3

I rent a web server ("service") at a web hosting site which recently i assume got hacked but i am unsure how... I know it got hacked because recently out of the blue certain files and folder appeared on the FTP-server. I deleted all the files and changed the password on everything in relation with this server... a couple of days later files appeared again so i deleted them and they haven't appeared yet, now there is still one more thing that is anoying me if i look at the ".com" file (which stores request's to the website) it grows to like 50 000 request's a day :( ! Whats more all the request are from a ip-address traced to like Argentina, and they are asking for one of the removed .exe files... as far as i understand they are getting back the 404 file.

A example row from the .com file:
"Requestor IP" - - [02/Aug/2012:19:24:32 +0200] "GET /onlySMT.exe HTTP/1.1" 404 3612 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; GTB7.3; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; BRI/2)"

Now there are 50 009 rows like this in the log file... What can i do to stop this?

btw the passwords i use are random 12 character length with English alphabet, small and large letters and numbers.

Thank you in advance for any answers which are all very appreciated

WBR

  • 1
    What do you run on your website, e.g. what kind of APP? You should upgrade it or fix the security flaw. – Andrew Smith Aug 2 '12 at 18:21
  • Thank you for feedback Andrew! The app i run on the site is a basic website with absolute minimum functionality, the only "medium-advanced" stuff on there is a reservation capability from booking.com and a YoxView image viewer... i disabled Stats from Modlogan cause to narrow down what was the security hole :/ – Cisum Inas Aug 2 '12 at 20:14
4

That's the kind of behavior a botnet displays. What you can assume from the re-appearance of deleted files is that your server has been 'back-doored'.

Changing passwords will not help. A total wipe and rebuild of the server is in order. Because you are 'renting' the service, you will need to shut it down and get a new IP and a new environment on the server.

  • Thank's for the response! So basically there is not much i personally can do :( ? Except hope that the people owning the web-hotel service fix it... right? – Cisum Inas Aug 2 '12 at 20:33
  • I would shut down your service and start a new one. – schroeder Aug 2 '12 at 23:23
  • You mean i should go to another web-hotel ? – Cisum Inas Aug 2 '12 at 23:26
  • 3
    Or ask that your environment be wiped and start another from scratch. – schroeder Aug 2 '12 at 23:32
2

This is a common technique to distribute exploits and viruses: hack a random website, host the data you want to distribute, and make many people go there. Or use the server as update server for a virus that has already spread. This makes it much harder to trace back who wrote the virus.

What I would do is:

  1. Replace the exe with something that displays an alert to the user, telling them they have a virus and should ask someone to remove it (e.g. bring it to a repair shop). Perhaps also contact an antivirus company for further directions on how to make users aware.
  2. Inform my host about this, demand to move me to another server and tell me how this could happen. If they refuse to tell what happened, move to another provider. Or perhaps move to another provider regardless.
  • Thank you for the feedback, i already thought about 1) i know that for instance the target platform is windows cause of the extension so it might not be a bad idea.. but that would make my bandwidth suffer (Maximum on srv is 50 gb / month)... 2 seems like the most real outcome though... although could do both... – Cisum Inas Aug 2 '12 at 20:54
  • 1
    The executable doesn't have to be large. It think with a few lines C# and no special compile options, the executable will be <200KB. You could cover 262000 requests and perhaps help hundreds of people with this. Simply take down the file when you are nearing the limit. – Luc Aug 2 '12 at 21:07
  • You are right! I am gonna make a exe really simple with a warning text and links to Avast, Avg, and Eset... But before i put it up there... can it backfire on me, should i keep something in mind? – Cisum Inas Aug 2 '12 at 21:33
  • Users may think you are the hacker, but since you aren't they can't do anything legally against you. Just make sure not to reveal your home address or full name, just in case. I don't have much experience with this. Good to hear you're going to try this! I'm interested if you have a result of some sort :) – Luc Aug 2 '12 at 22:01
  • 1
    It's up on the server... hopefully it will help someone... – Cisum Inas Aug 2 '12 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.