Recently, we have heard a lot of hacking attempts done on to forums. If your forum was hacked, in such a case, what you should do? What do you need to know? This article is created to help you follow the correct steps on the way to relaunch.
You should be clear about one thing, if your business forum was hacked and is attacked by another person from your forum, you are held responsible for such deeds. Hence, it is necessary to quickly initiate countermeasures before you get even into big problems.
Your Forum Website:
First thing you should do is prevent the worst. Lock down your forum website. Following are the reasons to lock your forum:
- Prevent further use by the hacker
- Prevent endangerment of third parties (For example: Trojans)
- Limit the damage to their image
There are various methods to block a project, however the most known and quick method that works best is .Htaccess file. You can simply put a .htaccess file in the root directory of your project, including the following content:
Order Deny, Allow
Deny from all
Backup:
Once you are done putting the .htaccess file, you should immediately take a complete backup of your business forum. This backup also includes a backup of the database. Under any circumstances, you must not create the backups using software that was already installed on your web space. This backup can be used later for analysis, to figure out what gives the hacker access. Furthermore you need the backup as evidence, if one takes into consideration to initiate criminal proceedings.
Set New Passwords:
Make sure you reset all the passwords including FTP, web front-end web host, database, etc… Each and every password much be changed.
Find out How the Forum has been Compromised:
The most important thing ever to figure out is what gives the hacker access. If you do not have the latest forum software installed, that’s for a good place to search. Unfortunately, that is not enough if you only use the latest forum software. Each expansion pack (Mod / Hack) may represent the vulnerability. Since the extensions are usually written to be very bad, do not automatically assume that the latest version of the extension of the security hole is fixed. One reason is that most programmers who write extensions, see this as a hobby and do not have the necessary background knowledge to write security-aware software. It is therefore always practice caution when using extensions. Pay attention to the source of your extensions and refer to the person who created the extensions.
The security hole could also be an unsafe and / or cracked password of the moderators or administrators account. Therefore, it applies to all user accounts that have special privileges to assign a new password. Also, there are some possibilities of CSRF attacks (ie. cross-site request forgery also called as One-click attack) is a kind of malicious exploit of a website whereby unauthorized commands are transmitted from a trusted user of the website.
Backup or Restore Complete Reinstall of the Software:
If a backup exists, it is enough to have the forum return to normal functionality. The only loss that is present then, is the lack of data between the last backup and the time of compromise. However, you must be aware that the security hole can still exist in the backup that has been taken.
Well, if you have no backups at hand, it looks very much out worse. In such case, the complete re-installation of the software is the only solution. Here I mean not only the forum software itself, but also all the mods / hacks that have been installed. One should not take the risk and trust that the hacker has already changed nothing in the files.
To correct and secure the current installation, you should perform the following things:
Server Configuration
- Install latest version of PHP
- Install latest version of MySQL
- Perform operating system updates
- Always prefer using a Dedicated Hosting platform
- Increase security by Installing Suhosin PHP protection security patch.
- Install ModSecurity. Installing ModSecurity may affect the performance of the server, so it is advised to use a caching system like APC or eAccelerator.
- Disable all unnecessary services
Securing PHP
- Disable PHP extensions
- expose_php = Off
- display_errors = Off
- enable_dl = Off
- allow_url_include = Off
- disable_functions = system, shell_exec, popen, pclose, proc_open, proc_close, proc_get_status, proc_nice, proc_terminate, exec, passthru, show_source, ReadFile, escapeshellcmd, escapeshellarg
- One must be careful when disabling these functions, because so many scripts need some of these functions. So you should run tests if PHP applications still work, if one excludes these functions.
Securing MySQL Database Server
- Set password for root user
- Administrators accounts only allow localhost
- Skip database access from external computers to prevent
Securing Apache Web server
- Disable all modules that are not required
- All security-relevant setting should be integrated directly in the httpd.conf, not in .htaccess file
Monitoring Measures:
Once the forum returns to normal and is functioning normally, you should carry out more in the first term monitoring measures. If you wish you can use a special software or use Snort which is a network intrusion detection system as well as modsecurity to derive a comprehensive overview of the occurring events. The monitoring should be performed at least half an year, before it should switch back to “normal status”.
Unfortunately, it is often the case that is due to a lack of backup, the compromised system can disappear entirely from the network. A reconstruction of a business forum or any other project is often no longer feasible – either financially or because of the enormous time and effort. If the user data is gone and you don’t have backup of it, it looks very bad. When you are in this situation again from scratch, then you must not lose hope. But once you know, learn from mistakes, and make sure you backup your data offsite using an offsite backup hosting plan.
Related Posts:
