4

Last night my website got hacked and attacker edited the main index.php.

I was wondering even he edited that file, the last modified date did not change. so I just worry if he would put the backdoor codes in other files. It is difficult for me to know the last edited files.

  1. Is there a way I can know last edited files?

  2. How can I scan those files at online?

Because the web sever is huge, I don't want to download those all files and scan it at my PC.

|improve this question
  • 5
    File dates are a really poor indicator. The best way is to do a system wide diff against the files in a known good backup and see from that what php code has been changed. Note that this doesn't even begin to address any CMS code stuck into the database. – Fiasco Labs May 15 '13 at 6:39
11

Unless you have an expert in computer forensics it's gonna be very difficult to know what happened, what files were modified, and what kinds of backdoors were installed.

Since your web server is "huge" I assume you're following a good backup policy, right? Right? Once you have a breach, assume the server is compromised and restore to the most recent good backup.

|improve this answer
  • I schedule the backup system once in a week and also now I got some help from my web hosting service. it will be fine. but I thought there would be a technical solution to know last modified files. – ronaldtgi May 15 '13 at 8:10
  • 1
    Identifying the changes made would help identify the backdoors added to the system - but it has no impact on the vulnerability the hacker exploited to deploy the additional code. – symcbean May 15 '13 at 9:16
7

enter image description here

It is the ONLY way to be sure.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.