Click here to get back home

Hacker
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Hacker John Parker 10-11-2007
|--> Re: Hacker Mathieu CHATEAU10-11-2007
|--> Re: Hacker jwgoerlich10-11-2007
---> Re: Hacker Bernard Cheah [...10-11-2007
| |--> Re: Hacker Mathieu CHATEAU10-12-2007
| `--> Re: Hacker Bernard Cheah [...10-12-2007
| ---> Re: Hacker Bernard Cheah [...10-14-2007
| |--> Re: Hacker Mathieu CHATEAU10-14-2007
`--> Re: Hacker Bernard Cheah [...10-16-2007
Posted by John Parker on October 11, 2007, 3:34 pm
Please log in for more thread options
 I need some advice regarding a 2003 web server.

We have been hacked by something called turkishhacker.mdx which installs new
index.html, index.asp, index.php and default. range of same in the root
directory letting the world know on the affected website it has been hacked.

This is the second time in 6 months this has happened and after the first
time I made quite a few changes.

- All security updates are in place
- There is no write permissions set on root
- All site are isolated with unique user permissions
- FrontPage permissions in use

I am puzzled how this can be happeneing where there is no write permission
in place. It does not affect all sites but about 60% and they are not
always the same as last time.

Can anyone give me some advice?

Thanks
John Parker



Posted by Mathieu CHATEAU on October 11, 2007, 4:05 pm
Please log in for more thread options
 Hello,

is this server reachable through Remote Desktop or VNC ?
Did you change the admin password ?
Check that he didn't create another admin account.
Run antivirus/antipsyware (spybot for example) on the server.
Is the guest account still desactivated ?

Run MBSA against the server:
http://www.microsoft.com/downloads/details.aspx?FamilyId=4B4ABA06-B5F9-4DAD-BE9D-7B51EC2E5AC9&displaylang=en

Disable windows service like server, remote registry.

If you want to, i can run a test from home to make a checkup (mail me in
private)

In doubt, you may just reinstall it from scratch.


--
Cordialement,
Mathieu CHATEAU
English blog: http://lordoftheping.blogspot.com
French blog: http://www.lotp.fr


>I need some advice regarding a 2003 web server.
>
> We have been hacked by something called turkishhacker.mdx which installs
> new index.html, index.asp, index.php and default. range of same in the
> root directory letting the world know on the affected website it has been
> hacked.
>
> This is the second time in 6 months this has happened and after the first
> time I made quite a few changes.
>
> - All security updates are in place
> - There is no write permissions set on root
> - All site are isolated with unique user permissions
> - FrontPage permissions in use
>
> I am puzzled how this can be happeneing where there is no write permission
> in place. It does not affect all sites but about 60% and they are not
> always the same as last time.
>
> Can anyone give me some advice?
>
> Thanks
> John Parker
>
>


Posted by jwgoerlich on October 11, 2007, 4:07 pm
Please log in for more thread options
Hello,

Did you reload after the first attack? My advice would be to rebuild
the computer from the ground up and follow this guide:

Securing IIS6: From the OS, Up
http://www.sans.org/reading_room/whitepapers/windows/1238.php?portal=9edc084644564927aeaf433fc5ff0ab1

Regards,

J Wolfgang Goerlich

> I need some advice regarding a 2003 web server.
>
> We have been hacked by something called turkishhacker.mdx which installs new
> index.html, index.asp, index.php and default. range of same in the root
> directory letting the world know on the affected website it has been hacked.
>
> This is the second time in 6 months this has happened and after the first
> time I made quite a few changes.
>
> - All security updates are in place
> - There is no write permissions set on root
> - All site are isolated with unique user permissions
> - FrontPage permissions in use
>
> I am puzzled how this can be happeneing where there is no write permission
> in place. It does not affect all sites but about 60% and they are not
> always the same as last time.
>
> Can anyone give me some advice?
>
> Thanks
> John Parker



Posted by Leythos on October 11, 2007, 4:43 pm
Please log in for more thread options
newsgroup@rightfast.com says...
> I need some advice regarding a 2003 web server.
>
> We have been hacked by something called turkishhacker.mdx which installs new
> index.html, index.asp, index.php and default. range of same in the root
> directory letting the world know on the affected website it has been hacked.
>
> This is the second time in 6 months this has happened and after the first
> time I made quite a few changes.
>
> - All security updates are in place
> - There is no write permissions set on root
> - All site are isolated with unique user permissions
> - FrontPage permissions in use
>
> I am puzzled how this can be happeneing where there is no write permission
> in place. It does not affect all sites but about 60% and they are not
> always the same as last time.
>
> Can anyone give me some advice?

Do you check the logs to see who is connecting?

Do you follow ALL of the permissions on how to secure a web server?

Did you setup strong passwords and change account names?

Are you using MS FTP? If so, switch to FileZilla FTP server.

You can't say that there is no write permission, any admin account has
write permission - it sounds like you've got bad passwords or that they
were cracked.

What security do you have in place?

Firewall appliance?

AV Software?

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Posted by Bernard Cheah [MVP] on October 11, 2007, 10:14 pm
Please log in for more thread options
> Are you using MS FTP? If so, switch to FileZilla FTP server.

I'm just curious about this... how would this helps? and MS FTP is
vulnerable ?

--
Regards,
Bernard Cheah
http://www.iis.net/
http://msmvps.com/blogs/bernard/


> newsgroup@rightfast.com says...
>> I need some advice regarding a 2003 web server.
>>
>> We have been hacked by something called turkishhacker.mdx which installs
>> new
>> index.html, index.asp, index.php and default. range of same in the root
>> directory letting the world know on the affected website it has been
>> hacked.
>>
>> This is the second time in 6 months this has happened and after the first
>> time I made quite a few changes.
>>
>> - All security updates are in place
>> - There is no write permissions set on root
>> - All site are isolated with unique user permissions
>> - FrontPage permissions in use
>>
>> I am puzzled how this can be happeneing where there is no write
>> permission
>> in place. It does not affect all sites but about 60% and they are not
>> always the same as last time.
>>
>> Can anyone give me some advice?
>
> Do you check the logs to see who is connecting?
>
> Do you follow ALL of the permissions on how to secure a web server?
>
> Did you setup strong passwords and change account names?
>
> Are you using MS FTP? If so, switch to FileZilla FTP server.
>
> You can't say that there is no write permission, any admin account has
> write permission - it sounds like you've got bad passwords or that they
> were cracked.
>
> What security do you have in place?
>
> Firewall appliance?
>
> AV Software?
>
> --
>
> Leythos
> - Igitur qui desiderat pacem, praeparet bellum.
> - Calling an illegal alien an "undocumented worker" is like calling a
> drug dealer an "unlicensed pharmacist"
> spam999free@rrohio.com (remove 999 for proper email address)



Similar ThreadsPosted
hacker attempts? June 13, 2007, 10:10 am
Hacker locking my accounts March 16, 2008, 5:02 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap