about it Midnight, his handle is a good reflection of his intellect.
MIDnightKAO > I moved your post, although the forum you had it in wasn't that bad a choice :)
Midnight, were you hosting your page or was someone else?
If you weren't then who was?
If you were then what OS were you running, what version of apache, did you patch it, what other services where you running, were you firewalled, did you give someone your password.........
The easiest way to solve this kind of situation is to think to yourself "What would I do?"
I use hostrocket for hosting. What does patching it mean? I'm pretty new to this so sorry for any inconvenience. lol.
Thanks for the replies.
Isnt there a way I can allow only a certain IP to log into FTP or something like that?
If your sure that the person got in by guessing your FTP account's password (which your not) then make your password stronger. Change it and make it harder. Also, you say someone else is hosting your website? And speaking of the user who negged you, you could post his name here or you could alert Negative who it was and let him handle it.
A few questions:
Do you know how you were defaced?
Can you post the specifications of your hosting plan / server for us?
Do you use server side scripting of any sort?
What type of database if so?
What forum software did you use?
Are you familiar with SSH and does your host allow it?
Are you sure you aren't infected with any backdoors that would sniff your FTP password?
Have you run Site Digger from Foundstone on your website?
If your site is hosted by hostrocket, there's nothing much you can do about how they run their servers. It's their servers, they decide how to configure them. On their site though, it says it comes with a web-based control panel. It might be worth looking into that panel: it might allow you to set FTP-access, change your FTP-password(s),...
If not: email hostrocket and ask them to change your FTP-password(s).
Another possibility is that you have a trojan/keylogger on your computer, which could be used by the attacker to obtain your FTP-password(s). In this case, changing your FTP-password won't help much. Get an anti-trojan scanner to check for this possibility.
Tauscan has a 30-day trial period.
Something else: you say your site got defaced AND you lost all of your data? If you had a forum, your (forum)data should be in a database. They may have defaced the forum front-end through FTP, but it might be worth to check the database (or have it checked by hostrocket if you don't have access) It's unlikeley that they AND got access to your FTP, AND to the database. Unless that entire web-based control panel is the problem.
Spyder > I know who it was... I deleted the post where the OP said who it was :D
Ahh, si. :D Anyway's, Negative bring's up a good point. All of your database file's must have been in one web-based control panel in which he hacked or gained access to.Quote:
I know who it was... I deleted the post where the OP said who it was
Must be a pretty bad host if you couldn't do that manually yourself in the event of a hack though, right? I mean it could take their tech support days maybe a week or two to get to that. Heh, dunno.Quote:
email hostrocket and ask them to change your FTP-password(s).
hey lissen i guess the hackers got thorough a expoit of the ftp as i did with my college , it was running a ws ftp i got a exploit from the net ran it and i was through with the security , i don say this has happened but i say that this might have happed as script kiddes like me use this exploits
The guy who defaced it left his little tag on the front page, and i did a search on his handle. His handle info said that he has defaced over 100 websites, as part of this defacement clan or something.
My ftp password was very complex...I dont know how he could have cracked it. I've changed my passwords manually. The server suggested I change them often. I scan my computer every day to prevent adware, spyware, and all of that, so I dont think that could have been it.
I'm assuming that if your password was complex and you didnt leave it lying around and there want a wee lil logger or something of the like running,he could've found a vulnerability in the ftp client your server's running..if ftp was the way he actually got in
Is your web site hosted by hostrocket in an shared enviroment. I.e more than one customer is hosted from the same server? And do you have access to cgi-bin?
SittingDuck
WEll man not only do you have to worry about FTP even though that isnt a hacking tool, then again it isnt really a tool, but you also have to worry about people who know how to use PHF that can really screw your whole site up and if they got your IP Address or the IP Address of the person who made that site they can sure do alot of damage that way along with your computer or they could have used command pormpt. And if they where really good crackers they could have used C++ and make a couple of programs and kill your site, but im sure it was only newby wanna-be hackers with NMap and im not saying NMAP is bad but it would be used by anyone talented because all they gotta do is banner your IP Address. SO I hope you work it out. and what is your web-site anyway?