.

Re : Hacked site

<<

jb007uk

Newbie
Newbie

Posts: 6

Joined: Tue May 01, 2007 11:33 am

Post Wed Jun 06, 2007 11:40 am

Re : Hacked site

Hi,

Apologies if I am in the wrong section.

My server has been compromised by anti western Turkish hackers and as a result they have hacked my websites with them putting up some sort of military site written in Turkish.  Is there anything that I can do now that they have been inside my cpanel ?

By the way I have the details of the forum where the hacker came from

Rgds - JB
<<

jimbob

Post Wed Jun 06, 2007 12:44 pm

Re: Re : Hacked site

Hi,
Do you know how the attackers gained access to your sites? Unless you plug this hole they, or some other group of mass defacers, will come back and do it all over again.

Contact your hosting company and inform them of the security breach so they can investigate. I shouldn't waste your time trying to go after the culprits, your efforts are better spent recovering your sites. Mass defacers generally go after low hanging fruit and I'd not be at all surprised if they got into your site by exploiting a bug in a well know web application (think forums).

Now might be a good time to review your disaster recovery plan! There's nothing like actually doing it to find out what you're missing.

Jim
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Wed Jun 06, 2007 2:34 pm

Re: Re : Hacked site

I'm assuming by your question about your cpanel, that you have your site with a hosting company? Is this a shared plan or do you have a dedicated server? If the latter, the logs are available for you to peruse.

I would agree with jimbob. Hunting them down is not worth your time. Just get the sites back up. Be sure to go through all of your web folders and make sure you delete everything that is not essential especially complex scripts like forums and image galleries (again good suggestion by jimbob).

Don
CISSP, MCSE, CSTA, Security+ SME
<<

jb007uk

Newbie
Newbie

Posts: 6

Joined: Tue May 01, 2007 11:33 am

Post Thu Jun 07, 2007 4:54 am

Re: Re : Hacked site

Thanks guys for your advice.  Just for the record, I am on shared hosting and I have cpanel.  Is it harder for these lowlife to break a dedicated server ? I suspect that this particular event has arise because I have linked the server to schools.us and on reading a posting from a Turkish hacker on another forum  whereby he states that they do not hack Muslim owned sites only foreign site. As my site schoolsout.us is not even up on the internet I assume this cockroach is targeting domains with a .us with some software of some sort which is very worrying for U.S. citizens.  Most of the sites are corrupted similar to www.mariotalk.com/www.007fan.com/www.nogoinghome.com

Thanks again - JB     
<<

jimbob

Post Thu Jun 07, 2007 6:13 am

Re: Re : Hacked site

I wouldn't credit this miscreant with political motivation or ethics. Like most defacers it's 99% ego, akin to 'tagging' in urban graffiti. The thin veneer of hactivism over the top doesn't disguise the fact that they perform untargeted attacks again any site they can. Ever see an apology from them for accidentally defacing a Muslim-owned site? I don't think so. Ethics and politics are not their motivation.

IMHO you have not been targeted for any other reason than your site exists.

Jim

Return to Forensics

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software