I am facing an issue where hackers are seeking to compromise two of my servers. They succeeded in wiping out both and stealing my backups. I had off-site backups and I am back online. Nonetheless, I want to close the back doors into my system. What should I do to make sure this never happens again?

The off-site backup was restored from a point were they already had access.

An earlier backup is not an option.

closed as not a real question by Gilles, AviD May 9 '13 at 9:25

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7
    The level of detail in your question is akin to “My car broke down. I took the bus home, now how do I fix my car and ensure it doesn't break again?” So yes, you need to close the backdoor(s), and that's all we can say with so little information. If you have no idea what to do, bring your car to a mechanic, I mean hire a security consultant. – Gilles May 9 '13 at 8:51
  • 2
    Hi Jenny, welcome to Information Security. As @Gilles mentioned, your question does not have nearly enough information to even begin discussing it. Another apt metaphor would be calling a doctor: "I am not well. What medicine should I take?" (Metaphors are fun.) Please see the FAQ and How to Ask - then you can edit your question (or ask a new one) with more details about your servers, system, technology, frameworks, languages, functionality, vulnerabilities, constraints, process, etc etc etc etc. – AviD May 9 '13 at 9:28

I want to close the back doors into my system.

I believe that is your answer. You need to perform some incident response and find out what the cause of your breach was and close the holes that you have found.

Security is a mulch-layered approach, you will want some software like firewalls, antivirus, intrusion detection, etc. at the system level and likely at the network level. You may want to proxy connections to your server as well at both the network and the application layer. For example, on a web server you may want to include a web application firewall.

One of the most likely causes if you are using off the shelf software is that your software is out of date and needs to be patched, software should be updated regularly. In addition, you also need to ensure you configure all optional settings in the appropriate and most secure manner, which will vary by application. You can google for guides, or you may consider asking a more specific question to the community about how to best secure a specific application.

If you are writing your own software, you need to ensure that you follow secure coding practices. You must ensure there is input validation, proper application of protocols/algorithms, and that you are using updated/secured versions of third party libraries. If you are doing web apps, check out OWASP.

In terms of the incident response, you need to look for evidence of how they got on to your system and what they did. It's possible they were only able to get to certain files or compromise certain applications, however, from your original questions its not quite sure what happened or what they actually did.

Evidence can be found by comparing files with known values (file integrity monitoring) and by reviewing access logs (assuming they were no also compromised). You should search through some existing questions here on this site on incident response that may help you on the right path.

Restoring from a backup will get you back online, but it will not solve your problem, the backup likely holds the same vulnerabilities.

  • 2
    As Eric G said, you can't close the back doors in your system until you find them. As you've rebuilt from a backup malware is likelyl stil on the system. It's worth doing at least the following: rebuild the system OS and harden it. Find a production copy of your application which you know is clean (mature dev version perhaps?). Deploy that onto production system. You can check for dodgy file uploads (shell scripts etc) in your web app by running a diff against a known clean version also. Identify the root issues and learn for next time. Sorry this happened to you... – AndyMac May 9 '13 at 5:35

Not the answer you're looking for? Browse other questions tagged or ask your own question.