Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was Googling one of my domains (hosted on shared hosting) and found a webpage where it was list as Hacked Site, the list belonging to a certain national hacking group (the country they claim to belong is notorious for lot of international troubles, but the country, as such, has no accords in hacking World).

Only the root index page is public while rest of the data is protected by HTTP Authentication. Moreover, each page (in addition to logging by the cPanel) also has its own visit logging script which logs visit data to the DB and neither of the two logging mechanism show an unusual activity during the past few months. Also none of my files seem to have been affected or altered.

As of writing, I have blocked all access to most of the folders/data completely and changed passwords and username for the once not blocked. The domain is primarily used by us for testing and experimentation.

  • Is this possibly a false claim? (There is very little to suggest an intrusion going through logs and state of the files, db etc.)
  • How can I better diagnose the situation?
  • Given that it is on hackers list, should I abandon the domain and/or host?
share|improve this question

2 Answers 2

up vote 4 down vote accepted

It could very easily be a false claim - and it sounds like you have done the right things regarding checking logs, database etc - and you can perform in-depth forensic analysis (either yourself or contract one of the many companies that do this) but if you are in any doubt you should plan for the worst - a rootkit.

If you have a well concealed rootkit, the only option is to completely wipe the machine and start again from known good sources.

Your point about a hacker's list depends on what they are saying. If it is purely a 'we defaced/pwned these sites' list, then I wouldn't think anything of it once you have secured it.

share|improve this answer
    
Its shared hosting...So if there is a rootkit it likely would not be possible to clean the machine. –  Ramhound Dec 28 '11 at 12:18
    
As pointed by Ramhound, being on shared host limits what I can do. I have sent an email to providers to garner more info and awaiting a reply. Thanks! –  check123 Dec 28 '11 at 17:03
  1. Yes it may be a false claim

  2. "protected by HTTP Authentication" - hardly great security. Even when it is exclusively over SSL - is it?

  3. "in addition to logging by the cPanel" - erk!

  4. "Also none of my files seem to have been affected or altered" - how did you check this? Have you checked all the files on the server?

A lot depends on what access you have to the system. If this is a shared server then it's quite possible you could have no visibility of a compromise on your vhost. It also means you'd be very limited on what you'd be able to implement on the server. Even if its a dedicated server, the claim may relate to a DNS poisoning issue which is has no impact on the state of the server nor your access to it.

How do you check that there aren't additional files deployed on the server (as opposed to modifications of your files)?

If you've got reason to be concerned then wipe it and redeploy it. If you don't have the facility to do this, then you're not going to survive a real attack - so get this set up. Also have a look at deploying a host based IDS such as tripwire or lids.

share|improve this answer
    
Its shared hosting. While everything you said is valid. His choices will be limited. –  Ramhound Dec 28 '11 at 12:29
    
It is not "only" HTTP authentication. It is the first level to the each sub-domain. And documents within are authenticated by a well tried and tested php based authentication solution. –  check123 Dec 28 '11 at 17:11
    
"Also none of my files seem to have been affected or altered"... Ok, I'll qualify that it is based on randomly selected samples. –  check123 Dec 28 '11 at 17:12
    
Well I have written a mail to the provider and awaiting a reply. Lets see if their reply holds something of value. –  check123 Dec 28 '11 at 17:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.