Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.

My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in order to gain page ranks.

The attacker (based on the language of the blog (Indonesian)) is presumably overseas. Can i track them down and prosecute?

What should i do next?

I need to know:

  • How to find out how they got in
  • How to find where the attack came from
  • How to to treat my findings
  • When to involve Law Enforcemnet
  • How to stop the attack from happening again

Hope you can help :)

share|improve this question

closed as not a real question by Terry Chia, Scott Pack, Iszi, AJ Henderson, dr jimbob Feb 11 '13 at 21:53

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Please, one question at a time. –  F. Hauri Feb 9 '13 at 13:44
    
@D3C4FF - I think it would be best to contact Law Enforcement ASAP if you plan to prosecute. Of course, that'd only make sense to you personally and your business, if damages can be established, so you should contact your lawyer as well, probably also your accountant. If you don't consider prosecution worth the time, effort, and also your money, then I'd just save all the logs, repair the damage and investigate your unfortunate event in spare time, but after PTS treatment with some nice Oz brew or two. –  Noordung Feb 9 '13 at 14:38
    
Thanks TidalWave. I've already had a couple for tonight! ;) What i'm after is an answer where someone can suggest the best course of action following a breach of a site. Should LE be contacted first (assuming you want to prosecute) under all circumstances or should i begin backing up log files? Perhaps i should refine the scenario? –  NULLZ Feb 9 '13 at 14:42
    
@D3C4FF - I'm not familiar with Oz laws and procedures, so the usual IANAL applies. I found this DSD site with links to Information Security Manuals for agencies in your country. I think that's a good place to start investigating, what might it take to put things back in place. Here's also a Security Incident Report Form (pdf). Best of luck! –  Noordung Feb 9 '13 at 14:53
1  
@BobWatson: That makes for a good close target on Server Fault but is less helpful as a close target here. –  Scott Pack Feb 10 '13 at 19:29

4 Answers 4

up vote 5 down vote accepted

This is a forum for IT security experts not legal experts in international IT law, so questions about prosecution / law enforcement are mostly off topic. Though I'd first harden your system and later think about trying to prosecute; as tracking down who was the human user at the other end is not a trivial task -- especially if it happened overseas.

Can you describe your setup? Is it on a linux server/windows server/shared host/wordpress blog?

You've given us very little information. Before figuring out how they got in, let's first see what is going on.

How is it being forwarded?

  • Javascript? (E.g., disable javascript in your browser -- does it still forward?)
  • HTTP META refresh tag or in an iframe? Use a utility like curl / wget to download a static copy of the html from your webpage. Is everything in a giant <iframe> or is there a tag like <META http-equiv="refresh" content="0;URL='http://random_other_site.com' />
  • 3xx HTTP Redirect? Use a utility to look at the HTTP headers. E.g., in google chrome - press ctrl-shift-I to pull up developer tools, go to the "Network" tab and try visiting your page. If the http status code is 302/304 (or something else in the 300s), they've altered your server code. Can you login to your server?
  • DNS pointing your domain to somewhere else? Run dig www.foo.com - does it point to your IP address? (They likely managed to change your authoritative DNS records -- go to your registrar to get back control. They probably managed to get your passwords at your registar somehow.)
  • ARP poisoning on your local network? (Try visiting your site from a different network). (If this is the case; just lock down your routers.)
  • Changed your content to their content on your website being served by your webserver? (Look for weak passwords; vulnerabilities where unauthorized users can upload files).

As for how they get in; depends on the type of attack. Maybe you (or any other user with access) you have a weak password (and it was guessed) or one that you've reused elsewhere, or weak password reset mechanism, or you authenticate into your server without using SSL, or you've logged in once from a machine with a keylogger, and the attacker captured your login information. Possibly your site was vulnerable to say cross-site scripting that injected malicious javascript to redirect your site. Maybe your site is configured weakly, used tools that have known 0-day vulnerabilities that allowed attackers to randomly upload files to be served and change content.

share|improve this answer

The attacker (based on the language of the blog (Indonesian)) is presumably overseas. Can i track them down and prosecute?

I would say not; unless you're a multi-national (who can more easily spend resources on chasing people in foreign countries) - this almost certainly won't be worth your time. But this isn't legal advice, so you need to make your own assessment here. The chances of getting any recompense is vanishingly small.

