1

They have hacked my VPS and changed the root password. Fortunately my provider has reset it for me and now I have control again.

Now I would like to make sure they didn't installed any stuff or service (e.g., for exploiting it for some illegal download/upload etc) that I'm not aware of.

Is there any tool or practice to make sure my server is clean? I would like to avoid reinstalling it from scratch.

3
  • 10
    If your server was hacked, anything and everything is suspect. Reinstall it from scratch. Don't even bother trying anything else.
    – Chris Down
    May 30, 2014 at 16:54
  • 1
    What @ChrisDown said. And find out how they broke into your server. What service was used? Have all security updates been installed? Was it a web service? If you don't care about that and you install the same software, your new installation might be hacked too in no time.
    – Dubu
    May 30, 2014 at 17:01
  • well to be honest I did not install security updates for a long time so it could be anything... I'll enable automatic updates!
    – lviggiani
    May 30, 2014 at 17:04

1 Answer 1

Reset to default
7

No, and it's really not as simple as reinstalling either.

By all means spend some time working out what the entry point was, but this install is dangerous junk now. You have to consider the possibilities:

  • Stolen data: Do they have passwords to available services now (eg webapps)? You're probably going to need to reset a whole ton of passwords and (importantly) notify people if you hold their personal data and/or login credentials.

  • Access to files: Reinstalling and copying over files isn't enough. You need to make sure that your files are your files. A very common hack is to inject code into web files (to advertise for the hacker and infect visitors for botnets). You simply can't trust data from the server. That's why we use version control that we don't let the production server write to, isn't it?

  • What else happened? Added users, changed groups, added services, tainted services (like "Operation Windigo" uses)... You just don't know what has happened to this server. You can forensically pick it apart but this may leave it open to further attack and it will take you weeks.

In short, you need to build a new server, you need to restore safe copies of your files and any database data needs to be inspected and checked to make sure they haven't dropped themselves in extra access routes. Oh and you need to notify users and people you hold data on.

Having read your comments on the question and your experience to date, it might well be worth hiring somebody with experience to setup and look after the next evolution of the server. This is all stuff you can learn but it's also stuff you need to maintain too.

A fire-and-forget approach to servers is extremely dangerous.

1
  • To add to this, you should really look at where the attack came from. 9/10 times the hacker is stupid and will try the same port twice. The 1/10 will look for open port with a flawed design and take a hold of it. Prevention matters.
    – Virusboy
    May 30, 2014 at 18:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .