Are we under hacker control?

Question

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.

You can log on only if you have a certificate (for root user) or via ftp (a restricted partition of data for upload contents, but this is not the point) or through apache that have some permission for write onto certains directory.

In recent past we had some trouble with that policy since who can "hack" apache, could delete files onto apache's writable directories. But we didn't get scared since today.

Today we notice that a log file and a log directory, particularly the httpd log's directory and log's files, have undergone a change of permissions (in detail, someone removed the +x perm. to other users. Permissions were 755). Since the owner is root and the group is root, could someone tell me if there is an alternative explaination to "someone stole your certificate" ?

Moreover I know that keep software up to date is the best method for prevent well-known flaws, but in that case I can't image someone that via Apache could do something like that.

Answer 1

Are you saying that your permissions were 755 but are now 754 or 644? Looking at my apache logs (Ubuntu, don't have CentOS handy), they should be 644. Was Apache restarted?

Regarding possible methods of attack (hypothetically speaking of course) -

Presuming that someone did not steal or successfully fake the certification authentication, a possible theory is that someone stole an FTP login (entirely plausible, through social engineering or sniffing the cleartext protocol) and then performed privilege escalation (through a vulnerability in FTP, Apache (unlikely not aware of any at the minute), some other software installed on the system, via the Linux kernel (they do exist but I presume you're well patched on that front unless someone through a 0-day your way, again unlikely but possible if you've data that someone really wants) or finally via your web application depending on how well it's coded, php apps are renowned for being insecurely developed and are frequently vulnerable for exploitation.

I'd recommend removing FTP access and replacing it with SCP (using key authentication).