its neither a local hacker nor a locally hosted server... not sure how they would go about catching the guy... I know its next to impossible in south africa - ie it takes several months to get a subpoena and trace someone who is probably long gone by then..
-
Join the MyBroadband community
South Africa’s biggest forum. Discuss, discover, and connect with thousands of members.
-
Question of the Day: Which legendary musicians or bands have you seen live?
WebAfrica Hacked
- Thread starter James
- Start date
magneto
Senior Member
Swazi said:
swazi they want get him/her anyway. they prob del the logs. thats what i would do.plus used hosts from there botnet. must b a retard to hack striaght from your own ip.
I feel for WebAfrica with regard to this, because all you need is one client to set his ftp password to "password" and some hacker to guess it.
or you have a client that has a very badly written asp upload page, and the hacker just uploads a dll to the server.
See, to my knowledge, IIS and windows doesn't really have the ability to run in a "JAIL" so call it like linux/unix.
and some folders need the ASPNET user or the IUSR to have modify or write permissions on certain folders, nothing stops a hacker from uploading a precompiled .dll and running it to replace all index.asp* pages with his page, and get it to search through the system. (in linux, this is a bit more difficult if the user accounts are setup properly)
It's a shared solution, and a server got hacked, it happens, it happens to almost every hosting company around, it's the nature of the business.
It's like being a shop owner, and getting robbed, or held up, it's the nature of the business. you get over it and you move on.
or you have a client that has a very badly written asp upload page, and the hacker just uploads a dll to the server.
See, to my knowledge, IIS and windows doesn't really have the ability to run in a "JAIL" so call it like linux/unix.
and some folders need the ASPNET user or the IUSR to have modify or write permissions on certain folders, nothing stops a hacker from uploading a precompiled .dll and running it to replace all index.asp* pages with his page, and get it to search through the system. (in linux, this is a bit more difficult if the user accounts are setup properly)
It's a shared solution, and a server got hacked, it happens, it happens to almost every hosting company around, it's the nature of the business.
It's like being a shop owner, and getting robbed, or held up, it's the nature of the business. you get over it and you move on.
There is something which does amaze me with WebAfrica, their website itself is hosted on ns10.pcnets.co.za, which is hosted with Hetzner...
I also notice that WebAfrica's NS servers, are on a shared NS service with Hetzner.
It appears as though WebAfrica is reselling for Hetzner?
odd...
I also notice that WebAfrica's NS servers, are on a shared NS service with Hetzner.
It appears as though WebAfrica is reselling for Hetzner?
odd...
Dave said:
Nah its an old reverse IP record - NFI who ns10.pcnets is. We do share UUnet bandwidth and IP's with hetzner and should probably get it changed though.
Dave said:
Well yes and no, we actually tightened things up quite a bit. All users have
their own windows user that IIS user runs under. (ie equivalent to a linux "jail")
So ASP, PHP, plain html etc is not a problem. The problem comes in with ASP.NET where the NETWORK_SERVICE needs access. The way to get around that is to run every ASP.NET site in its own application pool each with its own identity. This however greatly increases the amount of RAM utilisation on the server.
Still as you say dedicated offers more security than a shared environment.
A lot of sites in SA are been defaced:
http://www.zone-h.org/en/defacements/filter/filter_domain=saix.net/
http://www.zone-h.org/en/defacements/filter/filter_domain=mybroadband.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=antitrust.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=mweb.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=is.co.za/
It also looked like a large amount of the systems hacked were linux
http://www.zone-h.org/en/defacements/filter/filter_domain=saix.net/
http://www.zone-h.org/en/defacements/filter/filter_domain=mybroadband.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=antitrust.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=mweb.co.za/
http://www.zone-h.org/en/defacements/filter/filter_domain=is.co.za/
It also looked like a large amount of the systems hacked were linux
Any site is hackable (I prefer using the term 'expoitable' as strictly speaking its not hacking) if a noob installs a script or program prone to attack. Linux itself, properly buttoned down, is pretty much impermeable, but there will always be someone installing a flaky piece of code somewhere along the line, and there will always be a pale-faced little ****head behind his PC somewhere running scanners to pick it up for lack of having a life outside of his bedroom..w1z4rd said:
What a lot of the public don't realize is how hard it is to balance security with usability.
