Re: Hacked into ftp
From: karl [x y] (jamescagney90210@excite.com)
Date: 08/03/02
- Next message: karl [x y]: "Re: Attacked by UNIX Rootkit"
- Previous message: Cas Irvin [MS]: "RE: ODBC error on ASP page when accessing file on other server"
- In reply to: PP: "Hacked into ftp"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "karl [x y]" <jamescagney90210@excite.com> Date: Fri, 2 Aug 2002 19:28:32 -0400
That's not all you need to do. If you haven't already, you want to identify
how they accessed your system, so you can close that and other
vulnerabilities. If you left an FTP folder so that anonymous user could
both read and write to any one folder, then that is probably not such a big
intrusion.
However, if you failed to apply all the latest IIS and Windows patches [at
least up through March 2002] then a hacker could have used IIS or another
means to install back doors to compromise your system. Once this happens,
the only way to be sure you've removed all the back doors allowing access to
your system is to format, reinstall windows and everything else and secure
it correctly before making it internet-visible.
You can try to detect certain types of installed hacker software by running
fport from foundstone.com and looking for unusual ports and/or programs.
You can also try looking at your IIS web server logs for log entries
mentioning .EXE or % and that also have a code 200 or 502 in that line in
the log.
Securing a Windows computer involves installing all security patches from
Microsoft and following the checklists all at www.microsoft.com/security
[and you can also find some additional recommendations and varying
checklists by searching www.google.com for "harden OR hardening
windows-2000" [or whatever your version of Windows is]. You also want to
consider both software and hardware firewalls, starting at the low end with
Sygate software firewall [free for non-commercial use] and Netgear
"firewall" routers [starting at $70 US], an antivirus program like Norton
that is configured by you to download updates every day, etc.
The books Incident Response and Hacking Exposed 3rd edition are good ways to
start learning about how to recognize and deal with intrusions and how to
defend against them.
"PP" <Priyapatel@comprisetechnologies.com> wrote in message
news:057801c23a68$42c742c0$36ef2ecf@tkmsftngxa12...
Hello Everyone ...
I have people hacked into my ftp server directory and
use it to save files. I try to delet them but Can't
delete them.. They have space in directory or "com1;
¥™¨©¨¥¤quit" which I can't delet them... Does any one know
how I can delete them.
My server is win2000
Thanks
Priya
- Next message: karl [x y]: "Re: Attacked by UNIX Rootkit"
- Previous message: Cas Irvin [MS]: "RE: ODBC error on ASP page when accessing file on other server"
- In reply to: PP: "Hacked into ftp"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
