How to detect hackers on your web
server
Catch hackers red handed through real-time security event
log monitoring
A discussion of the methods used by hackers to attack IIS web servers, and how you can use event log monitoring on your web server to be alerted to successful attacks immediately.
WWW.GFI.COM How to detect hackers on your web server . 2
Introduction This white paper focuses on how administrators can set up their web servers successfully and safely. Describing the tools used by hackers to gain backdoor access to your IIS web servers, this paper details the necessary steps to detect successful intrusions on your network, as well as explaining how to prevent such attacks to your web server.
Introduction....................................................................................................................................2 Hacking a web server is not difficult..............................................................................................2 Tools of the hacker trade...............................................................................................................3 Intrusion detection by monitoring key system files........................................................................5 How to detect attacks on your server............................................................................................6 About GFI LANguard Security Event Log Monitor (S.E.L.M.) .....................................................11 About GFI ....................................................................................................................................12
Hacking a web server is not difficult Internet Information Services (IIS) web servers are highly popular among business organizations, with more then 6 million installations worldwide. Unfortunately, this makes IIS web servers also a popular target amongst hackers. As a result, every so often, new exploits emerge which endanger your IIS web server's integrity and stability.
Many administrators have a hard time keeping up with the various security patches released for IIS to cope with each new exploit, making it easy for malicious users to find a vulnerable web server on the Internet. Taking advantage of an exploit is not difficult with the appropriate hacker tools - these enable the average teenage hacker to easily attack and even control your web server, with the possibility of penetrating your internal network.
In other words, it is not too difficult for outsiders to access proprietary corporate information. Worse still, hackers need not be teenagers out for a thrill, as is commonly presumed: disgruntled employees and competitors, for instance, may have their own reasons for breaking into confidential areas of your network.
Few hacker attacks are actually instantly recognizable as such, and fewer still become high profile affairs reported in the media. Most attacks are not easy to discover because many intruders prefer to remain hidden so that they can use the IIS web server they have hacked as a launch base for attacks on far more important or popular web servers. Apart from endangering your own web site's integrity, such use of your server can render you liable should it be used to launch an attack on another organization.
WWW.GFI.COM How to detect hackers on your web server . 3
Tools of the hacker trade Many tools exist to facilitate hackers who wish to deface a web site. Such tools are so easy to use that even someone with no prior hacking experience can make a mess out of a web server in no time at all.
The Internet Printing Protocol (IPP) exploit
IPP exploit made easy
A program that makes use of this exploit is Internet Printing Protocol Exploit v.0.15 (see figure above). This is based on the infamous original exploit code in a C program file named "jill.c", made public by a hacker using the alias "dark spyrit".
This application uses a vulnerability in the IPP buffer overflow on an IIS web server. All the hacker needs to do is type in the name of the targeted web server (or a computer with IIS installed on it) and click on "Connect".
Upon connecting, the application... [download for more]