In terms of how they got in, you're going to struggle unless you've already invested in IDSs (Intrusion Detection Systems) of some nature. The golden rule here is that once compromised - you can no longer trust the machine. The attacker may have deleted logs, changed timestamps, etc. Similarly with where it came from - your ISP may be able to help (if you're sure they're Indonesian - ask for all traffic to/from Indonesia, assuming that's not a country you often do business with).

You can look through the logs on the server, specifically the HTTP access logs - the most likely attack vector for a web-facing HTTP server is going to be through insecure web software. Check your software versions for known security issues (Wordpress is pretty notorious for this), check that your passwords aren't simplistic.

The most likely scenario is that some automated worm, probably using Google, found that your site was running a bit of software with a juicy vulnerability and hit it. I'm speculating, but without any more details, that's likely where we are. If you're on a public web host, and any of your files or folders are world-writeable, it could be any of the other sites hosted on your server.

Assuming you find anything; contact your local law enforcement if you think it points somewhere, but I wouldn't hold my breath. If you're in Government or largeish Enterprise, you should have a team, agency or the like to report to - make sure you do do that.

The big thing here is that, since you can no longer trust the machine (bolded again, it's important), your best option is to start over. It's harsh, but if they have local admin, you're just going to get hammered again.

It sort of stops being a security question once you've actually been compromised - have a look at http://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server for other advice, but it starts becoming a legal risk question for your organisation (Is it costing thousands being down? Is it worth booting a maybe-bad server?).

Build everything up again, patch everything, restore your last DB backup. When you put together the server, make sure you lay a secure baseline (Server Certification Processes) so that you can look at the logs saved on a different machine, one you can still trust.

share|improve this answer
    
I agree with your analysis once we determine its a compromised server; but we haven't determined that his server has been compromised yet. For all we know, his application let users inject javascript in a comment form (XSS) which was then used to redirect users away from his original page. Or he had a weak application password for a CMS running on the server that allows someone to change content on his webpages (e.g., redirect to another machine), but they weren't able to compromise the machine. Or that DNS entry was changed as his pw with registrar was guessed or ... –  dr jimbob Feb 10 '13 at 6:27
    
Hopefully @D3C4FF comes back and can add some specifics; compromise of an admin password for a lot of web apps is compromise of the server, since you can usually edit the configuration files, or the code (in the case of Wordpress that exposes php). As for the rest, I suppose a precursor question after hearing "I've been hacked!" with no knowledge of the commenter's background and knowledge should always be "What makes you think that?". –  Bob Watson Feb 10 '13 at 6:47

You "need" to know how they got in. If you're asking this question, it sounds like you didn't prepare, so you may be disappointed with your options. Do you keep comprehensive forensic-quality logs, stored separately from the hacked machine? If not, have you perused the logs that you do have? Read shell history files? Reading logs is your best bet here, gumshoe.

You "need" to know where the attack came from. This is the internet, where machines are hacked to control botnets for proxying attacks against IRC networks that control botnets. If the attacker has any desire to remain anonymous, and you aren't big enough to have governments and communications companies helping you, all you have left is to look for clues like a gumshoe. That can work, if you have the penchant for playing detective, but there is no magic answer.

Since you're not a big company that just lost millions of customer records or units of money, how to "treat your findings" and wondering "when to involve law enforcement" might be taking things a little too seriously for reality. Do you know how many international manhunts take place in pursuit of people who redirect someone's homepage? Zero. Treat your findings like clues in your own miniature cyberwar. Take notes. Call the FBI when you've lost over $1M.

How to stop the attack from happening again? If you can figure out the attack vector, close it. If you can't, then hire a security consultant, or rebuild your system on completely different technology and pray.

share|improve this answer

I will give my methodology that I use to clean-up hacked sites.

You will want to find the most recently modified files from the date you noticed the hack. You can use find /dir/ -mtime to do this. -mtime -1 will provide information from the last 24 hours; check all those files for malicious code.

Once you've established a list of modified files that are malicious you'll want to stat them for modification and creation time. You will then check your transfer logs and FTP logs around that time to find the attackers IP address and way of exploitation. If you are lucky you'll see how they got in; usually, the attacker has hacked your site months previously resulting in you being unable to check logs for how/when your site was hacked.

Some of the most common tools I use to clean-up hacked sites: find,stat,grep -F.

As said previously; we're not lawyers but IT security experts. If the attacker is in a foreign country then don't waste your time. If the attacker is in your native country then still don't waste your time; reason being is they've most likely covered their tracks and are long gone. The amount of resources spent trying to find and punish the hacker could have been put to better use securing and protecting your site.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.