Ever wonder what sort of traces a hacker leaves behind when they are probing for vulnerabilities on your website? I though it would be entertaining to give you some details of a very recent probe of another website that I manage.
The website is an in-house system for a customer of mine that has it open to the Internet so they can access their web-based CRM software from outside the office. They're running a Triad-style (aka WAMP) setup of Apache, PHP and MySQL on a Windows server.
It looks to me like the hacker was running a script of some sort that was looking for known vulnerabilities in several web-based applications like Joomla, LiveAlbum, Focus, phpSiteBackup, PhpRealty, NuclearBB, and Smarty Cart. This would make the hacker either (a) lazy, or (b) a Script Kiddy who doesn't actually know what he's doing beyond running tools other folks have written and released on the Internet.
The raw logfile snippet is attached here for your education and amusement:
It looks to me like the tool that our Script Kiddie is using is trying to launch/inject an offsite tool from a server in an elementary school in Michigan (75.133.78.195 which resolves to tank.suttonsbay.k12.mi.us). The source of our attack (207.126.55.250) is a server managed by a hosting company - probably hacked into without their knowledge although it's possible an employee of theirs is up to unauthorized personal use of the Internet given the attack was around 2:00 in the afternoon Central time.
I used WhoIs at http://network-tools.com to determine who owned the computers with the IP addresses shown and notified them by email that their computers were involved in an attack on the server that I manage.
My system was in no way compromised by this attack and I could've easily ignored it and moved on with my day, but I strongly believe in being a good Net Citizen so I contacted the folks involved. I've done this before and know for a fact that it has resulted in action at the other end - at least one resulted in a dialup subscriber (the offender) losing their account with their ISP.
In a nutshell: 1. PAY ATTENTION to the computers you're responsible for. If you don't review logs once in a while you're leaving yourself vulnerable. 2. GET INVOLVED and don't be afraid to take the time to drop someone an email or call them to let them know something is wrong on their side. It's not a waste of time.
Posted by jps on Wednesday 16 January 2008 - 16:00:41