For example:
Its very easy to make a Linux server extremely secure, remove ftp access to the server, disallow external mysql connections, jail apache, then use something like mod_suphp to control the apache processes and user permissions on each uses files & folders, jail each user to their own directory, turn on PHP safe mode, use hardenedphp and keep the registered global off. When people want stuff uploaded to their site, they must submit it to the hosting company, the hosting company will then get PHP/asp developers to overlook each bit of code, before uploading it to your website and allowing u to run it.
This above would probably ensure that the server and your site is about 95% secure. But you will have little to no usability, considering that most PHP applications wont run with the registered globals off, not even phpmyadmin runs with hardenedphp (because of the POST limits), and you will have no physical access to the server at all. Mod_Suphp is nice, but because it breaks things down into millions of different processes, and uses the PHP in cgi mode, forums such as this or invision board cause the system load to go through the roof, it also slows things down a hell of a lot. Also because the hosting would now need to get involved with every little website change and stuff, the cost of hosting would go up in order to cover the additional staff it would take to admin all of this.
OR
The hosting companies can give you FTP access, make the PHP as globally compatible as possible, make software and such on the server run as optimized as possible, and do what they can in the way of server security without compromising the above, and leave the general site security stuff up to the user. This would give the user the most usability, and also allow the hosting company to provide the service at a cheaper price.
Which would you prefer?
option A where everything is secure, you pay a lot more for hosting and you have to wait to have things done or changed on your site?
or option B, where you have control of your site, and if something should happen, you don't sit and bitch about it, because these things happen.
If a person is SOOO security mad about their site, why not fork out R2000 or whatever a month and get yourself a dedicated server? What gets me are people who pay like R20 a month, and expect the world from their hosting company, they expect their hosting company to optimize the security and usability of the server around their R20 website. On top of this, they also expect 24/7 fanatical support. To those people I always ask "if I had to give you R20 p/m, would you optimize a server for me, and give me 24/7 fanatical support?"
</vent>
For example:
Its very easy to make a Linux server extremely secure, remove ftp access to the server, disallow external mysql connections, jail apache, then use something like mod_suphp to control the apache processes and user permissions on each uses files & folders, jail each user to their own directory, turn on PHP safe mode, use hardenedphp and keep the registered global off. When people want stuff uploaded to their site, they must submit it to the hosting company, the hosting company will then get PHP/asp developers to overlook each bit of code, before uploading it to your website and allowing u to run it.
This above would probably ensure that the server and your site is about 95% secure. But you will have little to no usability, considering that most PHP applications wont run with the registered globals off, not even phpmyadmin runs with hardenedphp (because of the POST limits), and you will have no physical access to the server at all. Mod_Suphp is nice, but because it breaks things down into millions of different processes, and uses the PHP in cgi mode, forums such as this or invision board cause the system load to go through the roof, it also slows things down a hell of a lot. Also because the hosting would now need to get involved with every little website change and stuff, the cost of hosting would go up in order to cover the additional staff it would take to admin all of this.
OR
The hosting companies can give you FTP access, make the PHP as globally compatible as possible, make software and such on the server run as optimized as possible, and do what they can in the way of server security without compromising the above, and leave the general site security stuff up to the user. This would give the user the most usability, and also allow the hosting company to provide the service at a cheaper price.
Which would you prefer?
option A where everything is secure, you pay a lot more for hosting and you have to wait to have things done or changed on your site?
or option B, where you have control of your site, and if something should happen, you don't sit and bitch about it, because these things happen.
If a person is SOOO security mad about their site, why not fork out R2000 or whatever a month and get yourself a dedicated server? What gets me are people who pay like R20 a month, and expect the world from their hosting company, they expect their hosting company to optimize the security and usability of the server around their R20 website. On top of this, they also expect 24/7 fanatical support. To those people I always ask "if I had to give you R20 p/m, would you optimize a server for me, and give me 24/7 fanatical support?"
</vent>
killadoob
Honorary Master
is not that we have easy to hack servers we just hear about it when it happens
i mean who here check america for hacked sites?
i mean who here check america for hacked sites?