2

I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was some other activity on the server, as well. It included:

  • Brute Force Hacking (I can verify this with the Auth logs)
  • Redirection Malware attempts. People started getting warnings from Norton, and I also got a warning from Firefox.

After clearing out the websites entirely, and re-installing them, one by one, and adding security plugins to them, everything checked out fine. I've beefed up security on the server with fail2ban, and other various security patches, and utilities. Everything seems to have subsided and the attacks seem to be either entirely gone, or have been made irrelevant.

I'm not new to Apache, Linux, PHP, MySQL, and a host of other web related topics (SEO, Marketing, etc.), but I don't know where to start when it comes to security. I mean, I don't even know how the injection/XSS/malware problem even began. I don't know who started it, and why. I don't even know truly, whether the threat and problem is fixed. Where do I begin with those questions?

Some basic info:

  • The sites are powered with Wordpress (latest version) with security plugins.
  • Using Apache2 with Ubuntu 11.10 server.
  • LAMP setup with basic security in place
Improve this question
2
  • When the server was hacked was ANY installation of Wordpress not current?
    – Ramhound
    Feb 17, 2012 at 15:26
  • I think one may have been. Many of them however, were simple one-click upgrades from earlier versions. When I wiped them clean, and imported the XML data again, everything was fine. I checked with Sucuri.net again after the cleanup and everything was green-lit. After installing the security plugins, I'm getting periodic emails tell me that someone has been locked out for attempting to access certain pages, etc. So things seem to be in place and working.
    – willbeeler
    Feb 17, 2012 at 18:41

2 Answers 2

Reset to default
0

Well, I see a lot of questions in there ! Let me take them up one by one !

So there are two attack vectors in your case. The your webapplication and the webserver itself.

I mean, I don't even know how the injection/XSS/malware problem even began. I don't know who started it, and why.

All injection/XSS/malware/redirection problems are basically issues with your webapplication. Hardening your server by patching and softwares like failban won't help you there. You should probably review your web code to make sure you are not prone to SQLi and XSS. There is only one solution: validation!. Validate (and escape) all bits of information you are receiving from your users. Be it date, readonly form fields, hidden fields, dropdowns, radio buttons or anything.

For the redirections, you should check the source of your pages to see the code that is causing the redirect. You can then grep your code base to see if that piece of code is appended to your php/html files (indicating a server breakin via FTP/SSH) OR if that code made its way in your MySQL databases (indicating a sql injection on your web-application).

Remember SQLi/XSS attacks don't take many attempts so failban is unlikely to ban those IPs.

As to who started it and when, you can try looking at the apache access logs to see if you can find something interesting. If an attack was mounted on your web application and used querystring parameters, access logs might have recorded it.

You also mentioned:

Brute Force Hacking (I can verify this with the Auth logs)

Brute force SSH/FTP attempts on any public facing site server is not uncommon. SSH ports constantly get bombarded with dictionary based attacks. I'd suggest having key based authentication and disabling password authentication altogether. If that is not possible, you should have pretty strong passwords that cannot be brute forced.

Improve this answer
3
  • Thank you for answering my question, I do appreciate it. I realized there were 2 points of contention with what hit us. The first, obviously was at the application level, and the second, at the server level. I was kind of looking for something more basic, as a framework for dissecting security issues. In other words, I don't feel in control of the security, of which, I'm responsible. On the other hand, I feel like I'm in 100% control of the PHP side, for example. I know what's going on with the PHP settings, and the applications on the server. You know what I mean? Thanks man!
    – willbeeler
    Feb 16, 2012 at 18:55
  • @willbeeler To be assured that everything is sane, you can run some scans on your website and see what it comes up with. skipfish looks for application level vulnerabilities, though it really is pretty heavy on servers so don't make it brute force if you don't want thousands of requests. You can also try sqlmap - which is pretty good in finding if you have any SQLi vectors. On the server side, you can probably make sure that you aren't listening on any more ports that you need (quick nmap test) and obviously scans like nessus to assess server security.
    – CodeExpress
    Feb 16, 2012 at 19:01
  • Thank you, I'll check that out. The url for Skipfish is code.google.com/p/skipfish
    – willbeeler
    Feb 17, 2012 at 18:43
0

Agree with all above. A good VA scan (Nessus, OpenVAS, etc.) is in order followed up by consideration of a helpful Wordpress plugin.

BulletProof Security WordPress Website Security Protection. Website security protection against: XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking... http://wordpress.org/extend/plugins/bulletproof-security/

And then follow the general Wordpress Hardening Guide: http://codex.wordpress.org/Hardening_WordPress

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .