2008 server hacked - how to secure?

Someone setup the user name and password for a server as:

Of course this is one of the most common so was hacked
I found a app called DUBrute running on it and searching other servers

However, i'm puzzled
I created a new account under a different name, with a secure password
and set the admin account to have 0 access to things like file/remote desktop (wasn't in admin group any more)

However, someone still managed to get back in
I presume they installed a backdoor account which wasn't showing up anywhere??
1.What are the usual things to check after being hacked
2. what should i do to lock down the server?
Who is Participating?
McKnifeConnect With a Mentor Commented:
Ok, for sql servers there are security best practices.

With no more details, this is all I can give you. But to be honest, securing SQL is not my topic.

You should return the server to a trusted state. Preferrably, this is done by replaying an image backup of a date were you cannot find symptoms/folders of infection.
websssAuthor Commented:
Yes i'm restoring to an old image as we speak
I figured they could have installed their own software which i would never know about!
How should i lock down the server now?
WEBINAR: GDPR Implemented - Tips & Lessons Learned

Join the WatchGuard team on Thursday, March 29th as we recount some valuable lessons learned in weighing the needs of a business against the new regulatory environment, look ahead at the two months left before implementation, and help you understand the steps you can take today!

"locking down" is a commonly used, but totally empty term, a better term to use is "harden". The default state a cleanly installed server is in has (after being patched) no holes. The firewall is up, it cannot be reached from outside. So all you need to do is see what services you are using (those do open ports) and if those are patched (if non-windows services) and configured securely.
Nevertheless, we could also harden it by using security options and turning of unneeded options. We cannot tell you what to do because we don't know what that server is used
-and by whom
-and how
websssAuthor Commented:
i'm new to all this
Its a SQL DB server
websssAuthor Commented:
Ok thanks, i'll take a look first
MaheshConnect With a Mentor ArchitectCommented:
After server get hacked you need to think of Server locking:
It depends where your server is placed
I mean, in DMZ or regular corporate LAN ?

In case of DMZ you should block all ports opening towards server except essential \ required port to access server (The definition of essential ports is what application is installed on server and the protocol and method required to access it EX: Http / Https etc)
Also consider installing Intrusion detection systems (IDS) in DMZ to block suspicious activities

If server is part of Corporate LAN ensure that very few users will be server administrators
Rename administrator account
Disable built-in administrator account

Apart from above, common security measures are as below
Install proper AV security software and keep it updated
Install Windows Defender \ Anti Malware software and keep it updated
install latest windows patches  \ security updates on regular basis
disable unwanted services, block schedule tasks, disable SMB (TCP 445) access to server from common segments, disable direct non interrupted internet access on server, disable RDP from all segments except management workstations

websssAuthor Commented:
Its a VPS in a london datacenter with a public IP address
VPS stands for Virtual Private Server ?

Also you can block ping protocol from internet to this server..

I guess public IP is there for to directly RDP in to server for management ?

Since this is SQL database server, I don't see any reason to place public IP to this server and publish it to internet

You can use VPN to get in your data center through VPN gateway and once you get in through VPN, then just connect to server with RDP for management

Once you remove server public IP and unpublish it from internet, the attack surface will be minimized by 90%

websssAuthor Commented:
We have GPS devices reporting position updates to the server
They communicate by TCP and hit the IP directly
Not sure if there is a way around this?
I am not aware how GPS software works

But according to me Software and Database should be separate.
Applications are published to internet and Database remains at back end

So in that case GPS device need to be connected to GPS software on server and any data that needs to be stored in SQL database should be read-write out from backend servers (SQL DB Servers) and SQL servers should not be published on internet

This is my understanding, however if this is not the case, then you need to ensure that GPS application will communicate with SQL DB with static port (1433) only and from GPS devices only
If you allowed dynamic ports for accessing SQL database from internet, probably you are opening huge port range from internet.

Rich RumbleConnect With a Mentor Security SamuraiCommented:
You need the connections to the SQL server to be secured, not only with a username and password, but so that username and password can't be sniffed:
Do not use simple authentication methods, you have to have encrypted connections. It may also be possible for someone to look at your APP and find a static username+pass so make sure that username has very restricted rights in your DB/Tables, and NO rights on the host server.
What port you run on makes no difference, it will be found, you  need to acknowledge that fact and make the rest of the transaction as secure as possible.
Mike TConnect With a Mentor Leading EngineerCommented:

It's tricky. Restoring from a backup is sensible in that it will remove the malware DUbrute, but it does nothing to protect you. To go James Bond, you've come to work and found a bug and removed it, but unless you find out where they got in, they will just get in and put another bug somewhere harder to find.

You need to dig into the logs and find the entry point and secure that first. Consider all accounts to be compromised and change username and passwords. Consider adding certificates to transactions.

Audit everything - the eventlogs, the SQL logs - export backups for analysis elsewhere as the logs will continue to grow
Get Security Compliance Manager (SCM) and apply the hardening for both OS and SQL.
Patch the OS
Patch SQL
Harden the firewall as mentioned, both the hardware firewall and the OS level
Consider running app-locker which blocks unknown apps (you teach it what to trust first)
As well as AV, consider enabling Host Intrusion Protection (HIPs) - McAfee ePO has it but there's a cost and I doubt it's cheap.

There's certainly a lot of work to do. I would also tell the owners of other servers at the datacenter that they have at least been scanned, since the SQL box was used as a zombie. If they find out and you haven't told them things could get ugly.

You need to establish when it first started too.
I don't know SQL or networking enough to suggest anything for them, but you've plenty to do already - it's sounding like a team effort - a server guy, SQL SBA and a networking guy at the bare minimum.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.