How likely is it that I was hacked by running a local server for development?

Question

Over the last couple of days I've been learning Apache and servers in general - I installed Apache, PHP and mySQL on my Ubuntu system and accessed my website with 'localhost'. I have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network, let alone other computers connected to the Internet. However, I got scared when in a tutorial video I watched they told to turn off your Internet connection as soon as you install Apache. Is it justified? There are no sensitive information in the database or in /var/www, it's all dummy data just for learning purposes, but I'm worried that somebody could hack into my whole system.

Keeping in mind that I've been doing this for the last few days, should I consider myself hacked?

And to make it clear, when I run my server locally and can access it through localhost, is it available to people on the Internet?

Answer 1

have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network

You accessing your services through localhost doesn't mean that it's running as localhost:

When starting a daemon, such as Apache and MySQL, it can run on localhost or on all interfaces. If your IP address is, say, 10.0.0.5; and Apache runs on all interfaces; you can access your pages on both http(s)://10.0.0.5 as well as 127.*. Now, even by running it on all interfaces, if you're protected by a NAT device, such as your default access points, it's unlikely that someone routes into your network. Of course, all users on the same network (WLAN, ...) could access your daemon.

The best way to check this is to run a netstat -an on your machine, the output should be something like:

$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:25              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::80                   :::*                    LISTEN      -

Here can see that SSH (22) runs on all my IPv4 interfaces, 6379 (redis) runs only accessible on localhost and http (80) runs on all IPv4 and IPv6 (:::80) interfaces.

Running them locally only depends on the deamon itself, apache allows a Listen 127.0.0.1:80 in the httpd.conf file, MySQL allows you to put a bind-address = 127.0.0.1 in the my.cnf file (under the [mysqld] directive) and so on. An additional measure you can do is to block all ports using IPTables on your interface (wlan0, eth0, ...), and only allow the services you intend to publish.

It's unsure to consider "yourself hacked". It was, if exposed, for sure subject to it. It depends if you have poor credentials, vulnerable versions, ...

Answer 2

Many common applications are insecure by default, and if you're just writing your first PHP, it's extremely likely that it has vulnerabilities. Are any of these things that can affect your computer more than just messing up your database (which you don't care about)? Maybe, depending on what they are.

How you access the web server does not affect who else can access it; what matters is how the server is configured. Apache is usually configured by default to listen to all requests on port 80. To change this to only be accessible via localhost, change this to Listen 127.0.0.1:80.

You should also look into the firewall rules for your system, as that will provide an extra layer of protection.

Answer 3

In addition to the answers already given, I would also point out two additional things:

• If you are running something like Windows 10, you will have automatic inbound protection anyway and nobody will be able to connect to the web service on your PC unless you responded to that ever helpful dialogue that occasionally pops up asking if you want to allow some kind of network access either on Public or Private networks. When using a Wi-Fi network that isn't yours, always make sure you set it as a Public network and don't allow Apache to talk over public networks.

  For Linux, you will have something called IPTABLES. As is generally the case with Linux, configuring this may be a little more involved but most distributions have a more friendly front end such as the command line UFW. For Linux, you should check that, again, there is no inbound connection allowed. The installation of Apache on Linux is almost certain to reconfigure IPTABLES to at least allow inbound traffic on ports 80 and 443.

  Not sure about Mac I'm afraid.

• When on a public Wi-Fi, make sure you have no open ports if the Wi-Fi is "open", e.g. it has no encryption turned on.