Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack.

The websites have very little in common other than they are ASP.NET, 2 of them are MVC and 1 is webforms, 2 are c# and 1 is VB, etc.

The server is Windows 2003 with IIS6 and all security updates have been installed. FTP was turned off overnight and an attack still occurred.

Any ideas on how to start troubleshooting this?

EDIT: Turns out the latest updates have not been installed (last update was June 2010) so I'll need to install all of those first before investigating further.

EDIT 2: Latest updates installed and problem has yet to reoccur. Chalk one up for keeping your server up to date.

share|improve this question
1  
are there no transaction logs for the forms? If not, check the IIS logs themselves. If you need help deciphering the logs, look here. Search the file for the link to see where it came from and how it was sent. – Paul Ackerman Dec 14 '11 at 22:51

2 Answers

up vote 2 down vote

Use some file integrity checker like Tripwire (commercial) or AIDE (free) to see which files were being changed, it could give you some insight into what is happening and you'll also have fast way to spot the changed files.

You should also inspect server logs for suspicious activity, check if your file upload script are implemented correctly (not uploading to predictable URL, correct permissions - uploaded files should not have permission to be executed).

share|improve this answer
up vote 2 down vote

Log files on the server? Would be a start for seeing what is going on. Check your access controls for the site and server too. But if the server has been compromised these won't be reliable.

share|improve this answer
"Log files on the server", would you be able to recommend anything? – William Hurst Dec 15 '11 at 5:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.