Your Server Has Been Hacked… What Next?

Over a long enough time-frame, the chances of an Internet-facing server being hacked approach certainty. Online criminals trawl the net looking for vulnerable servers. If a server hosts a popular website or one with valuable private information, it may attract the focused attention of an attacker.

One of the skills a competent server administrator develops is an understanding of how to deal with a compromised server. Ideally, your server won’t ever be compromised, and there are many things you can do to reduce the chances of hackers finding a way in, but if it happens, you need to be ready.

How Are Servers Hacked?

There are four main vectors that can be exploited by criminals:

  • A vulnerability in a web-facing application or the systems that support it (e.g. the database).
  • A vulnerability in a component of the operating system.
  • A phishing attack.
  • A brute force attack.

It’s important that once you discover a server has been compromised, you try to discover how. Knowing how the attacker got in can help you reduce the risk of future compromises.

How Can You Tell If Your Server Is Compromised?

It’s in the interest of attackers to remain hidden, so you may not notice for some time, but compromised servers often exhibit unusual patterns of behavior like excessive bandwidth use, a strange pattern of network connections, or greater resource use than usual. You won’t notice these changes if you don’t monitor server performance and logs. Monitoring is a key part of server security.

Malware and rootkit scanners will help you discover if your server’s core systems have been compromised, or if an attacker has installed malware on the system.

The least desirable way to discover that your server has been compromised is for someone else to let you know. The server’s IP may be blocked by a spam blacklist, or a company like Google may get in touch to tell you they’ve removed your server from the search engine results because it’s infecting users with malware.

Next Steps

If your server is spewing malware, leaking private data, or otherwise putting users at risk, the first step is to remove it from the Internet altogether. That might mean shutting down a specific site or taking the entire server offline.

Next, backup your data 

It’s possible that the data or the applications running on your server have been maliciously modified, so you won’t restore from this backup, but a recent backup is an essential diagnostic and forensic tool — it will help you discover how your server was hacked.

You should let your hosting company’s support service know that you suspect your server has been compromised. Depending on the level of service you pay for, they may be able to help. At the very least they can use the information you give them to spot patterns of criminal activity.

Now for the hard truth, if your server has been compromised, you cannot trust any of the software it runs. Unless you are an expert system administrator with a deep knowledge of server security, you should not attempt to “clean” your server. The best course of action is to reinstall the operating and restore your software and sites from a verified malware-free backup.

If you believe the compromise is limited to a specific site or container, you might get away with reinstalling and restoring that area of your server. For example, hacked WordPress sites can often be restored without having to reinstall the whole server. But if you’re unsure, or there is an indication that the server has been infected with a rootkit, reinstallation is the only viable option.

Which brings me to the last piece of advice for this piece: make sure you regularly and comprehensively backup the data on your server. Without a comprehensive backup, you are out on a limb which stands a good chance of being sawed off.
 
Business2Community

 

« Bank of England: Cyberattacks A 'Clear and Present Danger'
Air Gapping Critical Process Control Networks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Zerto

Zerto

Zerto provides enterprise-class disaster recovery and business continuity software specifically for virtualized data centers and cloud environments.

CERT.BY

CERT.BY

The National Computer Emergency Response Team of the Republic of Belarus.

SonicWall

SonicWall

SonicWall provide products for network security, access security, email security & encryption.

Identity Automation

Identity Automation

Identity Automation is a leading provider of Identity and Access Management software.

MicroEJ

MicroEJ

MicroEJ is a software vendor of cost-driven solutions for embedded and IoT devices.

Data Terminator

Data Terminator

Data Terminator provide a comprehensive range of secure data destruction equipment and services are in compliance to US Department of Defense (DoD) and National Security Agency (NSA) standards.

SOFTwarfare

SOFTwarfare

SOFTwarfare deliver high-quality, reliable and secure enterprise application integrations through RESTful APIs for Cyber, Ops & Dev.

CIBR Warriors

CIBR Warriors

CIBR Warriors are a leading cyber security and networking staffing company that provides workforce solutions with businesses nationwide in the USA.

Intrepid Solutions and Services

Intrepid Solutions and Services

Intrepid Solutions and Services provides technology solutions and professional services to key components of the intelligence and national security communities.

Laminar

Laminar

Laminar provides the only Public Cloud Data Protection solution that provides full visibility and enforcement capabilities across your entire public cloud infrastructure.

N-able

N-able

N-Able deliver simple and sophisticated monitoring, security, and business solutions that empower you to solve your toughest IT challenges.

Protectt.ai Labs

Protectt.ai Labs

Protectt.ai Labs is India’s first mobile security start up building awareness & providing solutions for mobile app, device & transaction security.

Saiflow

Saiflow

SaiFlow provides a tailor-made cybersecurity solution for Electric Vehicles Charging Infrastructure (EVCI), Distributed Energy Resources (DERs) and energy networks and assets.

DarkFeed

DarkFeed

DarkFeed is a Threat Intelligence provider that monitors the darknet in real-time, where hackers and Cyber criminals are most active.

Harrison Clarke

Harrison Clarke

Harrison Clarke is a leading staffing and recruiting firm in the Cloud, Cybersecurity, Data & AI space.

Piiano

Piiano

Piiano offers developer-friendly privacy and security products. Reduce risk and protect your data by using our specialized security and privacy SaaS tools.