Jump to content

Welcome to We Got Served Forums
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. If you already have an account, login here - otherwise create an account for free today!
Photo

I Got Hacked; Need Help

- - - - - hacked port attack security log

  • Please log in to reply
3 replies to this topic

#1
LeRoi

LeRoi

    Member

  • Members
  • PipPip
  • 11 posts
All,

I set up a WHS 2011 2 months ago with 3 users and one HTPC computer connected (win7 Pro). I configured the WHS server and installed one add in; drive pool. This server is mostly used for movies and pictures and to gain acces from my Android phone. It is attached to a Zyxel router with NAT and I added the ip from the sever as a dedicated server to gain remote access. Firewall is up, virusscanner (AVG) on. I installed remote alert but this add in only works in V1. As for now, the WHS setup is still very standard, straight forward done.

After a week out I got home and I noticed my files in the server map were deleted and one map was added in 'document' ; 'this computer is hacked'. The creation date was 15-4-2012 with time stamp. In the security log I could identify the attacker with his computer name and ip address. Then I got puzzled; there was no user name, the directories were only 'everybody' was added in the security tab, were messed up (I hope). I saw a lot of attacks during the week from other IP addresses all over the world (I checked them all over a week and added them to the firewall, as I do regulary). He/she did not get to the directories where only one or two users had access to. The administrator account and directories are untouched. None of the passwords are changed.

Can somebody give me some advise?
- How did the attacker came in? How to check this?
- How can I monitor and prefend this in the future?
- How do I check the current install is not compromised (progs are installed to gain access again)?
- Where to look

I do not want to install the whole server again as I did with WHS v1 once and did not get access to homeserver.com anymore, the certificate didn't match etc.

Thx in advance.
Roi

This is the log from the security logbook which stated the attacker came in (it's in Dutch but the lay-out is similar ro the English version).

Er is een account aangemeld.
Onderwerp:
Beveiligings-id: NULL SID
Accountnaam: -
Accountdomein: -
Aanmeldings-id: 0x0
Aanmeldingstype: 3
Nieuwe aanmelding:
Beveiligings-id: ANONIEME LOGON
Accountnaam: ANONIEME LOGON
Accountdomein: NT AUTHORITY
Aanmeldings-id: 0x702bff9
Aanmeldings-GUID: {00000000-0000-0000-0000-000000000000}
Procesgegevens:
Proces-id: 0x0
Naam proces: -
Netwerkgegevens:
Naam van werkstation: COMPUTER-PC
Netwerkadres van bron: 82.173.125.222
Poort van bron: 59510
Gedetailleerde verificatiegegevens:
Aanmeldingsproces: NtLmSsp
Verificatiepakket: NTLM
Doorgezette services: -
Pakketnaam (alleen NTLM): NTLM V1
Sleutellengte: 128
Deze gebeurtenis wordt gegenereerd wanneer een aanmeldingssessie wordt gemaakt. De gebeurtenis wordt gegenereerd op de computer waartoe toegang wordt verkregen.


Upgrade to a WGS Supporter Account to remove this ad.

#2
Drashna Jaelre (WGS)

Drashna Jaelre (WGS)

    Tinkerer

  • Lead Moderator
  • 14,784 posts
  • Gender:Male
  • Location:San Diego, CA, USA
  • Interests:Computers, Home Server (obviously), math, science, good books, friends
My guess is that they used some security exploit in IIS. You *are* updating the server promptly, and keeping it fully up to date, right?

Also, IIRC, there is a way to block IP's in IIS, which may be a very good idea.

And I'd highly recommend installing a virus scanner, just in case.

#3
LeRoi

LeRoi

    Member

  • Members
  • PipPip
  • 11 posts
Thanks for your reply, Drashna.

Yes, updates and virusscanner are installed from the beginning. A vulnability in IIS is also the only thing I can imagine.

Attacks stopped after a while cause I rerouted the ports from the server and renamed the administrator account and group. Off course I changes every password straight away.

The only problem now is that I can't connect to http://SERVER/CONNECT but still can acces through the https:***.homeserver.com login. This is a problem cause the client computer can now not connect to the dashboard but can access the shares in the workgroup. Pitty cause now the 'green button' doesn't show the server anymore. Restoring to default didn't make a difference. It only works when I disable the firewall on the server and after the attack I do not want that.

#4
LeRoi

LeRoi

    Member

  • Members
  • PipPip
  • 11 posts
Solved: I made a rule in the firewall which allow the local computers (range of local ip-addresses) to get access through a range of ports. Now http://server/connect is now accessible and backups are running again.

The 'green' button is working again on the HTPC. Love it!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users


Upgrade to a WGS Supporter Account to remove this ad.