A friend told me one of their company servers got recently hacked. The server was super secured software side.

It turned out the attacker called the hoster and used some social engineering skills to reset the root password (with a live cd or custom image??) (or whatever happend, it is not exactly clear.). The company got a few days later a bill of the phone call for the technical support.

The server contained a database with usernames and balance. So, one with access to the server could theoretically increase or add balance to his account and cash it out.

As far as I know the server was rebooted several times.

Question: Is there a way to harden or fully prevent such a scenario? I have sensitive data as well on my server and I plan to use VeraCrypt to store my database. The mounted device would shutdown when the server is rebooted.

  • 1
    You want a technical solution such that if the root user was malicious, that the database could not be accessed? Root is kind of god on a server... – schroeder May 2 '18 at 19:47
  • 2
    Find another hosting company with better security policy. There's no way to prevent anyone with root access from changing anything it wants. – ThoriumBR May 2 '18 at 19:50
  • If the server was not rebooted, then root would have access. – schroeder May 2 '18 at 19:50
  • I understand that root access can do anything, but the hoster did not know the password nor the attacker. They have either reset it, or worked another way out to access the server. The hoster has a good reputation in Germany. According to the logs the server has been rebooted multiple times. So the answer is to find a new hoster and nothing can be done to harden such a scenario (?) – user3606329 May 2 '18 at 19:55
  • 1
    Then their processes are wrong! No unauthorised person should get access. The fault is squarely on the hoster to allowing this. – schroeder May 2 '18 at 20:05

TL;DR: Not practical

You can use encryption. If root password is reset, the data would still not be possible to decrypt. So assuming your hosting company had to restart the server to reset the password, this would work. However, if you use encryption, you would have to enter the password somehow after each reboot. So not practical. And if you save the password, your hosting company would be able to easily see it.

  • Thanks for your answer! I believe we have an uptime of minimum 1 year average. It wouldn't bother too much ;). I will go with this way probably. Social Engineering is quite hard to prevent, even if the hoster does verification on the technical hotline. – user3606329 May 2 '18 at 20:28
  • @user3606329 In that case, you should consider what kind of encryption you will use. There are quite significant differences between FDE and home directory encryption in your case. – Peter Harmann May 2 '18 at 20:43
  • @ Peter Harmann: Do you think FDE would be better here? The hoster could not install any software/custom kernel image then? If the attacker would install a keylogger throug the support - the home directory password could be logged. I don't think there is a way to reset the root password without turning of the machine. So this should give some security overall. – user3606329 May 2 '18 at 20:50
  • 1
    @user3606329 I would personally go with FDE if possible. While FDE has its own disadvantages, I feel those are not relevant for social engineering. Your host would have to be actively hostile to use them. So if you have remote management, that supports you entering FDE password remotely, IMO you should use FDE. Just for completeness, using both is also an option, though probably unnecessary. – Peter Harmann May 2 '18 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.