7 ms·
> You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can
by porker 13y ago
> You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can therefore assume they had root if they wanted it and that any attempts to detect whether they did are useless because their rootkit makes the box lie to you about its current state.
Is privilege escalation that easy/common? Thinking esp of the number of shared hosting providers out there, if a user account is compromised they don't assume the entire server is compromised.
Now ok, www-data isn't any old user account, but the same principle applies?
- eli 13y agoIn theory you might be right, but in practice patio11 definitely is. Either way, the big hassle is going to be reinstalling your site, pulling a copy of the database from backup (you have that right?). Might as well go all the way and install everything fresh.
- dennisgorelik 13y agoWhy reinstall database from old backup? Can trojan be hiding in the database?
- eli 13y agoYes, definitely! Drupal (like Wordpress and others) stores all the "content" of your site in a database so there could be all manner of nastiness hidden in your pages. And then, obviously, the attacker could have added an admin user account or, less obviously, altered settings stored in the database to make the site insecure. My advice would be to restore completely from backup, if possible.
- dennisgorelik 13y agoThe price of restoring from old backup could be steep: some data loss. Or at least time consuming manual data merge with data from more recent, but compromised database. It might be easier to check database for common vulnerabilities (admin accounts, suspicious content for web pages).
- eli 13y agoIf you must go down that road, I'd suggest pulling the content off the compromised site and copying it manually and very carefully to the recovered site. You can never really be sure you got rid of everything otherwise.
- tluyben2 13y agoIt depends what you are running: if I have exec then I can drop to root on a lot of systems. But with these kind of scripts its usually an automated process which infects the system and that usually means nothing else was done besides infect all www files. But most likely they could have rooted and thus you need to reinstall.
- dc2447 13y ago> Is privilege escalation that easy/common? Thinking esp of the number of shared hosting providers out there, if a user account is compromised they don't assume the entire server is compromised. Privilege escalation is easier than getting the initial shell. I would certainly reinstall any machine where someone has a shell. As for these web shells, this agin demonstrates the important of blocking outbound connections with a firewall or some type of networking design.
- peterwwillis 13y agoShared hosting providers stay in business with the principle that somehow they provide a relatively secure platform for their users, so a few of them do harden their systems enough to prevent most priv escalation. But one buffer overflow and a lack of mandatory access control later and you've got gold. Priv escalation exploits have been so common in Linux in the past decade that I would consider local access the same as root access [without MAC like grsec or selinux enabled].
- anonymousDan 13y agoOut of interest, have you any opinion on selinux vs grsec vs apparmor, in terms of which is better in certain scenarios and/or overall?
- peterwwillis 13y agoWell apparmor is like the baby cousin to selinux, or the big brother to the traditional unix DAC. Selinux is more robust but also more complex. Grsec is an attempt at both a MAC and various exploit-prevention techniques. In that sense, grsec will be more effective at preventing "traditional" exploit techniques. But modern software development is so bad, even after using high-level languages and abstractions, much of the webapp and backend development is rife with security holes. You don't need to use things like buffer overflows anymore to simply extract data or take over accounts. Servers are so easily accessible and botnets are so widespread that owning a server isn't really the point anymore; once you have all their data, who needs root?
- anonymousDan 13y agoYa, I guess I'm thinking of it more from a hosting/cloud perspective, in that even though one user/tenant's site has been hacked, it would be nice not to have to wipe the machine for all other users.
- deleted 13y ago[deleted]
- 13y ago
- poopsintub 13y agoIt is on GoDaddy servers. In my experience, there was a back-door from other 'unsecured' sites.
- tptacek 13y agoYes, privilege escalation is common. If someone gets code execution on your server, assume they got everything.
- midas007 13y agoTL;DR: If owned, start from a fresh base system. I think you meant "someone gets privileged code execution," which is a sensible assumption. Even still, app-permission (less than privileged) code execution can still do damage like host malware, IRC dumpsites/bot control, diodes, tor relays, vandalize web properties, etc. The only way to know that a system is no longer owned for certain is to reimage it to a known good state. Doing anything less is tons of work, and unlikely to catch everything (rootkits, backdoors, hidden services, replaced system files, etc.). Even when running HIDS, HIDS cant be trusted because rootkits can hide things from it because it's running from the system with a possibly infected kernel. So, it turns out reimaging is less work and more trustworthy if the box is rebuilt and the 'sploit can be mitigated before bringing it online to the outside world (build and patch offline to avoid getting re-owned).
- wglb 13y agoI think he said it precisely as he meant it.
- _asciiker_ 13y agoWhile I agree in principle that when owned one should start from scratch, my advice would be to learn something. Often I am asked to analyse attacks and I now have a collection of about 15 malware scripts that not only show me the intent but they are also useful (and remarkably well coded) for my daily admin tasks. So, fresh start but at least get something out of it!
- midas007 13y ago"and the 'sploit can be mitigated before bringing it online to the outside world" You should read more carefully. Also, keeping people waiting without an ETA for a down service because you're learning isn't going to result in happy customers. Furthermore, whomever is running these boxes needs to deploy NIDS and HIDS and properly secure their boxes, because clearly they don't understand what an attack surface is.
- patio11 13y agoThis is partly because shared hosting providers act like Internet slumlords. Their unwillingness to spend sufficiently to secure their hardware and users' data is not sufficient evidence to conclude that they are secure. (Honestly, at $4 or whatever a month, I sort of understand.)