1

I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game.

It's in such a state that it has tons of custom code on it that run the server and hasn't really been maintained.

We recently noticed that someone had taken control of and turned the box into a malware/spam box.

The box has internet facing RDP (yes I know...) and FTP.

What steps, if any, can I take to more secure this box and try to make it even a little bit harder to compromise?

Thanks.

  • Since you are asking what steps you can take to further secure this server, it may help if you provide the steps you have already taken. – YLearn Apr 10 at 3:05
  • We deleted all new users that were created, shut down newly observed services and deleted newly observed executable, did some malware scanning and removed what was found, reset all user account passwords on the box. Today I plan on changing the RDP default port and I'm trying to figure out if I can tie MFA to the RDP login process. – JaReg Apr 10 at 13:30
1

While it is a bad idea to still keep the server running such old and unsupported systems are actually often found in industrial environments where they are used to run some software only supported on such older OS or which is tied to specific hardware.

The way to limit the risk in such cases is to minimize the attack surface as much as possible. This means removing or at least disabling any software and services which are not actually needed, harden any passwords in use on the system and put a firewall in front of it. The firewall should restrict access to only the applications which need to be actually accessible from outside and only for specific IP addresses. The firewall should also limit what traffic can leave the system so that a successful attacker will at least not be able to infect other systems from the compromised one. Of course you should not rely on the builtin-in firewall for this since the attacker might change this.

This way you at least reduced the risk of the system getting compromised and that it can be used to attack other systems after a successful compromise. Once this is done you should also look for a long term strategy to deal with the system, since what you did for now was only to limit the impact of the worst problems. Long term strategy might involve to declare the service you offer as officially obsolete so you can switch off the system after a while. Or you might rebuild everything in a more secure way on a supported platform and migrate customers to the new system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.