Networks

Ask something
Question Locked

I've been hacked !!!

0 helpful
10 replies

by dhegner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I found evidence of hacking on one of my servers last night. I cleaned up the directories but this morning I saw evidence of additional hacking. I did some research last night and disabled the MSPADMIN.exe service. I also set the Internet security as high as it will go and disabled all web sites in IIS. This is a Windows 2000 Small Business Server so I'm a little lost.

Can any-one give me a place to start? Is there a specific list of files or directories to search for? How are they getting in? I saw evidence this am of a directory created under the administrator directory in Documents and Directories which indicates access at the highest level.

HELP !!!!

10 replies

by sadym

you probably deserved it for your total lack of security

by hal 90000

Edited by moderator

Message was edited by: beth.blakely@...

by zimxen

What is the evidence you found? Check your server logs for any reference to the directory creation if you have auditing enabled. Check task manager for any processes that are runing you do not know about. If you find any you can search on the web to help you Identify them. I would reformat the server if that is possible.

by hal 90000

Edited by moderator

Message was edited by: beth.blakely@...

by dhegner

It was the old COM1 directory hack. I used the POSIX utilities to kill the COM1 directories and then I was able to eliminate the entire directory structure.

This is an old and feeble legacy server. Auditing is not enabled.

Last night I ran a Google search from a workstation on every process running on the server. The only process that had any dialog about hacking was MSPAdmin which I've disabled. I found additional evidence that MSPAdmin was used from the time stamps on two files that "appear" to be configuration files in the MSPAdmin program file Client directory. This client directory was shared which I didn't check for last night. I eliminated this share and cut the suspect files out of the directory. Since doing these things there is no further evidence of hacking.

With any luck this server will be out of production within 30 days. I'm replacing all the legacy servers. I'm just unfamiliar with the SBS software setup and thought that some-one might know of some unique feature or add on that would make it susceptable to hacking.

Thank you for your professional response. If you have any additional info based on this information please let me know. I will continue to monitor the server and post any information I feel can assist the group going forward.

Thanks!

by downrighttired

first i wanna say im so glad i talked my company out of SBS, poses too many unknowns for me. Anyway first off, do you have a firewall or anything logging incoming traffic? this could be a place to start. Next i would download microsoft baseline security analyzer (http://www.microsoft.com/technet/security/tools/mbsahome.mspx)
note this wont expose all security threats but runs through microsofts checklist (encouraging isnt it?)
you should also run whatever anti-virus / malware programs you have or can get ahold of (this should probably be done first actually in your case)
next find a port scanner to scan your IP and let you know what ports are open (probably alot of em if you dont have any firewall) heres a nice free one-> http://www.download.com/Scan-Port/3000-2381_4-10155408.html?tag=lst-0-1
once youve done this you can find out what programs or services typically use the ports that are open here-> http://www.grc.com/port_53.htm (thank you steve gibson!) youll find alot of other resources at grc.com too, should probably start listening to their podcast too!! Hope this gives you some places to start.....

This discussion is closed to new replies.