Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared on the FTP-server. I deleted all the files and changed the password on everything in relation with this server... a couple of days later files appeared again so i deleted them and they haven't appeared yet, now there is still one more thing that is anoying me if i look at the ".com" file (which stores request's to the website) it grows to like 50 000 request's a day :( ! Whats more all the request are from a ip-address traced to like Argentina, and they are asking for one of the removed .exe files... as far as i understand they are getting back the 404 file.

A example row from the .com file:
"Requestor IP" - - [02/Aug/2012:19:24:32 +0200] "GET /onlySMT.exe HTTP/1.1" 404 3612 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; GTB7.3; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; BRI/2)"

Now there are 50 009 rows like this in the log file... What can i do to stop this?

btw the passwords i use are random 12 character length with English alphabet, small and large letters and numbers.

Thank you in advance for any answers which are all very appreciated

WBR

share|improve this question
1  
What do you run on your website, e.g. what kind of APP? You should upgrade it or fix the security flaw. – Andrew Smith Aug 2 '12 at 18:21
Thank you for feedback Andrew! The app i run on the site is a basic website with absolute minimum functionality, the only "medium-advanced" stuff on there is a reservation capability from booking.com and a YoxView image viewer... i disabled Stats from Modlogan cause to narrow down what was the security hole :/ – 54N1 Aug 2 '12 at 20:14

2 Answers

up vote 4 down vote accepted

That's the kind of behavior a botnet displays. What you can assume from the re-appearance of deleted files is that your server has been 'back-doored'.

Changing passwords will not help. A total wipe and rebuild of the server is in order. Because you are 'renting' the service, you will need to shut it down and get a new IP and a new environment on the server.

share|improve this answer
Thank's for the response! So basically there is not much i personally can do :( ? Except hope that the people owning the web-hotel service fix it... right? – 54N1 Aug 2 '12 at 20:33
I would shut down your service and start a new one. – schroeder Aug 2 '12 at 23:23
You mean i should go to another web-hotel ? – 54N1 Aug 2 '12 at 23:26
2  
Or ask that your environment be wiped and start another from scratch. – schroeder Aug 2 '12 at 23:32
up vote 2 down vote

This is a common technique to distribute exploits and viruses: hack a random website, host the data you want to distribute, and make many people go there. Or use the server as update server for a virus that has already spread. This makes it much harder to trace back who wrote the virus.

What I would do is:

  1. Replace the exe with something that displays an alert to the user, telling them they have a virus and should ask someone to remove it (e.g. bring it to a repair shop). Perhaps also contact an antivirus company for further directions on how to make users aware.
  2. Inform my host about this, demand to move me to another server and tell me how this could happen. If they refuse to tell what happened, move to another provider. Or perhaps move to another provider regardless.
share|improve this answer
Thank you for the feedback, i already thought about 1) i know that for instance the target platform is windows cause of the extension so it might not be a bad idea.. but that would make my bandwidth suffer (Maximum on srv is 50 gb / month)... 2 seems like the most real outcome though... although could do both... – 54N1 Aug 2 '12 at 20:54
1  
The executable doesn't have to be large. It think with a few lines C# and no special compile options, the executable will be <200KB. You could cover 262000 requests and perhaps help hundreds of people with this. Simply take down the file when you are nearing the limit. – Luc Aug 2 '12 at 21:07
You are right! I am gonna make a exe really simple with a warning text and links to Avast, Avg, and Eset... But before i put it up there... can it backfire on me, should i keep something in mind? – 54N1 Aug 2 '12 at 21:33
Users may think you are the hacker, but since you aren't they can't do anything legally against you. Just make sure not to reveal your home address or full name, just in case. I don't have much experience with this. Good to hear you're going to try this! I'm interested if you have a result of some sort :) – Luc Aug 2 '12 at 22:01
1  
It's up on the server... hopefully it will help someone... – 54N1 Aug 2 '12 at 22:24
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.