My website has been hacked, what do i do next? [closed]

Question

So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.

My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in order to gain page ranks.

The attacker (based on the language of the blog (Indonesian)) is presumably overseas. Can i track them down and prosecute?

What should i do next?

I need to know:

• How to find out how they got in
• How to find where the attack came from
• How to to treat my findings
• When to involve Law Enforcemnet
• How to stop the attack from happening again

Hope you can help :)

Answer 1

This is a forum for IT security experts not legal experts in international IT law, so questions about prosecution / law enforcement are mostly off topic. Though I'd first harden your system and later think about trying to prosecute; as tracking down who was the human user at the other end is not a trivial task -- especially if it happened overseas.

Can you describe your setup? Is it on a linux server/windows server/shared host/wordpress blog?

You've given us very little information. Before figuring out how they got in, let's first see what is going on.

How is it being forwarded?

• Javascript? (E.g., disable javascript in your browser -- does it still forward?)
• HTTP META refresh tag or in an iframe? Use a utility like curl / wget to download a static copy of the html from your webpage. Is everything in a giant <iframe> or is there a tag like <META http-equiv="refresh" content="0;URL='http://random_other_site.com' />
• 3xx HTTP Redirect? Use a utility to look at the HTTP headers. E.g., in google chrome - press ctrl-shift-I to pull up developer tools, go to the "Network" tab and try visiting your page. If the http status code is 302/304 (or something else in the 300s), they've altered your server code. Can you login to your server?
• DNS pointing your domain to somewhere else? Run dig www.foo.com - does it point to your IP address? (They likely managed to change your authoritative DNS records -- go to your registrar to get back control. They probably managed to get your passwords at your registar somehow.)
• ARP poisoning on your local network? (Try visiting your site from a different network). (If this is the case; just lock down your routers.)
• Changed your content to their content on your website being served by your webserver? (Look for weak passwords; vulnerabilities where unauthorized users can upload files).

As for how they get in; depends on the type of attack. Maybe you (or any other user with access) you have a weak password (and it was guessed) or one that you've reused elsewhere, or weak password reset mechanism, or you authenticate into your server without using SSL, or you've logged in once from a machine with a keylogger, and the attacker captured your login information. Possibly your site was vulnerable to say cross-site scripting that injected malicious javascript to redirect your site. Maybe your site is configured weakly, used tools that have known 0-day vulnerabilities that allowed attackers to randomly upload files to be served and change content.

Answer 2

The attacker (based on the language of the blog (Indonesian)) is presumably overseas. Can i track them down and prosecute?

I would say not; unless you're a multi-national (who can more easily spend resources on chasing people in foreign countries) - this almost certainly won't be worth your time. But this isn't legal advice, so you need to make your own assessment here. The chances of getting any recompense is vanishingly small.

In terms of how they got in, you're going to struggle unless you've already invested in IDSs (Intrusion Detection Systems) of some nature. The golden rule here is that once compromised - you can no longer trust the machine. The attacker may have deleted logs, changed timestamps, etc. Similarly with where it came from - your ISP may be able to help (if you're sure they're Indonesian - ask for all traffic to/from Indonesia, assuming that's not a country you often do business with).

You can look through the logs on the server, specifically the HTTP access logs - the most likely attack vector for a web-facing HTTP server is going to be through insecure web software. Check your software versions for known security issues (Wordpress is pretty notorious for this), check that your passwords aren't simplistic.

The most likely scenario is that some automated worm, probably using Google, found that your site was running a bit of software with a juicy vulnerability and hit it. I'm speculating, but without any more details, that's likely where we are. If you're on a public web host, and any of your files or folders are world-writeable, it could be any of the other sites hosted on your server.

Assuming you find anything; contact your local law enforcement if you think it points somewhere, but I wouldn't hold my breath. If you're in Government or largeish Enterprise, you should have a team, agency or the like to report to - make sure you do do that.

The big thing here is that, since you can no longer trust the machine (bolded again, it's important), your best option is to start over. It's harsh, but if they have local admin, you're just going to get hammered again.

It sort of stops being a security question once you've actually been compromised - have a look at https://serverfault.com/questions/218005/how-do-i-deal-with-a-compromised-server for other advice, but it starts becoming a legal risk question for your organisation (Is it costing thousands being down? Is it worth booting a maybe-bad server?).

Build everything up again, patch everything, restore your last DB backup. When you put together the server, make sure you lay a secure baseline (Server Certification Processes) so that you can look at the logs saved on a different machine, one you can still trust.

Answer 3

You "need" to know how they got in. If you're asking this question, it sounds like you didn't prepare, so you may be disappointed with your options. Do you keep comprehensive forensic-quality logs, stored separately from the hacked machine? If not, have you perused the logs that you do have? Read shell history files? Reading logs is your best bet here, gumshoe.

You "need" to know where the attack came from. This is the internet, where machines are hacked to control botnets for proxying attacks against IRC networks that control botnets. If the attacker has any desire to remain anonymous, and you aren't big enough to have governments and communications companies helping you, all you have left is to look for clues like a gumshoe. That can work, if you have the penchant for playing detective, but there is no magic answer.

Since you're not a big company that just lost millions of customer records or units of money, how to "treat your findings" and wondering "when to involve law enforcement" might be taking things a little too seriously for reality. Do you know how many international manhunts take place in pursuit of people who redirect someone's homepage? Zero. Treat your findings like clues in your own miniature cyberwar. Take notes. Call the FBI when you've lost over $1M.

How to stop the attack from happening again? If you can figure out the attack vector, close it. If you can't, then hire a security consultant, or rebuild your system on completely different technology and pray.

Answer 4

I will give my methodology that I use to clean-up hacked sites.

You will want to find the most recently modified files from the date you noticed the hack. You can use find /dir/ -mtime to do this. -mtime -1 will provide information from the last 24 hours; check all those files for malicious code.

Once you've established a list of modified files that are malicious you'll want to stat them for modification and creation time. You will then check your transfer logs and FTP logs around that time to find the attackers IP address and way of exploitation. If you are lucky you'll see how they got in; usually, the attacker has hacked your site months previously resulting in you being unable to check logs for how/when your site was hacked.

Some of the most common tools I use to clean-up hacked sites: find,stat,grep -F.

As said previously; we're not lawyers but IT security experts. If the attacker is in a foreign country then don't waste your time. If the attacker is in your native country then still don't waste your time; reason being is they've most likely covered their tracks and are long gone. The amount of resources spent trying to find and punish the hacker could have been put to better use securing and protecting your site.