LeRoi

I Got Hacked; Need Help

4 posts in this topic

All,

I set up a WHS 2011 2 months ago with 3 users and one HTPC computer connected (win7 Pro). I configured the WHS server and installed one add in; drive pool. This server is mostly used for movies and pictures and to gain acces from my Android phone. It is attached to a Zyxel router with NAT and I added the ip from the sever as a dedicated server to gain remote access. Firewall is up, virusscanner (AVG) on. I installed remote alert but this add in only works in V1. As for now, the WHS setup is still very standard, straight forward done.

After a week out I got home and I noticed my files in the server map were deleted and one map was added in 'document' ; 'this computer is hacked'. The creation date was 15-4-2012 with time stamp. In the security log I could identify the attacker with his computer name and ip address. Then I got puzzled; there was no user name, the directories were only 'everybody' was added in the security tab, were messed up (I hope). I saw a lot of attacks during the week from other IP addresses all over the world (I checked them all over a week and added them to the firewall, as I do regulary). He/she did not get to the directories where only one or two users had access to. The administrator account and directories are untouched. None of the passwords are changed.

Can somebody give me some advise?

- How did the attacker came in? How to check this?

- How can I monitor and prefend this in the future?

- How do I check the current install is not compromised (progs are installed to gain access again)?

- Where to look

I do not want to install the whole server again as I did with WHS v1 once and did not get access to homeserver.com anymore, the certificate didn't match etc.

Thx in advance.

Roi

This is the log from the security logbook which stated the attacker came in (it's in Dutch but the lay-out is similar ro the English version).

Er is een account aangemeld.

Onderwerp:

Beveiligings-id: NULL SID

Accountnaam: -

Accountdomein: -

Aanmeldings-id: 0x0

Aanmeldingstype: 3

Nieuwe aanmelding:

Beveiligings-id: ANONIEME LOGON

Accountnaam: ANONIEME LOGON

Accountdomein: NT AUTHORITY

Aanmeldings-id: 0x702bff9

Aanmeldings-GUID: {00000000-0000-0000-0000-000000000000}

Procesgegevens:

Proces-id: 0x0

Naam proces: -

Netwerkgegevens:

Naam van werkstation: COMPUTER-PC

Netwerkadres van bron: 82.173.125.222

Poort van bron: 59510

Gedetailleerde verificatiegegevens:

Aanmeldingsproces: NtLmSsp

Verificatiepakket: NTLM

Doorgezette services: -

Pakketnaam (alleen NTLM): NTLM V1

Sleutellengte: 128

Deze gebeurtenis wordt gegenereerd wanneer een aanmeldingssessie wordt gemaakt. De gebeurtenis wordt gegenereerd op de computer waartoe toegang wordt verkregen.

Share this post


Link to post
Share on other sites

Upgrade to a WGS Supporter Account to remove this ad.

My guess is that they used some security exploit in IIS. You *are* updating the server promptly, and keeping it fully up to date, right?

Also, IIRC, there is a way to block IP's in IIS, which may be a very good idea.

And I'd highly recommend installing a virus scanner, just in case.

Share this post


Link to post
Share on other sites

Thanks for your reply, Drashna.

Yes, updates and virusscanner are installed from the beginning. A vulnability in IIS is also the only thing I can imagine.

Attacks stopped after a while cause I rerouted the ports from the server and renamed the administrator account and group. Off course I changes every password straight away.

The only problem now is that I can't connect to http://SERVER/CONNECT but still can acces through the https:***.homeserver.com login. This is a problem cause the client computer can now not connect to the dashboard but can access the shares in the workgroup. Pitty cause now the 'green button' doesn't show the server anymore. Restoring to default didn't make a difference. It only works when I disable the firewall on the server and after the attack I do not want that.

Share this post


Link to post
Share on other sites

Solved: I made a rule in the firewall which allow the local computers (range of local ip-addresses) to get access through a range of ports. Now http://server/connect is now accessible and backups are running again.

The 'green' button is working again on the HTPC. Love it!

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now



Upgrade to a WGS Supporter Account to remove this ad.



  • Posts

    • So I currently have Windows Server 2012 Essentials (running in a Hyper-V VM) and am thinking about migrating to a Windows 10 server. I have 12 disks or so on the server all configured via Storage spaces. Can I simply connect these disks up to a Windows 10 install and have all the files appear? From what I have read the storage space info is all on the disks and it should work, but has anyone here actually tried it and succeeded. I have 10+ TB of data and the easiest way to get it to the new server would be to just connect the disks up.   Thanks, -Bill
    • Did you try CC cleaner or a disk clean up program? It seems to me that old files merged or not are still existing, do you have external storage that you could export the known good files to while you reformat and clean the 6TB?
    • Hello Is it possible to clone an external HDD containing the server backup to another external HDD? The external HDD doesn't have a drive letter, so how can I clone the drive?  I have two external drives in a Dual Dockingstation (2 drives), which has a button to clone from A to B, but I don't trust that solution too much..
    • I have a whs 2011 server, which has been running fine for years, however since I have updated the client pc's to windows 10 anniversary edition I am constantly getting a services not running error on clients, having checked the services, all are in the correct state, I have tried restarting some of the obvious ones, but with no success. if I select the fix option in the alert list for the error, it clears, but then returns after 20 mins or so. Not sure what to do next to solve this.
    • well it took a great deal of time but the repair made it possible for the cleanup to go pass the 14% strange however is that even though I told it to delete all the bad backups and merge the good ones it did not clear up any of the disk space. And adding all the good merge backup sizes together shows there should be the normal 6Tb free available. So the failed backups are gone the good backups are all merged but the disk space remains at 212 Mb. not sure how to tackle this I am going to look at it again this next weekend to see if I missed something.
  • Popular Contributors

    Nobody has received reputation this week.