2008 server hacked - how to secure?

Posted on 2014-04-07
Medium Priority
Last Modified: 2014-05-05
Someone setup the user name and password for a server as:

Of course this is one of the most common so was hacked
I found a app called DUBrute running on it and searching other servers

However, i'm puzzled
I created a new account under a different name, with a secure password
and set the admin account to have 0 access to things like file/remote desktop (wasn't in admin group any more)

However, someone still managed to get back in
I presume they installed a backdoor account which wasn't showing up anywhere??
1.What are the usual things to check after being hacked
2. what should i do to lock down the server?
Question by:websss
  • 5
  • 3
  • 3
  • +2
LVL 57

Expert Comment

ID: 39982595

You should return the server to a trusted state. Preferrably, this is done by replaying an image backup of a date were you cannot find symptoms/folders of infection.

Author Comment

ID: 39982599
Yes i'm restoring to an old image as we speak
I figured they could have installed their own software which i would never know about!
How should i lock down the server now?
LVL 57

Expert Comment

ID: 39982616
"locking down" is a commonly used, but totally empty term, a better term to use is "harden". The default state a cleanly installed server is in has (after being patched) no holes. The firewall is up, it cannot be reached from outside. So all you need to do is see what services you are using (those do open ports) and if those are patched (if non-windows services) and configured securely.
Nevertheless, we could also harden it by using security options and turning of unneeded options. We cannot tell you what to do because we don't know what that server is used
-and by whom
-and how

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.


Author Comment

ID: 39982619
i'm new to all this
Its a SQL DB server
LVL 57

Accepted Solution

McKnife earned 500 total points
ID: 39982628
Ok, for sql servers there are security best practices.

With no more details, this is all I can give you. But to be honest, securing SQL is not my topic.

Author Comment

ID: 39982629
Ok thanks, i'll take a look first
LVL 38

Assisted Solution

Mahesh earned 500 total points
ID: 39982641
After server get hacked you need to think of Server locking:
It depends where your server is placed
I mean, in DMZ or regular corporate LAN ?

In case of DMZ you should block all ports opening towards server except essential \ required port to access server (The definition of essential ports is what application is installed on server and the protocol and method required to access it EX: Http / Https etc)
Also consider installing Intrusion detection systems (IDS) in DMZ to block suspicious activities

If server is part of Corporate LAN ensure that very few users will be server administrators
Rename administrator account
Disable built-in administrator account

Apart from above, common security measures are as below
Install proper AV security software and keep it updated
Install Windows Defender \ Anti Malware software and keep it updated
install latest windows patches  \ security updates on regular basis
disable unwanted services, block schedule tasks, disable SMB (TCP 445) access to server from common segments, disable direct non interrupted internet access on server, disable RDP from all segments except management workstations


Author Comment

ID: 39982645
Its a VPS in a london datacenter with a public IP address
LVL 38

Expert Comment

ID: 39982657
VPS stands for Virtual Private Server ?

Also you can block ping protocol from internet to this server..

I guess public IP is there for to directly RDP in to server for management ?

Since this is SQL database server, I don't see any reason to place public IP to this server and publish it to internet

You can use VPN to get in your data center through VPN gateway and once you get in through VPN, then just connect to server with RDP for management

Once you remove server public IP and unpublish it from internet, the attack surface will be minimized by 90%


Author Comment

ID: 39982667
We have GPS devices reporting position updates to the server
They communicate by TCP and hit the IP directly
Not sure if there is a way around this?
LVL 38

Expert Comment

ID: 39982765
I am not aware how GPS software works

But according to me Software and Database should be separate.
Applications are published to internet and Database remains at back end

So in that case GPS device need to be connected to GPS software on server and any data that needs to be stored in SQL database should be read-write out from backend servers (SQL DB Servers) and SQL servers should not be published on internet

This is my understanding, however if this is not the case, then you need to ensure that GPS application will communicate with SQL DB with static port (1433) only and from GPS devices only
If you allowed dynamic ports for accessing SQL database from internet, probably you are opening huge port range from internet.

LVL 38

Assisted Solution

by:Rich Rumble
Rich Rumble earned 500 total points
ID: 39982980
You need the connections to the SQL server to be secured, not only with a username and password, but so that username and password can't be sniffed:
Do not use simple authentication methods, you have to have encrypted connections. It may also be possible for someone to look at your APP and find a static username+pass so make sure that username has very restricted rights in your DB/Tables, and NO rights on the host server.
What port you run on makes no difference, it will be found, you  need to acknowledge that fact and make the rest of the transaction as secure as possible.
LVL 19

Assisted Solution

by:Mike T
Mike T earned 500 total points
ID: 39989345

It's tricky. Restoring from a backup is sensible in that it will remove the malware DUbrute, but it does nothing to protect you. To go James Bond, you've come to work and found a bug and removed it, but unless you find out where they got in, they will just get in and put another bug somewhere harder to find.

You need to dig into the logs and find the entry point and secure that first. Consider all accounts to be compromised and change username and passwords. Consider adding certificates to transactions.

Audit everything - the eventlogs, the SQL logs - export backups for analysis elsewhere as the logs will continue to grow
Get Security Compliance Manager (SCM) and apply the hardening for both OS and SQL.
Patch the OS
Patch SQL
Harden the firewall as mentioned, both the hardware firewall and the OS level
Consider running app-locker which blocks unknown apps (you teach it what to trust first)
As well as AV, consider enabling Host Intrusion Protection (HIPs) - McAfee ePO has it but there's a cost and I doubt it's cheap.

There's certainly a lot of work to do. I would also tell the owners of other servers at the datacenter that they have at least been scanned, since the SQL box was used as a zombie. If they find out and you haven't told them things could get ugly.

You need to establish when it first started too.
I don't know SQL or networking enough to suggest anything for them, but you've plenty to do already - it's sounding like a team effort - a server guy, SQL SBA and a networking guy at the bare minimum.


Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An overview of cyber security, cyber crime, and personal protection against hackers. Includes a brief summary of the Equifax breach and why everyone should be aware of it. Other subjects include: how cyber security has failed to advance with technol…
It’s a season to be thankful, and we’re thankful for users like you who engage on site, solve technology problems, and network with others in the industry. What tech are we most thankful for? Keep reading.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question